Problem z grami!

Tymbark1L · 18 Czerwca 2016

Cześć! Otóż mam taki problem, że gry same mi się wyłączają... Gdy gram w wiedźmina 2 po ok. 10 minutach grania gra sama mi się wyłącza. Tak samo mam z cs go. Dodam jeszcze że kilka razy miałem blue screena. Mój system to windows 7. Na starym komputerze tak nie miałem. Wszystko chodziło sprawnie...

Płyta główna: ASUS H110M-K D3
Procesor: i5 6400
Karta Graficzna: Gigabyte GTX950 WindForce II OC

Logi:

GMER 2.2.19882 - http://www.gmer.net

Rootkit scan 2016-06-18 14:01:12

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000069 WD_____ rev.01.0 931,51GB

Running: 9b1dqn1o.exe; Driver: C:\Users\PAWE~1\AppData\Local\Temp\kwddrkog.sys

---- User code sections - GMER 2.2 ----

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 000000004a650480

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 000000004a650470

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 000000004a650360

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 000000004a650490

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 000000004a6503d0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 000000004a650310

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0xffffffffd387ec90}

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 000000004a6503a0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 000000004a650380

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 000000004a6502d0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 000000004a6502c0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 000000004a650300

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 000000004a6503b0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 000000004a650440

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 000000004a6503e0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 000000004a650220

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 000000004a6504a0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 000000004a650390

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 000000004a6502e0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 000000004a650340

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 000000004a650280

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 000000004a6502a0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 000000004a6503c0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 000000004a650320

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 000000004a650410

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 000000004a650230

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 000000004a6503f0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 000000004a6501d0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 000000004a650240

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 000000004a6504b0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 000000004a6504c0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 000000004a6502f0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 000000004a650350

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 000000004a650290

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 000000004a6502b0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 000000004a650370

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 000000004a650330

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 000000004a650460

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 000000004a650420

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 000000004a650250

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 000000004a650260

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 000000004a650400

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 000000004a6501e0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 000000004a650200

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 000000004a6501f0

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 000000004a650430

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 000000004a650450

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 000000004a650210

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 000000004a650270

.text C:\Windows\system32\csrss.exe[576] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0xffffffffd387d690}

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\wininit.exe[640] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 000000004a650480

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 000000004a650470

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 000000004a650360

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 000000004a650490

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 000000004a6503d0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 000000004a650310

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0xffffffffd387ec90}

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 000000004a6503a0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 000000004a650380

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 000000004a6502d0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 000000004a6502c0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 000000004a650300

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 000000004a6503b0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 000000004a650440

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 000000004a6503e0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 000000004a650220

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 000000004a6504a0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 000000004a650390

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 000000004a6502e0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 000000004a650340

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 000000004a650280

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 000000004a6502a0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 000000004a6503c0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 000000004a650320

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 000000004a650410

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 000000004a650230

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 000000004a6503f0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 000000004a6501d0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 000000004a650240

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 000000004a6504b0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 000000004a6504c0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 000000004a6502f0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 000000004a650350

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 000000004a650290

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 000000004a6502b0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 000000004a650370

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 000000004a650330

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 000000004a650460

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 000000004a650420

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 000000004a650250

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 000000004a650260

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 000000004a650400

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 000000004a6501e0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 000000004a650200

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 000000004a6501f0

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 000000004a650430

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 000000004a650450

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 000000004a650210

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 000000004a650270

.text C:\Windows\system32\csrss.exe[668] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0xffffffffd387d690}

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\services.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\lsass.exe[736] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\lsm.exe[744] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\winlogon.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000000060480

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000000060470

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000000060360

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000000060490

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 00000000000603d0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000000060310

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0xffffffff8928ec90}

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 00000000000603a0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000000060380

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 00000000000602d0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 00000000000602c0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000000060300

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 00000000000603b0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000000060440

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 00000000000603e0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000000060220

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 00000000000604a0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000000060390

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 00000000000602e0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000000060340

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000000060280

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 00000000000602a0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 00000000000603c0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000000060320

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000000060410

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000000060230

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 00000000000603f0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 00000000000601d0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000000060240

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 00000000000604b0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 00000000000604c0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 00000000000602f0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000000060350

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000000060290

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 00000000000602b0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000000060370

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000000060330

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000000060460

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000000060420

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000000060250

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000000060260

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000000060400

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 00000000000601e0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000000060200

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 00000000000601f0

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000000060430

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000000060450

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000000060210

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000000060270

.text C:\Windows\system32\nvvsvc.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0xffffffff8928d690}

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\svchost.exe[160] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\System32\svchost.exe[580] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\System32\svchost.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\svchost.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\AUDIODG.EXE[1136] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\Dwm.exe[1464] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\Explorer.EXE[1492] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\System32\spoolsv.exe[1620] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000000070480

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000000070470

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000000070360

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000000070490

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 00000000000703d0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000000070310

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0xffffffff8929ec90}

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 00000000000703a0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000000070380

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 00000000000702d0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 00000000000702c0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000000070300

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 00000000000703b0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000000070440

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 00000000000703e0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000000070220

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 00000000000704a0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000000070390

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 00000000000702e0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000000070340

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000000070280

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 00000000000702a0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 00000000000703c0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000000070320

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000000070410

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000000070230

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 00000000000703f0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 00000000000701d0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000000070240

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 00000000000704b0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 00000000000704c0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 00000000000702f0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000000070350

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000000070290

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 00000000000702b0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000000070370

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000000070330

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000000070460

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000000070420

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000000070250

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000000070260

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000000070400

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 00000000000701e0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000000070200

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 00000000000701f0

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000000070430

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000000070450

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000000070210

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000000070270

.text C:\Windows\system32\svchost.exe[1664] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0xffffffff8929d690}

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\taskeng.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\taskhost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\svchost.exe[1252] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2644] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000074ec1bb2 5 bytes JMP 0000000001108c60

.text C:\Program Files (x86)\Skype\Phone\Skype.exe[2680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075341465 2 bytes [34, 75]

.text C:\Program Files (x86)\Skype\Phone\Skype.exe[2680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753414bb 2 bytes [34, 75]

.text ... * 2

.text C:\Program Files\AVAST Software\Avast\avastui.exe[2736] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000074b387c9 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000000070480

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000000070470

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000000070360

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000000070490

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 00000000000703d0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000000070310

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0xffffffff8929ec90}

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 00000000000703a0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000000070380

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 00000000000702d0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 00000000000702c0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000000070300

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 00000000000703b0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000000070440

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 00000000000703e0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000000070220

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 00000000000704a0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000000070390

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 00000000000702e0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000000070340

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000000070280

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 00000000000702a0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 00000000000703c0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000000070320

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000000070410

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000000070230

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 00000000000703f0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 00000000000701d0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000000070240

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 00000000000704b0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 00000000000704c0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 00000000000702f0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000000070350

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000000070290

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 00000000000702b0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000000070370

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000000070330

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000000070460

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000000070420

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000000070250

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000000070260

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000000070400

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 00000000000701e0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000000070200

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 00000000000701f0

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000000070430

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000000070450

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000000070210

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000000070270

.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2804] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0xffffffff8929d690}

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\wbem\wmiprvse.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\SearchIndexer.exe[2324] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\SearchProtocolHost.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[2700] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\svchost.exe[2296] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Windows\system32\conhost.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000000070480

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000000070470

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000000070360

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000000070490

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 00000000000703d0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000000070310

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0xffffffff8929ec90}

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 00000000000703a0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000000070380

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 00000000000702d0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 00000000000702c0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000000070300

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 00000000000703b0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000000070440

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 00000000000703e0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000000070220

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 00000000000704a0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000000070390

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 00000000000702e0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000000070340

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000000070280

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 00000000000702a0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 00000000000703c0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000000070320

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000000070410

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000000070230

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 00000000000703f0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 00000000000701d0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000000070240

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 00000000000704b0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 00000000000704c0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 00000000000702f0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000000070350

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000000070290

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 00000000000702b0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000000070370

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000000070330

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000000070460

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000000070420

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000000070250

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000000070260

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000000070400

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 00000000000701e0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000000070200

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 00000000000701f0

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000000070430

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000000070450

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000000070210

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000000070270

.text C:\Windows\System32\svchost.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0xffffffff8929d690}

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000076f30480

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000076f30470

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000076f30360

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000076f30490

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 0000000076f303d0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000076f30310

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0x15ec90}

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 0000000076f303a0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000076f30380

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 0000000076f302d0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 0000000076f302c0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000076f30300

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 0000000076f303b0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000076f30440

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 0000000076f303e0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000076f30220

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 0000000076f304a0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000076f30390

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 0000000076f302e0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000076f30340

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000076f30280

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 0000000076f302a0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 0000000076f303c0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000076f30320

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000076f30410

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000076f30230

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 0000000076f303f0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 0000000076f301d0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000076f30240

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 0000000076f304b0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 0000000076f304c0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 0000000076f302f0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000076f30350

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000076f30290

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 0000000076f302b0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000076f30370

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000076f30330

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000076f30460

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000076f30420

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000076f30250

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000076f30260

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000076f30400

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 0000000076f301e0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000076f30200

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 0000000076f301f0

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000076f30430

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000076f30450

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000076f30210

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000076f30270

.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4312] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0x15d690}

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076dd13c0 5 bytes JMP 0000000000170480

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076dd1410 5 bytes JMP 0000000000170470

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076dd1570 5 bytes JMP 0000000000170360

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076dd15c0 5 bytes JMP 0000000000170490

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076dd15d0 5 bytes JMP 00000000001703d0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076dd1680 1 byte JMP 0000000000170310

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 2 0000000076dd1682 3 bytes {JMP 0xffffffff8939ec90}

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076dd16b0 5 bytes JMP 00000000001703a0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076dd16d0 5 bytes JMP 0000000000170380

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076dd1710 5 bytes JMP 00000000001702d0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076dd1790 5 bytes JMP 00000000001702c0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076dd17b0 5 bytes JMP 0000000000170300

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076dd17f0 5 bytes JMP 00000000001703b0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 0000000076dd1830 5 bytes JMP 0000000000170440

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076dd1840 5 bytes JMP 00000000001703e0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076dd19a0 5 bytes JMP 0000000000170220

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076dd1b60 5 bytes JMP 00000000001704a0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076dd1b90 5 bytes JMP 0000000000170390

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076dd1c70 5 bytes JMP 00000000001702e0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076dd1c80 5 bytes JMP 0000000000170340

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076dd1ce0 5 bytes JMP 0000000000170280

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076dd1d70 5 bytes JMP 00000000001702a0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076dd1d90 5 bytes JMP 00000000001703c0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076dd1da0 5 bytes JMP 0000000000170320

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076dd1e10 5 bytes JMP 0000000000170410

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076dd1e40 5 bytes JMP 0000000000170230

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076dd1fe0 5 bytes JMP 00000000001703f0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076dd2100 5 bytes JMP 00000000001701d0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076dd21c0 5 bytes JMP 0000000000170240

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076dd21f0 5 bytes JMP 00000000001704b0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076dd2200 5 bytes JMP 00000000001704c0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076dd2230 5 bytes JMP 00000000001702f0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076dd2240 5 bytes JMP 0000000000170350

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076dd22a0 5 bytes JMP 0000000000170290

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076dd22f0 5 bytes JMP 00000000001702b0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076dd2320 5 bytes JMP 0000000000170370

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076dd2330 5 bytes JMP 0000000000170330

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076dd2620 5 bytes JMP 0000000000170460

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtResumeProcess 0000000076dd2780 5 bytes JMP 0000000000170420

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076dd2820 5 bytes JMP 0000000000170250

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076dd2830 5 bytes JMP 0000000000170260

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076dd2840 5 bytes JMP 0000000000170400

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076dd2a00 5 bytes JMP 00000000001701e0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076dd2a10 5 bytes JMP 0000000000170200

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076dd2a80 5 bytes JMP 00000000001701f0

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076dd2ae0 5 bytes JMP 0000000000170430

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076dd2af0 5 bytes JMP 0000000000170450

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076dd2b00 5 bytes JMP 0000000000170210

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076dd2be0 1 byte JMP 0000000000170270

.text C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe[5464] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl + 2 0000000076dd2be2 3 bytes {JMP 0xffffffff8939d690}

---- Threads - GMER 2.2 ----

Thread C:\Windows\Explorer.EXE [1492:2772] 000007fef1fe2118

---- Files - GMER 2.2 ----

File C:\ProgramData\NVIDIA Corporation\NetService\0e79401f-ab8e-440f-9a4b-1bb6f3e6d69a\368.39-desktop-win8-win7-winvista-64bit-international-whql-g.exe (size mismatch) 340787200/0 bytes executable

---- EOF - GMER 2.2 ----

Temperatury:

Tymbark1L · 18 Czerwca 2016

@ref

Tymbark1L · 22 Czerwca 2016

@MrSanten było kilka podczas grania, były po wyłączeniu gry oraz były też podczas oglądania filmu. Blue screenów w ciągu 5 dni było ok. 15. Słowa z pierwszych 2 blue screenów to antywirus. Więc zainstalowałem od nowa antywirusa avast i potem nie było blue screenów z antiwirusem, ale potem robiły się blue screeny chyba z powodu sterowników.

Tymbark1L · 22 Czerwca 2016

@ref

MrSanten · 21 Czerwca 2016

Uruchamiasz program w zgodności?

Jakub · 20 Czerwca 2016

Sprawdzałeś temperatury podczas gry?

Od dawna tak masz?

Zaczęło się to dziać dopiero kiedy wzrosły temperatury na zewnątrz?

Pasta pod radiatorem była kiedykolwiek wymieniana?

Masz dobrą cyrkulacje powietrza w obudowie?

Dzieje się tak tylko w bardziej wymagających grach?

MrSanten · 22 Czerwca 2016

Bluescreen był podczas grania?

Tymbark1L · 21 Czerwca 2016

@MrSanten W gry gram przez platforme steam. A Steam włączam bez trybu zgodności.

Jakub · 21 Czerwca 2016

A sprawdzałeś jak wygląda zużycie CPU/RAM podczas gry? Może jakiś proces/program w tle zużywa zasoby, na grę zaczyna brakować i system po prostu zabija proces.

Tymbark1L · 20 Czerwca 2016

@ref

Jakub · 25 Czerwca 2016

https://support.microsoft.com/pl-pl/kb/980932

https://support.microsoft.com/pl-pl/kb/2832829

Tymbark1L · 21 Czerwca 2016

@ref @MrSanten @Wolen

Tymbark1L · 25 Czerwca 2016

@ref

Ktosiu · 18 Czerwca 2016

Gdzie logi i sprawdzenie temperatur ?

Tymbark1L · 18 Czerwca 2016

Zaraz dodam!

MrSanten · 25 Czerwca 2016

Sprawdź powód bluescreen'ów za pomocą programu BluescreenView.

Tymbark1L · 21 Czerwca 2016

@Wolen
Zaktualizowałem windows 7 do windows 10 i problem nadal występuję.

Informacje z menadżera zadań:

Tymbark1L · 20 Czerwca 2016

@Wolen
- Screen z temperaturami został zrobiony kiedy grałem w wiedźmina 2,
- Miałem to już kiedy po raz pierwszy zainstalowałem cs go,
- Raczej nie. Myślę że to wina systemu, ponieważ jest on chyba nieoryginalny. (Pożyczony od kolegi),

- To jest nowy komputer,
- Raczej tak,
- Dzieje się tak we wszystkich grach. Jeszcze dodam że gdy w cs go włączam renderowanie wielordzeniowe to po załadowaniu mapy od razu cs go mi się wyłącza.

Tymbark1L · 26 Czerwca 2016

@MrSanten kupiłem gotowego kompa ze strony x-kom.
To ten komputer:

http://www.x-kom.pl/p/259744-desktop-x-kom-tesla-gb-500-i5-6400-gtx950-8gb-1tb.html

Tymbark1L · 24 Czerwca 2016

@ref

MrSanten · 26 Czerwca 2016

To jest jakiś problem z pamięcią RAM. Ile masz RAM-u? Niedawno wymieniałeś czy coś?

Tymbark1L · 25 Czerwca 2016

@Wolen przed chwilą podczas oglądania filmu na youtube zrobił mi się bluescreen:

Tymbark1L · 25 Czerwca 2016

1.

2.

Zaloguj się

👋 Witaj na MPCForum!

Problem z grami!

Pytanie

22 odpowiedzi na to pytanie

Rekomendowane odpowiedzi

Zarchiwizowany