Servus zusammen,
ich habe vor ein paar Tagen mein Betriebssystem neu aufgesetzt ( W7 Home Premium x64)
MB Treiber, sprich Soundcard, Lan-Adapter, Onboard-Graka und USB Treiber sind schon drauf und funktionieren fast Problemlos.
Denn mein Lan-Adapter ( Realtek PCIe GBI Family Adapter) hat eine vermeintlich fiese Macke.

Der Adapter startet wie im Threadtitel angegeben nur mit eingeschränkter Konnektivität.
Wenn ich den Lan-Adapter nun über die Adapter-Einstellungen deaktiviere und wieder aktiviere scheint das Problem behoben zu sein.
Allerdings tritt das Problem nach jedem Neustart wieder auf, sodass ich oben genannte Schritte wiederholen muss.

Ich hatte die Idee eine Batch zu schreiben die das "Automatisch" übernimmt, aber das kann keine Lösung sein, da das Problem an sich damit ja nicht behoben wird.

Es sind nur die FRST Logs angehängt, da GMER bei mir im Scanvorgang einfach mal in den Programmstreik tritt.


In diesem Sinne
Palpatine

Tante Edit die Erste: GMER Log kann nun doch angehängt werden, allerdings konnte ich kein Show-All benutzen, weshalb auch immer.

Vorab: Du hast das GMER.log nur als zip Datei angehängt. Wäre schön, die Log-Datei zu sehen.

Du hast Avast AV und Windowsdefender aktiv ! 2 AV-Programme behindern sich, bremsen das System und können unvorhersehbare Probleme auslösen. Entscheide dich für eines und deaktiviere/deinstalliere das andere.

Du hast Avastonline Security aktiviert. Sog. Webschutzsoftware hat zweifelhaften nutzen und bremst auch oft das System aus.

Es sind mehrere BHO's (browserhelperobjects) installiert. Das sind meist Toolbars ohne effektiven Nutzen. Siehe Wikipedia dazu.

Falls du Java nicht zwingend benötigst, würde ich es aus Sicherheitsgründen deinstallieren.

Das alles muss mit dem eigentlichen Problem nicht zusammenhängen es sind aber wichtige Hinweise und vllt. hilfts auch das Problem zu beheben.

Hast du mal auf der ASUS-Seite nach einem aktuelleren LAN-Treiber bzw. Boardtreiber geschaut ? Evtl. ist dein BIOS einfach nicht up-to-date.

Zitat von Darklord666

Vorab: Du hast das GMER.log nur als zip Datei angehängt. Wäre schön, die Log-Datei zu sehen.

Entschuldigung, wusste nicht das Zips nicht gelten ^^

Zitat von Darklord666

Du hast Avast AV und Windowsdefender aktiv ! 2 AV-Programme behindern sich, bremsen das System und können unvorhersehbare Probleme auslösen. Entscheide dich für eines und deaktiviere/deinstalliere das andere.

Der Windows Defender dürfte jetzt deaktiviert sein, sodass nur noch Avast läuft

Zitat von Darklord666

Du hast Avastonline Security aktiviert. Sog. Webschutzsoftware hat zweifelhaften nutzen und bremst auch oft das System aus.

Jetzt verstehe ich gerade nur Bahnhof. Oben schreibst du das ich mich entscheiden soll und jetzt kommt das VETO. Was wäre denn deiner Meinung nach zu empfehlen.

Zitat von Darklord666

Es sind mehrere BHO's (browserhelperobjects) installiert. Das sind meist Toolbars ohne effektiven Nutzen. Siehe Wikipedia dazu.

Wenn du mir dann bitte noch verraten könntest welches diese BHO´s sind und wie ich sie loswerde ohne in der Reg rumfriemeln zu müssen, dann wäre ich dir dankbar dafür

Zitat von Darklord666

Falls du Java nicht zwingend benötigst, würde ich es aus Sicherheitsgründen deinstallieren.

Negativ, Java wird für einige Webseiten gebraucht und eins meiner Spiele läuft ohne Java gar nicht erst (Nein kein Minecraft )

Zitat von Darklord666

Hast du mal auf der ASUS-Seite nach einem aktuelleren LAN-Treiber bzw. Boardtreiber geschaut ? Evtl. ist dein BIOS einfach nicht up-to-date.

Als ich den Computer neu aufgesetzt habe, habe ich vorher alle möglichen Treiberdaten frisch heruntergeladen. Das dürfte dann, denke ich, auszuschliessen sein.
Bios KANN sein, da ich ungerne an eben diesem herumdoktore.
Nenn mich einen DAU, aber solche Dinge sind mir zu heiss, als das ich daran feuchtfröhlich herumexperimentiere

Der Erste Teil des GMER Logs, der ist zu groß für die bescheidene Zeichengröße von 122k Zeichen ^^

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-21 10:49:13
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HDP725050GLA360 rev.GM4OA5CA 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Tiger\AppData\Local\Temp\kgloipow.sys


---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      000000007703ff60 5 bytes JMP 0000000149970460
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               000000007703ffb0 5 bytes JMP 0000000149970450
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000077040110 5 bytes JMP 0000000149970370
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000077040160 5 bytes JMP 0000000149970470
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000077040170 5 bytes JMP 00000001499703e0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000077040220 5 bytes JMP 0000000149970320
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000077040250 5 bytes JMP 00000001499703b0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000077040270 5 bytes JMP 0000000149970390
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 00000000770402b0 5 bytes JMP 00000001499702e0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000077040330 5 bytes JMP 00000001499702d0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000077040350 5 bytes JMP 0000000149970310
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000077040390 5 bytes JMP 00000001499703c0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           00000000770403e0 5 bytes JMP 00000001499703f0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000077040540 5 bytes JMP 0000000149970230
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000077040700 5 bytes JMP 0000000149970480
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000077040730 5 bytes JMP 00000001499703a0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000077040810 5 bytes JMP 00000001499702f0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000077040820 5 bytes JMP 0000000149970350
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000077040880 5 bytes JMP 0000000149970290
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000077040910 5 bytes JMP 00000001499702b0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000077040930 5 bytes JMP 00000001499703d0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000077040940 5 bytes JMP 0000000149970330
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        00000000770409b0 5 bytes JMP 0000000149970410
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           00000000770409e0 5 bytes JMP 0000000149970240
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000077040ca0 5 bytes JMP 00000001499701e0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000077040d60 5 bytes JMP 0000000149970250
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000077040d90 5 bytes JMP 0000000149970490
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000077040da0 5 bytes JMP 00000001499704a0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000077040dd0 5 bytes JMP 0000000149970300
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000077040de0 5 bytes JMP 0000000149970360
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000077040e40 5 bytes JMP 00000001499702a0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000077040e90 5 bytes JMP 00000001499702c0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000077040ec0 5 bytes JMP 0000000149970380
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000077040ed0 5 bytes JMP 0000000149970340
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          00000000770411c0 5 bytes JMP 0000000149970440
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         00000000770413c0 5 bytes JMP 0000000149970260
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            00000000770413d0 5 bytes JMP 0000000149970270
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          00000000770413e0 5 bytes JMP 0000000149970400
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      00000000770415a0 5 bytes JMP 00000001499701f0
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       00000000770415b0 5 bytes JMP 0000000149970210
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000077041620 5 bytes JMP 0000000149970200
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000077041680 5 bytes JMP 0000000149970420
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000077041690 5 bytes JMP 0000000149970430
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        00000000770416a0 5 bytes JMP 0000000149970220
.text     C:\Windows\system32\csrss.exe[596] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000077041780 5 bytes JMP 0000000149970280
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\wininit.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      000000007703ff60 5 bytes JMP 0000000100120460
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               000000007703ffb0 5 bytes JMP 0000000100120450
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000077040110 5 bytes JMP 0000000100120370
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000077040160 5 bytes JMP 0000000100120470
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000077040170 5 bytes JMP 00000001001203e0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000077040220 5 bytes JMP 0000000100120320
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000077040250 5 bytes JMP 00000001001203b0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000077040270 5 bytes JMP 0000000100120390
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 00000000770402b0 5 bytes JMP 00000001001202e0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000077040330 5 bytes JMP 00000001001202d0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000077040350 5 bytes JMP 0000000100120310
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000077040390 5 bytes JMP 00000001001203c0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           00000000770403e0 5 bytes JMP 00000001001203f0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000077040540 5 bytes JMP 0000000100120230
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000077040700 5 bytes JMP 0000000100120480
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000077040730 5 bytes JMP 00000001001203a0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000077040810 5 bytes JMP 00000001001202f0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000077040820 5 bytes JMP 0000000100120350
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000077040880 5 bytes JMP 0000000100120290
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000077040910 5 bytes JMP 00000001001202b0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000077040930 5 bytes JMP 00000001001203d0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000077040940 5 bytes JMP 0000000100120330
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        00000000770409b0 5 bytes JMP 0000000100120410
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           00000000770409e0 5 bytes JMP 0000000100120240
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000077040ca0 5 bytes JMP 00000001001201e0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000077040d60 5 bytes JMP 0000000100120250
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000077040d90 5 bytes JMP 0000000100120490
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000077040da0 5 bytes JMP 00000001001204a0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000077040dd0 5 bytes JMP 0000000100120300
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000077040de0 5 bytes JMP 0000000100120360
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000077040e40 5 bytes JMP 00000001001202a0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000077040e90 5 bytes JMP 00000001001202c0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000077040ec0 5 bytes JMP 0000000100120380
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000077040ed0 5 bytes JMP 0000000100120340
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          00000000770411c0 5 bytes JMP 0000000100120440
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         00000000770413c0 5 bytes JMP 0000000100120260
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            00000000770413d0 5 bytes JMP 0000000100120270
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          00000000770413e0 5 bytes JMP 0000000100120400
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      00000000770415a0 5 bytes JMP 00000001001201f0
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       00000000770415b0 5 bytes JMP 0000000100120210
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000077041620 5 bytes JMP 0000000100120200
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000077041680 5 bytes JMP 0000000100120420
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000077041690 5 bytes JMP 0000000100120430
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        00000000770416a0 5 bytes JMP 0000000100120220
.text     C:\Windows\system32\csrss.exe[692] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000077041780 5 bytes JMP 0000000100120280
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\services.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\lsass.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                        000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                 000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                 0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                      0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                            0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                 0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                          0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                             0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                   00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                 0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                               0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                             00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                     0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                    0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                             0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                          0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                             0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                              0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                 0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                          00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                             00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                  0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                             0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                             0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                    0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                               0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                            0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                  0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                               0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                  0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                   0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                            00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                           00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                              00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                        00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                         00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                              0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                              0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                               0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                          00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\lsm.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                  0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    000000007703ff60 5 bytes JMP 0000000100070460
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             000000007703ffb0 5 bytes JMP 0000000100070450
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000077040110 5 bytes JMP 0000000100070370
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000077040160 5 bytes JMP 0000000100070470
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000077040170 5 bytes JMP 00000001000703e0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000077040220 5 bytes JMP 0000000100070320
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000077040250 5 bytes JMP 00000001000703b0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000077040270 5 bytes JMP 0000000100070390
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               00000000770402b0 5 bytes JMP 00000001000702e0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000077040330 5 bytes JMP 00000001000702d0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000077040350 5 bytes JMP 0000000100070310
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000077040390 5 bytes JMP 00000001000703c0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         00000000770403e0 5 bytes JMP 00000001000703f0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000077040540 5 bytes JMP 0000000100070230
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000077040700 5 bytes JMP 0000000100070480
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000077040730 5 bytes JMP 00000001000703a0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000077040810 5 bytes JMP 00000001000702f0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000077040820 5 bytes JMP 0000000100070350
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000077040880 5 bytes JMP 0000000100070290
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000077040910 5 bytes JMP 00000001000702b0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000077040930 5 bytes JMP 00000001000703d0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000077040940 5 bytes JMP 0000000100070330
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      00000000770409b0 5 bytes JMP 0000000100070410
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         00000000770409e0 5 bytes JMP 0000000100070240
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000077040ca0 5 bytes JMP 00000001000701e0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000077040d60 5 bytes JMP 0000000100070250
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000077040d90 5 bytes JMP 0000000100070490
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000077040da0 5 bytes JMP 00000001000704a0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000077040dd0 5 bytes JMP 0000000100070300
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000077040de0 5 bytes JMP 0000000100070360
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000077040e40 5 bytes JMP 00000001000702a0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000077040e90 5 bytes JMP 00000001000702c0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000077040ec0 5 bytes JMP 0000000100070380
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000077040ed0 5 bytes JMP 0000000100070340
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        00000000770411c0 5 bytes JMP 0000000100070440
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       00000000770413c0 5 bytes JMP 0000000100070260
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          00000000770413d0 5 bytes JMP 0000000100070270
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        00000000770413e0 5 bytes JMP 0000000100070400
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    00000000770415a0 5 bytes JMP 00000001000701f0
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     00000000770415b0 5 bytes JMP 0000000100070210
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000077041620 5 bytes JMP 0000000100070200
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000077041680 5 bytes JMP 0000000100070420
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000077041690 5 bytes JMP 0000000100070430
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      00000000770416a0 5 bytes JMP 0000000100070220
.text     C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000077041780 5 bytes JMP 0000000100070280
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000077040e40 5 bytes JMP 00000000771a02a0
vchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\System32\svchost.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
vchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\System32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\svchost.exe[1084] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
UDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\AUDIODG.EXE[1192] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
         

vchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\svchost.exe[1268] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\svchost.exe[1352] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\System32\spoolsv.exe[1488] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\svchost.exe[1540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\svchost.exe[2124] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 0000000100070460
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 0000000100070450
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 0000000100070370
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 0000000100070470
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000001000703e0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 0000000100070320
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000001000703b0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 0000000100070390
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000001000702e0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000001000702d0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 0000000100070310
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000001000703c0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000001000703f0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 0000000100070230
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 0000000100070480
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000001000703a0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000001000702f0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 0000000100070350
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 0000000100070290
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000001000702b0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000001000703d0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 0000000100070330
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 0000000100070410
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 0000000100070240
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000001000701e0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 0000000100070250
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 0000000100070490
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000001000704a0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 0000000100070300
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 0000000100070360
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000001000702a0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000001000702c0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 0000000100070380
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 0000000100070340
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 0000000100070440
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 0000000100070260
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 0000000100070270
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 0000000100070400
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000001000701f0
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 0000000100070210
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 0000000100070200
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 0000000100070420
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 0000000100070430
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 0000000100070220
.text     C:\Windows\system32\LogonUI.exe[2632] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 0000000100070280
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\atieclxx.exe[2660] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\taskhost.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                       000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                     0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                           0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                         0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                            0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                  00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                              0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                               0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                            00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                               0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                    0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                   0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                            0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                         0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                               0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                            0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                             0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                         00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                            00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                 0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                            0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                            0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                   0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                              0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                           0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                 0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                              0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                 0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                  0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                           00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                          00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                             00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                           00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                       00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                        00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                             0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                             0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                              0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                         00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\system32\Dwm.exe[2840] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                 0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                           000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                    000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                    0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                         0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                               0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                    0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                             0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                      00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                    0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                  0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                   0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                   0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                        0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                       0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                             0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                   0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                 0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                    0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                             00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                     0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                       0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                  0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                               0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                     0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                  0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                     0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                      0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                               00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                              00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                 00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                               00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                           00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                            00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                 0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                 0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                  0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                             00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\Explorer.EXE[2936] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                     0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3132] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter         0000000076a4d03c 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                             000000007703ff60 5 bytes JMP 0000000100070460
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                      000000007703ffb0 5 bytes JMP 0000000100070450
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                      0000000077040110 5 bytes JMP 0000000100070370
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                           0000000077040160 5 bytes JMP 0000000100070470
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                 0000000077040170 5 bytes JMP 00000001000703e0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                      0000000077040220 5 bytes JMP 0000000100070320
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                               0000000077040250 5 bytes JMP 00000001000703b0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                  0000000077040270 5 bytes JMP 0000000100070390
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                        00000000770402b0 5 bytes JMP 00000001000702e0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                      0000000077040330 5 bytes JMP 00000001000702d0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                    0000000077040350 5 bytes JMP 0000000100070310
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                     0000000077040390 5 bytes JMP 00000001000703c0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                  00000000770403e0 5 bytes JMP 00000001000703f0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                     0000000077040540 5 bytes JMP 0000000100070230
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                          0000000077040700 5 bytes JMP 0000000100070480
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                         0000000077040730 5 bytes JMP 00000001000703a0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                  0000000077040810 5 bytes JMP 00000001000702f0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                               0000000077040820 5 bytes JMP 0000000100070350
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                     0000000077040880 5 bytes JMP 0000000100070290
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                  0000000077040910 5 bytes JMP 00000001000702b0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                   0000000077040930 5 bytes JMP 00000001000703d0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                      0000000077040940 5 bytes JMP 0000000100070330
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                               00000000770409b0 5 bytes JMP 0000000100070410
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                  00000000770409e0 5 bytes JMP 0000000100070240
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                       0000000077040ca0 5 bytes JMP 00000001000701e0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                  0000000077040d60 5 bytes JMP 0000000100070250
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                  0000000077040d90 5 bytes JMP 0000000100070490
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                         0000000077040da0 5 bytes JMP 00000001000704a0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                    0000000077040dd0 5 bytes JMP 0000000100070300
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                 0000000077040de0 5 bytes JMP 0000000100070360
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                       0000000077040e40 5 bytes JMP 00000001000702a0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                    0000000077040e90 5 bytes JMP 00000001000702c0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                       0000000077040ec0 5 bytes JMP 0000000100070380
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                        0000000077040ed0 5 bytes JMP 0000000100070340
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                 00000000770411c0 5 bytes JMP 0000000100070440
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                00000000770413c0 5 bytes JMP 0000000100070260
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                   00000000770413d0 5 bytes JMP 0000000100070270
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                 00000000770413e0 5 bytes JMP 0000000100070400
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                             00000000770415a0 5 bytes JMP 00000001000701f0
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                              00000000770415b0 5 bytes JMP 0000000100070210
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                   0000000077041620 5 bytes JMP 0000000100070200
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                   0000000077041680 5 bytes JMP 0000000100070420
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                    0000000077041690 5 bytes JMP 0000000100070430
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                               00000000770416a0 5 bytes JMP 0000000100070220
.text     C:\Windows\system32\SearchIndexer.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                       0000000077041780 5 bytes JMP 0000000100070280
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter         0000000076a4d03c 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17              0000000075501401 2 bytes JMP 76a5eb26 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                0000000075501419 2 bytes JMP 76a6b513 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17              0000000075501431 2 bytes JMP 76ae8609 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42              000000007550144a 2 bytes CALL 76a41dfa C:\Windows\syswow64\kernel32.dll
         

Und NR 3 das Teil ist riesig -.-

.text     ...                                                                                                                          * 9
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                 00000000755014dd 2 bytes JMP 76ae7efe C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17          00000000755014f5 2 bytes JMP 76ae80d8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                 000000007550150d 2 bytes JMP 76ae7df4 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17          0000000075501525 2 bytes JMP 76ae81c2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                000000007550153d 2 bytes JMP 76a5f088 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                     0000000075501555 2 bytes JMP 76a6b885 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17              000000007550156d 2 bytes JMP 76ae86c1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                0000000075501585 2 bytes JMP 76ae8222 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                   000000007550159d 2 bytes JMP 76ae7db8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                00000000755015b5 2 bytes JMP 76a5f121 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17              00000000755015cd 2 bytes JMP 76a6b29f C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20          00000000755016b2 2 bytes JMP 76ae8584 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31          00000000755016bd 2 bytes JMP 76ae7d4d C:\Windows\syswow64\kernel32.dll
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort      000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject               000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess               0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx    0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess          0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection               0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory        0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject           0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                 00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent               0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection             0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread              0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread           00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry              0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort   0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject  0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair           0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion        0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant              0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore           0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx            0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer               0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess        00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry           00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry           0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey           0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys  0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair             0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion          0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore             0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                 0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx          00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder         00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions            00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread          00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation      00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState       00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem            0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess            0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread             0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl        00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe[3560] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\System32\svchost.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                         000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                         0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx              0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                    0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                         0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                  0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                     0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                           00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                         0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                       0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                        0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                     00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                        0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort             0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject            0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                     0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                  0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                        0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                     0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                      0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                         0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                  00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                     00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                          0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                     0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                     0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys            0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                       0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                    0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                          0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                       0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                          0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                           0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                    00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                   00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                      00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                    00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                 00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                      0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                      0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                       0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                  00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                          0000000077041780 5 bytes JMP 00000000771a0280
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                          000000007703ff60 5 bytes JMP 00000000771a0460
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                   000000007703ffb0 5 bytes JMP 00000000771a0450
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                   0000000077040110 5 bytes JMP 00000000771a0370
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                        0000000077040160 5 bytes JMP 00000000771a0470
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                              0000000077040170 5 bytes JMP 00000000771a03e0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                   0000000077040220 5 bytes JMP 00000000771a0320
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                            0000000077040250 5 bytes JMP 00000000771a03b0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                               0000000077040270 5 bytes JMP 00000000771a0390
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                     00000000770402b0 5 bytes JMP 00000000771a02e0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                   0000000077040330 5 bytes JMP 00000000771a02d0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                 0000000077040350 5 bytes JMP 00000000771a0310
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                  0000000077040390 5 bytes JMP 00000000771a03c0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                               00000000770403e0 5 bytes JMP 00000000771a03f0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                  0000000077040540 5 bytes JMP 00000000771a0230
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                       0000000077040700 5 bytes JMP 00000000771a0480
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                      0000000077040730 5 bytes JMP 00000000771a03a0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                               0000000077040810 5 bytes JMP 00000000771a02f0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                            0000000077040820 5 bytes JMP 00000000771a0350
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                  0000000077040880 5 bytes JMP 00000000771a0290
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                               0000000077040910 5 bytes JMP 00000000771a02b0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                0000000077040930 5 bytes JMP 00000000771a03d0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                   0000000077040940 5 bytes JMP 00000000771a0330
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                            00000000770409b0 5 bytes JMP 00000000771a0410
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                               00000000770409e0 5 bytes JMP 00000000771a0240
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                    0000000077040ca0 5 bytes JMP 00000000771a01e0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                               0000000077040d60 5 bytes JMP 00000000771a0250
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                               0000000077040d90 5 bytes JMP 00000000771a0490
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                      0000000077040da0 5 bytes JMP 00000000771a04a0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                 0000000077040dd0 5 bytes JMP 00000000771a0300
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                              0000000077040de0 5 bytes JMP 00000000771a0360
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                    0000000077040e40 5 bytes JMP 00000000771a02a0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                 0000000077040e90 5 bytes JMP 00000000771a02c0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                    0000000077040ec0 5 bytes JMP 00000000771a0380
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                     0000000077040ed0 5 bytes JMP 00000000771a0340
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                              00000000770411c0 5 bytes JMP 00000000771a0440
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                             00000000770413c0 5 bytes JMP 00000000771a0260
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                00000000770413d0 5 bytes JMP 00000000771a0270
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                              00000000770413e0 5 bytes JMP 00000000771a0400
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                          00000000770415a0 5 bytes JMP 00000000771a01f0
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                           00000000770415b0 5 bytes JMP 00000000771a0210
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                0000000077041620 5 bytes JMP 00000000771a0200
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                0000000077041680 5 bytes JMP 00000000771a0420
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                 0000000077041690 5 bytes JMP 00000000771a0430
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                            00000000770416a0 5 bytes JMP 00000000771a0220
.text     C:\Windows\servicing\TrustedInstaller.exe[760] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                    0000000077041780 5 bytes JMP 00000000771a0280

---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                             suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                             suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                             suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                             suspicious modification

---- Threads - GMER 2.1 ----

Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3476:3352]                                                       0000000075807587
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3476:3360]                                                       0000000069c8758a
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3476:2536]                                                       0000000077231c7f
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3476:2648]                                                       0000000077232c91
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3476:2020]                                                       0000000077232c91
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3476:2932]                                                       0000000077232c91
Thread    C:\Windows\System32\svchost.exe [3972:2092]                                                                                  000007feeb409688
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [1696:4072]                                                               000007fefb652a74
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [1696:2528]                                                               000007feea0ddc08

---- EOF - GMER 2.1 ----