| ArmeSocke | 17.08.2014 13:50 |
Gemer.txt (1/3) Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-17 13:15:10
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-1 Intel___ rev.1.0. 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\User\AppData\Local\Temp\kxldapoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800031a4000 49 bytes [4D, 08, 8D, 45, DC, 50, 8D, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 578 fffff800031a4032 63 bytes {OR EAX, 0xc4d8d00; CALL 0xfffffffffffb7f5d}
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1736] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007755faa8 5 bytes JMP 00000001743818dd
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1736] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077560038 5 bytes JMP 0000000174381ed6
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes JMP 3f3f3f3f
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007724a400 7 bytes JMP 000000016fff0260
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077253f20 5 bytes JMP 000000016fff01b8
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007726ffb0 5 bytes JMP 000000016fff01f0
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007727f2e0 5 bytes JMP 000000016fff0148
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000772a9a30 7 bytes JMP 000000016fff00d8
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000772b94c0 5 bytes JMP 000000016fff0180
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 00000000772b9630 5 bytes JMP 000000016fff0110
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000772d87e0 7 bytes JMP 000000016fff0228
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd312db0 5 bytes JMP 000007fffd300180
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd3137d0 7 bytes JMP 000007fffd3000d8
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd318ef0 6 bytes JMP 000007fffd300148
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd32af60 5 bytes JMP 000007fffd300110
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff3389e0 8 bytes JMP 000007fffd3001f0
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff33be40 8 bytes JMP 000007fffd3001b8
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 0000000077146c80 5 bytes JMP 000000016fff0308
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 000000007714a5b4 5 bytes JMP 000000016fff02d0
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!CreateWindowExW 0000000077150810 7 bytes JMP 000000016fff0340
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 000000007715ccec 9 bytes JMP 000000016fff0298
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe697490 11 bytes JMP 000007fffd300228
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe6abf00 7 bytes JMP 000007fffd300260
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef7c9dc88 5 bytes JMP 000007fff7c700d8
.text C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef7c9de10 5 bytes JMP 000007fff7c70110
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000773611f5 8 bytes {JMP 0xd}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077361fd7 8 bytes {JMP 0xb}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000773627d2 8 bytes {JMP 0x10}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000773633c0 16 bytes {JMP 0x4e}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077511465 2 bytes [51, 77]
.text C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000775114bb 2 bytes [51, 77]
.text ... * 2
|
So funktioniert es: