I have to keep restarting laptop to get back audio and youtubeClosed

Question

If I'm listening to audio off the internet everything is fine. When I get on the internet after a while audio will go out. Youtube videos wont play, I get an error message, try again later. Youtube will not play at all on firefox. Next all audio including offline audio will not play until I restart my laptop again. Other videos besides youtube play but they have no audio. As soon as I restart and the last program stops running I hear the windows shutdown sound. 
I do have to get rid of PUP virus every week.

2011N2 · Answer

Hello,

To help you and prescribe the remedy, I must make a diagnostic and to do so, I require a log. 

1. Open this link and download ZHPDiag2 : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html 

(Don't be alarmed is the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message.) 

2. Save the file on your Desktop. 

3. Double click on ZHPDiag.exe and follow the installation instructions. 

(For Vista and Win 7 users, click right to ensure you execute with admin right) 

The tool creates three icons ZHPDiag, MRB, and ZHPFix (If necessary,we will use ZHPFix after log analysis). 

4. Double click on the short cut ZHPDiag on your Destktop. 

5. If you need to change the language, click on the little house, (bottom right) and change to English

6. Click on the "Configure" button. 

7. Click on the Magnifying glass "diagnosis with legitimates". 

8. Click on "Search" 

Wait for the tool to finished (maybe a long time) 

9. Close ZHPDiag. 

10. To transmit the report, click on this link : 

https://authentification.site 

9. Search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt). 

10. Select the file ZHPDiag.txt. 

11. Click on "upload » 

12. Copy the URL and post it here. 

Gabriel.

leelee- · Answer

I already have 4 logs from other diagnostic tools. I'lll upload them and if you don't get all the info you want, then I'll try your tool. Hope that's all right because it is a lot of info and a lot of time.
_________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:11:40 PM, on 12/19/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\PLFSetI.exe
C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\Program Files (x86)\WordWeb\wweb32.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Leona\Music\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: DownloadTerms - {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} - C:\Users\Leona\AppData\Local\DownloadTerms	emp.dat (file missing)
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (file missing)
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [20131121] C:\Program Files\AVAST Software\Avast\setup\emupdate\0e3bd2c8-9f80-4047-9433-138a166d289d.exe /check
O4 - HKCU\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAccelerator.exe" /startup
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Leona\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED
O4 - HKCU\..\Run: [Google Update] "C:\Users\Leona\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WordWeb] "C:\Program Files (x86)\WordWeb\wweb32.exe" -startup
O4 - HKCU\..\Run: [Jenkat Alert Widget] C:\Users\Leona\AppData\Roaming\Jenkat\Jenkat Alert Widget\JenkatGA.exe /b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: TP-LINK Wireless Configuration Utility.lnk = C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\speedbit video accelerator\sblsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: SAS Core Service (!SASCORE) - Unknown owner - C:\Users\Leona\Desktop\SASCORE64.EXE (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Unknown owner - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Live Updater Service - Acer Incorporated - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Unknown owner - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VideoAcceleratorService - SpeedBit Ltd. - C:\PROGRA~2\SPEEDB~1\VideoAcceleratorService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

leelee- · Answer

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-12-19 16:47:11
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545025B9A300 rev.PB2OC60F 232.89GB
Running: k0iw07d7.exe; Driver: C:\Users\Leona\AppData\Local\Temp\ugloapog.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32
toskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                  fffff80002ded000 45 bytes [69, 00, 72, 00, 64, 00, 2D, ...]
INITKDBG  C:\Windows\system32
toskrnl.exe!ExDeleteNPagedLookasideList + 574                                                                  fffff80002ded02e 17 bytes [69, 00, 61, 00, 2E, 00, 63, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                             0000000077bf1360 5 bytes JMP 000000014a150460
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                      0000000077bf13b0 5 bytes JMP 000000014a150450
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                      0000000077bf1510 5 bytes JMP 000000014a150370
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                           0000000077bf1560 5 bytes JMP 000000014a150470
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                                 0000000077bf1570 5 bytes JMP 000000014a1503e0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                      0000000077bf1620 5 bytes JMP 000000014a150320
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                               0000000077bf1650 5 bytes JMP 000000014a1503b0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                  0000000077bf1670 5 bytes JMP 000000014a150390
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                        0000000077bf16b0 5 bytes JMP 000000014a1502e0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                      0000000077bf1730 5 bytes JMP 000000014a1502d0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                    0000000077bf1750 5 bytes JMP 000000014a150310
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                     0000000077bf1790 5 bytes JMP 000000014a1503c0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                  0000000077bf17e0 5 bytes JMP 000000014a1503f0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                     0000000077bf1940 5 bytes JMP 000000014a150230
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                          0000000077bf1b00 5 bytes JMP 000000014a150480
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                         0000000077bf1b30 5 bytes JMP 000000014a1503a0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                  0000000077bf1c10 5 bytes JMP 000000014a1502f0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                               0000000077bf1c20 5 bytes JMP 000000014a150350
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                     0000000077bf1c80 5 bytes JMP 000000014a150290
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                  0000000077bf1d10 5 bytes JMP 000000014a1502b0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                   0000000077bf1d30 5 bytes JMP 000000014a1503d0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                      0000000077bf1d40 5 bytes JMP 000000014a150330
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                               0000000077bf1db0 5 bytes JMP 000000014a150410
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                  0000000077bf1de0 5 bytes JMP 000000014a150240
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                       0000000077bf20a0 5 bytes JMP 000000014a1501e0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                  0000000077bf2160 5 bytes JMP 000000014a150250
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                  0000000077bf2190 5 bytes JMP 000000014a150490
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                         0000000077bf21a0 5 bytes JMP 000000014a1504a0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                    0000000077bf21d0 5 bytes JMP 000000014a150300
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                                 0000000077bf21e0 5 bytes JMP 000000014a150360
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                       0000000077bf2240 5 bytes JMP 000000014a1502a0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                    0000000077bf2290 5 bytes JMP 000000014a1502c0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                       0000000077bf22c0 5 bytes JMP 000000014a150380
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                        0000000077bf22d0 5 bytes JMP 000000014a150340
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                                 0000000077bf25c0 5 bytes JMP 000000014a150440
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                                0000000077bf27c0 5 bytes JMP 000000014a150260
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                   0000000077bf27d0 5 bytes JMP 000000014a150270
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                                 0000000077bf27e0 5 bytes JMP 000000014a150400
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                             0000000077bf29a0 5 bytes JMP 000000014a1501f0
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                              0000000077bf29b0 5 bytes JMP 000000014a150210
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                   0000000077bf2a20 5 bytes JMP 000000014a150200
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                   0000000077bf2a80 5 bytes JMP 000000014a150420
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                    0000000077bf2a90 5 bytes JMP 000000014a150430
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                               0000000077bf2aa0 5 bytes JMP 000000014a150220
.text     C:\Windows\system32\csrss.exe[380] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                       0000000077bf2b80 5 bytes JMP 000000014a150280
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                           0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                    0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                    0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                         0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                               0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                    0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                             0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                      0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                    0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                  0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                   0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                   0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                        0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                       0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                             0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                   0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                 0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                    0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                             0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                     0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                       0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                  0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                               0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                     0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                  0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                     0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                      0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                               0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                              0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                 0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                               0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                           0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                            0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                 0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                 0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                  0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                             0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                     0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\wininit.exe[436] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          00000000779deecd 1 byte [62]
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                             0000000077bf1360 5 bytes JMP 000000014a150460
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                      0000000077bf13b0 5 bytes JMP 000000014a150450
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                      0000000077bf1510 5 bytes JMP 000000014a150370
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                           0000000077bf1560 5 bytes JMP 000000014a150470
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                                 0000000077bf1570 5 bytes JMP 000000014a1503e0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                      0000000077bf1620 5 bytes JMP 000000014a150320
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                               0000000077bf1650 5 bytes JMP 000000014a1503b0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                  0000000077bf1670 5 bytes JMP 000000014a150390
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                        0000000077bf16b0 5 bytes JMP 000000014a1502e0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                      0000000077bf1730 5 bytes JMP 000000014a1502d0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                    0000000077bf1750 5 bytes JMP 000000014a150310
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                     0000000077bf1790 5 bytes JMP 000000014a1503c0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                  0000000077bf17e0 5 bytes JMP 000000014a1503f0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                     0000000077bf1940 5 bytes JMP 000000014a150230
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                          0000000077bf1b00 5 bytes JMP 000000014a150480
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                         0000000077bf1b30 5 bytes JMP 000000014a1503a0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                  0000000077bf1c10 5 bytes JMP 000000014a1502f0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                               0000000077bf1c20 5 bytes JMP 000000014a150350
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                     0000000077bf1c80 5 bytes JMP 000000014a150290
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                  0000000077bf1d10 5 bytes JMP 000000014a1502b0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                   0000000077bf1d30 5 bytes JMP 000000014a1503d0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                      0000000077bf1d40 5 bytes JMP 000000014a150330
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                               0000000077bf1db0 5 bytes JMP 000000014a150410
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry            
                                      0000000077bf1de0 5 bytes JMP 000000014a150240
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                       0000000077bf20a0 5 bytes JMP 000000014a1501e0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                  0000000077bf2160 5 bytes JMP 000000014a150250
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                  0000000077bf2190 5 bytes JMP 000000014a150490
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                         0000000077bf21a0 5 bytes JMP 000000014a1504a0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                    0000000077bf21d0 5 bytes JMP 000000014a150300
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                                 0000000077bf21e0 5 bytes JMP 000000014a150360
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                       0000000077bf2240 5 bytes JMP 000000014a1502a0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                    0000000077bf2290 5 bytes JMP 000000014a1502c0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                       0000000077bf22c0 5 bytes JMP 000000014a150380
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                        0000000077bf22d0 5 bytes JMP 000000014a150340
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                                 0000000077bf25c0 5 bytes JMP 000000014a150440
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                                0000000077bf27c0 5 bytes JMP 000000014a150260
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                   0000000077bf27d0 5 bytes JMP 000000014a150270
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                                 0000000077bf27e0 5 bytes JMP 000000014a150400
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                             0000000077bf29a0 5 bytes JMP 000000014a1501f0
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                              0000000077bf29b0 5 bytes JMP 000000014a150210
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                   0000000077bf2a20 5 bytes JMP 000000014a150200
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                   0000000077bf2a80 5 bytes JMP 000000014a150420
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                    0000000077bf2a90 5 bytes JMP 000000014a150430
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                               0000000077bf2aa0 5 bytes JMP 000000014a150220
.text     C:\Windows\system32\csrss.exe[448] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                       0000000077bf2b80 5 bytes JMP 000000014a150280
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                          0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                   0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                   0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                        0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                              0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                   0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                            0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                               0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                     0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                   0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                 0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                  0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                               0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                  0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                       0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                      0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                               0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                            0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                  0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                               0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                   0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                            0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                               0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                    0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                               0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                               0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                      0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                 0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                              0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                    0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                 0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                    0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                     0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                              0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                             0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                              0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                          0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                           0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                 0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                            0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                    0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\winlogon.exe[504] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                         00000000779deecd 1 byte [62]
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                          0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                   0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                   0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                        0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                              0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                   0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                            0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                               0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                     0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                   0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                 0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                  0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                               0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                  0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                       0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                      0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                               0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                            0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                  0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                               0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                   0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                            0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                               0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                    0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                               0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                               0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                      0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                 0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                              0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                    0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                 0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                    0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                     0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                              0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                             0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                              0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                          0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                           0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                 0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                            0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\services.exe[524] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                    0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\services.exe[524] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                         00000000779deecd 1 byte [62]
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                             0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                      0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                      0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                           0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                                 0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                      0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                               0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                  0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                        0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                      0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                    0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                     0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                  0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                     0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                          0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                         0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                  0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                               0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                     0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                  0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                   0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                      0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                               0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                  0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                       0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                  0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                  0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                         0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                    0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                                 0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                       0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                    0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                       0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                        0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                                 0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                                0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                   0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                                 0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                             0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                              0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                   0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                   0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                    0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                               0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                       0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\lsass.exe[556] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                            00000000779deecd 1 byte [62]
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                               0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                        0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                        0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                             0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                                   0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                        0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                                 0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                    0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                          0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                        0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                      0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                       0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                    0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                       0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                            0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                           0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                    0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                                 0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                       0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                    0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                     0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                        0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                                 0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                    0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                         0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                    0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                    0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                           0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                      0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                                   0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                         0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                      0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                         0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                          0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                                   0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                                  0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                     0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                                   0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                               0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                                0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                     0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                     0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                      0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                                 0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                         0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                           0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                    0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                    0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                         0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                               0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                    0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                             0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                      0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                    0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                  0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                   0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread

leelee- · Answer

.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                      0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                               0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                              0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                 0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                               0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                           0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                            0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                 0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                 0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                  0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                             0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                     0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                           0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                    0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                    0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                         0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                               0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                    0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                             0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                      0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                    0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                  0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                   0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                   0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                        0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                       0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                             0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                   0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                 0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                    0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                             0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                     0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                       0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                  0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                               0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                     0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                  0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                     0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                      0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                               0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                              0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                 0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                               0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                           0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                            0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                 0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                 0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                  0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                             0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                     0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\System32\svchost.exe[784] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          00000000779deecd 1 byte [62]
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                           0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                    0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                    0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                         0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                               0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                    0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                             0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                      0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                    0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                  0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                   0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                   0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                        0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                       0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                             0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                   0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                 0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                    0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                             0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                     0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                       0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                  0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                               0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                     0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                  0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                     0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                      0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                               0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                              0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                 0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                               0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                           0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                            0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                 0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                 0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                  0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                             0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                     0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\System32\svchost.exe[872] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          00000000779deecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                           0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                    0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                    0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                         0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                               0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                    0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                             0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                      0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                    0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                  0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                   0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                   0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                        0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                       0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                             0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                   0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                 0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                    0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                             0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                     0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                       0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                  0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                               0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                     0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                  0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                     0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                      0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                               0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                              0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                 0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                               0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                           0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                            0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                 0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                 0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                  0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                             0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                     0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\svchost.exe[900] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          00000000779deecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                           0000000077bf1360 5 bytes JMP 0000000100070460
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                    0000000077bf13b0 5 bytes JMP 0000000100070450
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                    0000000077bf1510 5 bytes JMP 0000000100070370
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                         0000000077bf1560 5 bytes JMP 0000000100070470
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                               0000000077bf1570 5 bytes JMP 00000001000703e0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                    0000000077bf1620 5 bytes JMP 0000000100070320
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                             0000000077bf1650 5 bytes JMP 00000001000703b0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                0000000077bf1670 5 bytes JMP 0000000100070390
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                      0000000077bf16b0 5 bytes JMP 00000001000702e0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                    0000000077bf1730 5 bytes JMP 00000001000702d0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                  0000000077bf1750 5 bytes JMP 0000000100070310
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                   0000000077bf1790 5 bytes JMP 00000001000703c0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                0000000077bf17e0 5 bytes JMP 00000001000703f0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                   0000000077bf1940 5 bytes JMP 0000000100070230
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                        0000000077bf1b00 5 bytes JMP 0000000100070480
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                       0000000077bf1b30 5 bytes JMP 00000001000703a0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                0000000077bf1c10 5 bytes JMP 00000001000702f0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                             0000000077bf1c20 5 bytes JMP 0000000100070350
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                   0000000077bf1c80 5 bytes JMP 0000000100070290
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                0000000077bf1d10 5 bytes JMP 00000001000702b0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                 0000000077bf1d30 5 bytes JMP 00000001000703d0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                    0000000077bf1d40 5 bytes JMP 0000000100070330
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                             0000000077bf1db0 5 bytes JMP 0000000100070410
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                0000000077bf1de0 5 bytes JMP 0000000100070240
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                     0000000077bf20a0 5 bytes JMP 00000001000701e0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                0000000077bf2160 5 bytes JMP 0000000100070250
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                0000000077bf2190 5 bytes JMP 0000000100070490
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                       0000000077bf21a0 5 bytes JMP 00000001000704a0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                  0000000077bf21d0 5 bytes JMP 0000000100070300
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                               0000000077bf21e0 5 bytes JMP 0000000100070360
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                     0000000077bf2240 5 bytes JMP 00000001000702a0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                  0000000077bf2290 5 bytes JMP 00000001000702c0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                     0000000077bf22c0 5 bytes JMP 0000000100070380
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                      0000000077bf22d0 5 bytes JMP 0000000100070340
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                               0000000077bf25c0 5 bytes JMP 0000000100070440
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                              0000000077bf27c0 5 bytes JMP 0000000100070260
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                 0000000077bf27d0 5 bytes JMP 0000000100070270
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                               0000000077bf27e0 5 bytes JMP 0000000100070400
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                           0000000077bf29a0 5 bytes JMP 00000001000701f0
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                            0000000077bf29b0 5 bytes JMP 0000000100070210
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                 0000000077bf2a20 5 bytes JMP 0000000100070200
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                 0000000077bf2a80 5 bytes JMP 0000000100070420
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                  0000000077bf2a90 5 bytes JMP 0000000100070430
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                             0000000077bf2aa0 5 bytes JMP 0000000100070220
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                     0000000077bf2b80 5 bytes JMP 0000000100070280
.text     C:\Windows\system32\svchost.exe[924] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          00000000779deecd 1 byte [62]
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                          0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                   0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                   0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                        0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                              0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                   0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                            0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                               0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                     0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                   0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                 0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                  0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                               0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                  0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                       0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                      0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                               0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                            0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                  0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                               0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                   0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                            0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                               0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                    0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                               0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                               0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                      0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                 0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                              0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                    0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                 0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                    0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                     0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                              0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                             0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                              0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                          0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                           0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                 0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                            0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                    0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\AUDIODG.EXE[1012] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                         00000000779deecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                           0000000077bf1360 5 bytes JMP 0000000100070460
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                    0000000077bf13b0 5 bytes JMP 0000000100070450
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                    0000000077bf1510 5 bytes JMP 0000000100070370
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                         0000000077bf1560 5 bytes JMP 0000000100070470
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                               0000000077bf1570 5 bytes JMP 00000001000703e0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                    0000000077bf1620 5 bytes JMP 0000000100070320
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                             0000000077bf1650 5 bytes JMP 00000001000703b0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                0000000077bf1670 5 bytes JMP 0000000100070390
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                      0000000077bf16b0 5 bytes JMP 00000001000702e0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                    0000000077bf1730 5 bytes JMP 00000001000702d0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                  0000000077bf1750 5 bytes JMP 0000000100070310
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                   0000000077bf1790 5 bytes JMP 00000001000703c0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                0000000077bf17e0 5 bytes JMP 00000001000703f0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                   0000000077bf1940 5 bytes JMP 0000000100070230
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                        0000000077bf1b00 5 bytes JMP 0000000100070480
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                       0000000077bf1b30 5 bytes JMP 00000001000703a0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                0000000077bf1c10 5 bytes JMP 00000001000702f0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                             0000000077bf1c20 5 bytes JMP 0000000100070350
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                   0000000077bf1c80 5 bytes JMP 0000000100070290
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                0000000077bf1d10 5 bytes JMP 00000001000702b0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                 0000000077bf1d30 5 bytes JMP 00000001000703d0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                    0000000077bf1d40 5 bytes JMP 0000000100070330
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                             0000000077bf1db0 5 bytes JMP 0000000100070410
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                0000000077bf1de0 5 bytes JMP 0000000100070240
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                     0000000077bf20a0 5 bytes JMP 00000001000701e0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                0000000077bf2160 5 bytes JMP 0000000100070250
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                0000000077bf2190 5 bytes JMP 0000000100070490
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                       0000000077bf21a0 5 bytes JMP 00000001000704a0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                  0000000077bf21d0 5 bytes JMP 0000000100070300
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                               0000000077bf21e0 5 bytes JMP 0000000100070360
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                     0000000077bf2240 5 bytes JMP 00000001000702a0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                  0000000077bf2290 5 bytes JMP 00000001000702c0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                     0000000077bf22c0 5 bytes JMP 0000000100070380
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                      0000000077bf22d0 5 bytes JMP 0000000100070340
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                               0000000077bf25c0 5 bytes JMP 0000000100070440
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                              0000000077bf27c0 5 bytes JMP 0000000100070260
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                 0000000077bf27d0 5 bytes JMP 0000000100070270
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                               0000000077bf27e0 5 bytes JMP 0000000100070400
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                           0000000077bf29a0 5 bytes JMP 00000001000701f0
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                            0000000077bf29b0 5 bytes JMP 0000000100070210
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                 0000000077bf2a20 5 bytes JMP 0000000100070200
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                 0000000077bf2a80 5 bytes JMP 0000000100070420
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                  0000000077bf2a90 5 bytes JMP 0000000100070430
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                             0000000077bf2aa0 5 bytes JMP 0000000100070220
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                     0000000077bf2b80 5 bytes JMP 0000000100070280
.text     C:\Windows\system32\svchost.exe[960] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          00000000779deecd 1 byte [62]
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                          0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                   0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                   0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                        0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                              0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                   0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                            0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                               0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                     0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                   0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                 0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                  0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                               0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                  0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                       0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                      0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                               0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                            0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                  0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                               0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                   0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                            0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                               0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                    0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                               0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                               0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                      0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                 0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                              0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                    0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                 0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                    0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                     0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                              0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                             0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                              0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                          0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                           0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                 0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                            0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                    0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\WLANExt.exe[1116] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                         00000000779deecd 1 byte [62]
.text     C:\Windows\System32\spoolsv.exe[1296] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                          0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\System32\spoolsv.exe[1296] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                   0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\System32\spoolsv.exe[1296] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess

leelee- · Answer

.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                              0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                         0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                                      0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                            0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                         0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                            0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                             0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                                      0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                                     0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                        0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                                      0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                                  0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                                   0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                        0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                        0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                         0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                                    0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                            0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\Explorer.EXE[2132] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                 00000000779deecd 1 byte [62]
.text     C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe[2776] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112           000000007606a2ba 1 byte [62]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort              0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                       0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                       0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx            0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                  0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                       0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                   0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                         0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                       0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                     0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                      0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                   0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                      0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort           0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject          0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                   0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                      0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                   0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                    0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                       0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                   0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                        0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                   0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                   0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys          0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                     0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                  0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                        0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                     0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                        0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                         0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                  0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                 0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                    0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                  0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation              0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState               0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                    0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                    0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                     0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                        0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[2544] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189             00000000779deecd 1 byte [62]
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                         0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                  0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                  0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                       0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                             0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                  0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                           0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                              0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                    0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                  0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                 0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                              0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                 0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                      0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                     0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                              0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                           0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                 0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                              0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                               0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                  0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                           0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                              0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                   0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                              0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                              0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                     0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                             0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                   0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                   0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                    0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                             0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                            0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                               0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                             0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                         0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                          0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                               0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                               0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                           0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                   0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\System32\igfxtray.exe[2628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                        00000000779deecd 1 byte [62]
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                            0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                     0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                     0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                          0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                                0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                     0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                              0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                                 0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                       0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                     0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                   0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                    0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                                 0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                    0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                         0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                        0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                                 0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                              0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                    0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                                 0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                  0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                     0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                              0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                                 0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                      0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                                 0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                                 0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                        0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                   0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                                0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                      0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                   0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                      0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                       0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                                0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                               0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                  0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                                0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                            0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                             0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                  0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                  0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                   0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                              0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                      0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\System32\hkcmd.exe[2720] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                           00000000779deecd 1 byte [62]
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                         0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                  0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                  0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                       0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                             0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                  0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                           0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                              0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                    0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                  0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                 0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                              0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                 0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                      0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                     0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                              0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                           0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                 0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                              0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                               0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                  0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                           0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                              0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                   0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                              0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                              0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                     0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                             0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                   0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                   0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                    0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                             0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                            0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                               0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                             0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                         0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                          0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                               0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                               0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                           0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                   0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\System32\igfxpers.exe[2804] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                        00000000779deecd 1 byte [62]
.text     C:\Windows\PLFSetI.exe[2508] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                  000000007606a2ba 1 byte [62]
.text     C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAccelerator.exe[3024] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112  000000007606a2ba 1 byte [62]
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                         0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                  0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                  0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                       0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                             0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                  0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                           0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                              0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                    0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                  0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                 0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                              0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                 0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                      0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                     0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                              0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                           0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                 0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                              0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                               0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                  0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                           0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                              0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                   0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                              0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                              0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                     0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                             0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                   0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                   0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                    0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                             0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                            0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                               0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                             0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                         0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                          0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                               0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                               0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                           0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                   0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\igfxsrvc.exe[3068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                        00000000779deecd 1 byte [62]
.text     C:\Program Files (x86)\WordWeb\wweb32.exe[2212] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                               000000007606a2ba 1 byte [62]
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[3368] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                       000000007606a2ba 1 byte [62]
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                          0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                                   0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                                   0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                        0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                              0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                                   0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                            0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                               0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                                     0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                                   0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                                 0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                                  0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                               0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                                  0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                       0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                      0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                               0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                            0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                                  0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                               0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                                0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                                   0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                            0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                               0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                                    0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                               0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                               0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                      0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                                 0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                              0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                                    0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                                 0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                                    0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                                     0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                              0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                             0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                                0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSetContextThread                                              0000000077bf27e0 5 bytes JMP 0000000077d50400
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemInformation                                          0000000077bf29a0 5 bytes JMP 0000000077d501f0
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSetSystemPowerState                                           0000000077bf29b0 5 bytes JMP 0000000077d50210
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtShutdownSystem                                                0000000077bf2a20 5 bytes JMP 0000000077d50200
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSuspendProcess                                                0000000077bf2a80 5 bytes JMP 0000000077d50420
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSuspendThread                                                 0000000077bf2a90 5 bytes JMP 0000000077d50430
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtSystemDebugControl                                            0000000077bf2aa0 5 bytes JMP 0000000077d50220
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\SYSTEM32
tdll.dll!NtVdmControl                                                    0000000077bf2b80 5 bytes JMP 0000000077d50280
.text     C:\Windows\system32\igfxext.exe[3956] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                         00000000779deecd 1 byte [62]
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePort                                    0000000077bf1360 5 bytes JMP 0000000077d50460
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtQueryObject                                             0000000077bf13b0 5 bytes JMP 0000000077d50450
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenProcess                                             0000000077bf1510 5 bytes JMP 0000000077d50370
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtReplyWaitReceivePortEx                                  0000000077bf1560 5 bytes JMP 0000000077d50470
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtTerminateProcess                                        0000000077bf1570 5 bytes JMP 0000000077d503e0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenSection                                             0000000077bf1620 5 bytes JMP 0000000077d50320
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtWriteVirtualMemory                                      0000000077bf1650 5 bytes JMP 0000000077d503b0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtDuplicateObject                                         0000000077bf1670 5 bytes JMP 0000000077d50390
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenEvent                                               0000000077bf16b0 5 bytes JMP 0000000077d502e0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateEvent                                             0000000077bf1730 5 bytes JMP 0000000077d502d0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateSection                                           0000000077bf1750 5 bytes JMP 0000000077d50310
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateThread                                            0000000077bf1790 5 bytes JMP 0000000077d503c0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtTerminateThread                                         0000000077bf17e0 5 bytes JMP 0000000077d503f0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtAddBootEntry                                            0000000077bf1940 5 bytes JMP 0000000077d50230
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtAlpcSendWaitReceivePort                                 0000000077bf1b00 5 bytes JMP 0000000077d50480
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtAssignProcessToJobObject                                0000000077bf1b30 5 bytes JMP 0000000077d503a0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateEventPair                                         0000000077bf1c10 5 bytes JMP 0000000077d502f0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateIoCompletion                                      0000000077bf1c20 5 bytes JMP 0000000077d50350
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateMutant                                            0000000077bf1c80 5 bytes JMP 0000000077d50290
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateSemaphore                                         0000000077bf1d10 5 bytes JMP 0000000077d502b0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateThreadEx                                          0000000077bf1d30 5 bytes JMP 0000000077d503d0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtCreateTimer                                             0000000077bf1d40 5 bytes JMP 0000000077d50330
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtDebugActiveProcess                                      0000000077bf1db0 5 bytes JMP 0000000077d50410
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtDeleteBootEntry                                         0000000077bf1de0 5 bytes JMP 0000000077d50240
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtLoadDriver                                              0000000077bf20a0 5 bytes JMP 0000000077d501e0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtModifyBootEntry                                         0000000077bf2160 5 bytes JMP 0000000077d50250
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeKey                                         0000000077bf2190 5 bytes JMP 0000000077d50490
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtNotifyChangeMultipleKeys                                0000000077bf21a0 5 bytes JMP 0000000077d504a0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenEventPair                                           0000000077bf21d0 5 bytes JMP 0000000077d50300
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenIoCompletion                                        0000000077bf21e0 5 bytes JMP 0000000077d50360
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenMutant                                              0000000077bf2240 5 bytes JMP 0000000077d502a0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenSemaphore                                           0000000077bf2290 5 bytes JMP 0000000077d502c0
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenThread                                              0000000077bf22c0 5 bytes JMP 0000000077d50380
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtOpenTimer                                               0000000077bf22d0 5 bytes JMP 0000000077d50340
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtQueueApcThreadEx                                        0000000077bf25c0 5 bytes JMP 0000000077d50440
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtSetBootEntryOrder                                       0000000077bf27c0 5 bytes JMP 0000000077d50260
.text     C:\Windows\system32\SearchIndexer.exe[3076] C:\Windows\SYSTEM32
tdll.dll!NtSetBootOptions                                          0000000077bf27d0 5 bytes JMP 0000000077d50270
.text     C:\Windows\sys

leelee- · Answer

I use Malwarebytes to scan and avast is running. Malware picks up PUP ever so often. Can you also recommend something to get rid of programs I don't use and duplicate files?

2011N2 · Answer

Hello,

Why a GMER report ?
Have you got MBAM's report ?

Gabriel.

leelee- · Answer

Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.12.20.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Leona :: LEONA-PC [administrator]

Protection: Enabled

12/20/2013 2:19:31 PM
MBAM-log-2013-12-20 (15-28-56).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 341858
Time elapsed: 1 hour(s), 8 minute(s), 52 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKCR\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1} (PUP.Optional.Conduit) -> No action taken.
HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> No action taken.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll (PUP.Optional.Conduit) -> No action taken.

(end)

2011N2 · Answer

Ok, now run ZHPDiag : https://ccm.net/forum/affich-732248-i-have-to-keep-restarting-laptop-to-get-back-audio-and-youtube#1

Gabriel.

leelee- · Answer

Rapport de Tests ZHPDiag v2013.12.14.22 (12/14/2013) - Variables
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)

*************  F O L D E R S / COMMON **********
sDirRoot ---->C:\
sDirCommonDesktop ---->C:\Users\Public\Desktop\
sDirAllUser ---->C:\Users\All Users\
sDirCommonAppdata ---->C:\ProgramData\
sDirProgramFiles ---->C:\Program Files (x86)\
sDirCommonPrograms ---->C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
sDirCommonStartup ---->C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
sDirWindows ---->C:\Windows\
sDirWindowsDPF ---->C:\Windows\Downloaded Program Files\
sDirWinTask ---->C:\Windows\Tasks\
sDirZHPDiagInstall ---->C:\Program Files (x86)\ZHPDiag\
sDirProgramFilesX86 ---->C:\Program Files (x86)\
sDirSystemFolder ---->C:\Windows\System32\
sDirSystemFolder64 ---->C:\Windows\SysWOW64\
sDirSystemDrivers ---->C:\Windows\System32\Drivers\
sDirProgramFilesCommonX86 ---->C:\Program Files (x86)\Common Files\
sDirProgramFilesCommon ---->C:\Program Files (x86)\Common Files\

*************  F O L D E R S / USERNAME **********
sDirUserName ---->C:\Users\Leona\
sDirAppData ---->C:\Users\Leona\AppData\
sDirAppDataRoaming ---->C:\Users\Leona\AppData\Roaming\
sDirDesktop ---->C:\Users\Leona\Desktop\
sDirAppdataLocal ---->C:\Users\Leona\AppData\Local\
sDirAppdataLocalLow ---->C:\Users\Leona\AppData\LocalLow\
sDirAppdataLocalTemp ---->C:\Users\Leona\AppData\Local\Temp\
sDirDocuments ---->C:\Users\Leona\Documents\
sDirUserDownloads ---->C:\Users\Leona\Downloads\
sDirPictures ---->C:\Users\Leona\Pictures\
sDirVideos ---->C:\Users\Leona\Videos\
sDirMusic ---->C:\Users\Leona\Music\
sDirFavorites ---->C:\Users\Leona\Favorites\
sDirStartMenu ---->C:\Users\Leona\AppData\Roaming\Microsoft\Windows\Start Menu\
sDirStartup ---->C:\Users\Leona\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
sDirSendTo ---->C:\Users\Leona\AppData\Roaming\Microsoft\Windows\SendTo\
sDirStartMenuPrograms ---->C:\Users\Leona\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
sDirProfilesFirefox ---->C:\Users\Leona\AppData\Roaming\Mozilla\Firefox\Profiles\
sDirZHPDiagReport ---->C:\Users\Leona\AppData\Roaming\ZHP\

*************  F I L E S **********
sFileZHPDiagReport ---->C:\Users\Leona\AppData\Roaming\ZHP\ZHPDiag.txt
sFileHosts ---->C:\Windows\System32\Drivers\etc\HOSTS
sFileHostsSave ---->C:\Users\Leona\AppData\Roaming\ZHP\HOSTS.txt
sFileZHPScanQuarantine ---->C:\Users\Leona\AppData\Roaming\ZHP\ZHPScanQuarantine.txt
sFileTarget ---->C:\Program Files (x86)\ZHPDiag\ZHPDiag2.exe
sFileScanLog ---->C:\Users\Leona\AppData\Roaming\ZHP\Log.txt
sZHPScan ---->C:\Program Files (x86)\ZHPDiag\ZHPScan.Txt
sExportBDR ---->C:\Users\Leona\AppData\Roaming\ZHP\ZHPDiagTempo.Txt
sDoc ---->C:\Documents and Settings\Leona\
sUser ---->C:\Users\Leona\

leelee- · Answer

Now, I probably wont see any other response until Monday. I'll be off the internet until then.

2011N2 · Answer

This is not the good report of ZHPDiag. You have to send me ZHPDiag.txt, on your desktop.

Good evening and see you soon,

Gabriel.

leelee · Answer

I wiped the disc clean and reinstalled Windows 7. Running like new now.
lee lee

2011N2 · Answer

Ok, good continuation. :)

Gabriel.

I have to keep restarting laptop to get back audio and youtube

14 responses

Similar discussions

Subscribe To Our Newsletter!