Spowolniony system, 100% użycia dysku, logi

**Posty:** 1 · przez **Dyrczu** 28 Gru 2014, 14:27

Witam wszystkich serdecznie

Mam oto taki problem z moim laptopem:
- powolne uruchamianie systemu, dużo wolniejsze niż jakiś czas temu
- po wejściu w "Mój komputer", po czym w któryś z dysków, lub folderów (np. Pobrane) długo ładują się pliki, zanim się ukażą
- zauważyłem, że czasami mam 100% użycia dysku, nawet jeżeli nic nie robię na laptopie, nic nie jest włączone

Zrobiłem logi, które wklejam w załącznikach. Mam nadzieję, że uda się coś na tej podstawie wyjaśnić. Z góry wielkie dzięki! Pozdrawiam

Skanując programem GMER, dwukrotnie wyskoczył błąd, że nie można uzyskać dostępu do danego pliku, gdyż jest on używany przez inny program.

Kod: Zaznacz wszystko: GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-12-28 13:17:32 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002d ST1000LM024_HN-M101MBB rev.2AR10001 931,51GB Running: pldhp1rd.exe; Driver: C:\Users\Dejv\AppData\Local\Temp\pfldapog.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\csrss.exe[508] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00007fff6a101720 8 bytes JMP 00007fff6a2200d8 .text C:\Windows\system32\csrss.exe[508] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00007fff6a101920 8 bytes JMP 00007fff6a220110 .text C:\Windows\system32\csrss.exe[508] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 8 bytes JMP 00007fff6a220148 .text C:\Windows\system32\csrss.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00007fff6a101720 8 bytes JMP 00007fff6a2200d8 .text C:\Windows\system32\csrss.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00007fff6a101920 8 bytes JMP 00007fff6a220110 .text C:\Windows\system32\csrss.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 8 bytes JMP 00007fff6a220148 .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\services.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\services.exe[700] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\services.exe[700] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIf3 00007fff6929f980 6 bytes {JMP QWORD [RIP+0x2206b0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIfEx 00007fff692d02a4 6 bytes {JMP QWORD [RIP+0x1bfd8c]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\services.exe[700] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\services.exe[700] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\services.exe[700] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\services.exe[700] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\lsass.exe[708] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIf3 00007fff6929f980 6 bytes {JMP QWORD [RIP+0x2206b0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIfEx 00007fff692d02a4 6 bytes {JMP QWORD [RIP+0x1bfd8c]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIf3 00007fff6929f980 6 bytes {JMP QWORD [RIP+0x2206b0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIfEx 00007fff692d02a4 6 bytes {JMP QWORD [RIP+0x1bfd8c]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[828] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x6dee80]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x6bee30]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x63ee20]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x61ee10]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x6feb90]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x71eb40]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x75e400]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x69e3e0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x4bd720]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x47cb60]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x53bf10]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x79b1c0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x4fae00]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x659960]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x4596c0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x57742c]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x43611c]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x3d57d0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x3938a0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 41] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x5b1cf0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x7b1b50]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x6713dc]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x3ede1c]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x4cd620]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x76c600]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x489f08]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x5d0ab0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x70c950]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x4e9e80]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x569b50]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x3463d0]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x7952c4]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x3626b8]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x5539f8]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x4d30ac]} .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[920] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 00007fff697028c0 7 bytes JMP 00008000676d02d0 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW 00007fff697043d8 7 bytes JMP 00008000676d0308 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 00007fff697b1f20 7 bytes JMP 00008000676d0378 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW 00007fff697b40b4 7 bytes JMP 00008000676d03b0 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW 00007fff697b4510 7 bytes JMP 00008000676d0340 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fff697b4af0 7 bytes JMP 00008000676d0260 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fff697dcea0 7 bytes JMP 00008000676d0228 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fff697dcf10 7 bytes JMP 00008000676d0298 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 00007fff6773299c 7 bytes JMP 00008000676d00d8 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 00007fff677354c8 5 bytes JMP 00008000676d0180 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 00007fff677355b0 5 bytes JMP 00008000676d0148 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 00007fff67735e58 5 bytes JMP 00008000676d0110 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!CreateWindowExW 00007fff67ae7834 10 bytes JMP 00008000676d0490 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 00007fff67aeb4d0 5 bytes JMP 00008000676d0420 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 00007fff67aec6d8 5 bytes JMP 00008000676d0458 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fff67aee39c 9 bytes JMP 00008000676d03e8 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fff69f21500 8 bytes JMP 00008000676d01b8 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fff69f21750 8 bytes JMP 00008000676d01f0 .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\dwm.exe[932] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes JMP 6d0061 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes JMP fb98d0 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes JMP 0 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes JMP 0 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x63ee20]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x61ee10]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes JMP 0 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes JMP 0 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes JMP 0 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes JMP 20002c .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x4bd720]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes JMP 6c002d .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x53bf10]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x79b1c0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x4fae00]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x659960]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x4596c0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x57742c]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x43611c]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x3d57d0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x3938a0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 41] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x5b1cf0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x7b1b50]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes JMP a00 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x3ede1c]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x4cd620]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes JMP 545041 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x489f08]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x5d0ab0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes JMP 0 .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x4e9e80]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x569b50]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x3463d0]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x7952c4]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x3626b8]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x5539f8]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x4d30ac]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\nvvsvc.exe[964] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[972] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[436] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIf3 00007fff6929f980 6 bytes {JMP QWORD [RIP+0x2206b0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIfEx 00007fff692d02a4 6 bytes {JMP QWORD [RIP+0x1bfd8c]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[464] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[512] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 00007fff697028c0 7 bytes JMP 00008000676d0340 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW 00007fff697043d8 7 bytes JMP 00008000676d0378 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 00007fff697b1f20 7 bytes JMP 00008000676d03e8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW 00007fff697b40b4 7 bytes JMP 00008000676d0420 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW 00007fff697b4510 7 bytes JMP 00008000676d03b0 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fff697b4af0 7 bytes JMP 00008000676d02d0 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fff697dcea0 7 bytes JMP 00008000676d0298 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fff697dcf10 7 bytes JMP 00008000676d0308 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 00007fff6773299c 7 bytes JMP 00008000676d00d8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 00007fff677354c8 5 bytes JMP 00008000676d0180 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 00007fff677355b0 5 bytes JMP 00008000676d0148 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 00007fff67735e58 5 bytes JMP 00008000676d0110 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 00007fff67ca9318 7 bytes JMP 00008000676d0260 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 00007fff67cacbe0 7 bytes JMP 00008000676d0228 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x6dee80]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x6bee30]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x63ee20]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x61ee10]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x6feb90]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x71eb40]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x75e400]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x69e3e0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x4bd720]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x47cb60]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x53bf10]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x79b1c0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x4fae00]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x659960]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x4596c0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!CreateWindowExW 00007fff67ae7834 10 bytes JMP 00008000676d0500 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x57742c]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x43611c]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x3d57d0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 00007fff67aeb4d0 5 bytes JMP 00008000676d0490 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 00007fff67aec6d8 5 bytes JMP 00008000676d04c8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x3938a0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 41] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x5b1cf0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fff67aee39c 9 bytes JMP 00008000676d0458 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x7b1b50]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x6713dc]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x3ede1c]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x4cd620]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x76c600]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x489f08]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x5d0ab0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x70c950]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x4e9e80]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x569b50]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x3463d0]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x7952c4]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x3626b8]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x5539f8]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x4d30ac]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fff69f21500 8 bytes JMP 00008000676d01b8 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fff69f21750 8 bytes JMP 00008000676d01f0 .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x6dee80]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x6bee30]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x63ee20]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x61ee10]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x6feb90]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x71eb40]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x75e400]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x69e3e0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x4bd720]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x47cb60]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x53bf10]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x79b1c0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x4fae00]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x659960]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x4596c0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x57742c]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x43611c]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x3d57d0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x3938a0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 41] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x5b1cf0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x7b1b50]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x6713dc]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x3ede1c]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x4cd620]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x76c600]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x489f08]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x5d0ab0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x70c950]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x4e9e80]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x569b50]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x3463d0]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x7952c4]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x3626b8]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x5539f8]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x4d30ac]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxCUIService.exe[1044] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\svchost.exe[1120] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\System32\spoolsv.exe[1492] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIf3 00007fff6929f980 6 bytes {JMP QWORD [RIP+0x2206b0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\RPCRT4.dll!RpcServerRegisterIfEx 00007fff692d02a4 6 bytes {JMP QWORD [RIP+0x1bfd8c]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[1544] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x6dee80]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x6bee30]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x63ee20]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x61ee10]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x6feb90]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x71eb40]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x75e400]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x69e3e0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x4bd720]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x47cb60]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x53bf10]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x79b1c0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x4fae00]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x659960]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x4596c0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x57742c]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x43611c]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x3d57d0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x3938a0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 41] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x5b1cf0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x7b1b50]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x6713dc]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x3ede1c]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x4cd620]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x76c600]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x489f08]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x5d0ab0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x70c950]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x4e9e80]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x569b50]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x3463d0]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x7952c4]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x3626b8]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x5539f8]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x4d30ac]} .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskeng.exe[1832] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 00007fff697028c0 7 bytes JMP 00008000676d02d0 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW 00007fff697043d8 7 bytes JMP 00008000676d0308 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 00007fff697b1f20 7 bytes JMP 00008000676d0378 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW 00007fff697b40b4 7 bytes JMP 00008000676d03b0 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW 00007fff697b4510 7 bytes JMP 00008000676d0340 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fff697b4af0 7 bytes JMP 00008000676d0260 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fff697dcea0 7 bytes JMP 00008000676d0228 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fff697dcf10 7 bytes JMP 00008000676d0298 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 00007fff6773299c 7 bytes JMP 00008000676d00d8 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 00007fff677354c8 5 bytes JMP 00008000676d0180 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 00007fff677355b0 5 bytes JMP 00008000676d0148 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 00007fff67735e58 5 bytes JMP 00008000676d0110 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 00007fff67ca9318 7 bytes JMP 00008000676d0500 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 00007fff67cacbe0 7 bytes JMP 00008000676d04c8 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x6dee80]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x6bee30]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x63ee20]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x61ee10]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x6feb90]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x71eb40]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x75e400]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x69e3e0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x4bd720]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x47cb60]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x53bf10]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x79b1c0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x4fae00]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x659960]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x4596c0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!CreateWindowExW 00007fff67ae7834 10 bytes JMP 00008000676d0490 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x57742c]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x43611c]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x3d57d0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 00007fff67aeb4d0 5 bytes JMP 00008000676d0420 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 00007fff67aec6d8 5 bytes JMP 00008000676d0458 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x3938a0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 41] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x5b1cf0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fff67aee39c 9 bytes JMP 00008000676d03e8 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x7b1b50]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x6713dc]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x3ede1c]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x4cd620]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x76c600]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x489f08]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x5d0ab0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x70c950]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x4e9e80]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x569b50]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x3463d0]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x7952c4]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x3626b8]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x5539f8]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x4d30ac]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fff69f21500 8 bytes JMP 00008000676d01b8 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fff69f21750 8 bytes JMP 00008000676d01f0 .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\taskhostex.exe[1884] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes JMP d0aca .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes JMP 4dc2d0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes JMP c4b .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes JMP 101 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes JMP 4a811 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes JMP 160000 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes JMP 134ae .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes JMP 3739c0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x212ee80]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x210ee30]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x208ee20]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x206ee10]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x214eb90]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x216eb40]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x20ee3e0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes JMP 20006a .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x1d8cb60]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x1f8bf10]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x21eb1c0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x20a9960]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x1d696c0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x1fc742c]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x1b5611c]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1a257d0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x19e38a0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 6 bytes {JMP QWORD [RIP+0x1b326f8]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes JMP 64003c .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x2201b50]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x20c13dc]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x1b0de1c]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x1ddd620]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x21bc600]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x1d99f08]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x2020ab0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x1f39e80]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x17563d0]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x21e52c4]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x19b26b8]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes JMP 6b006f .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x1f230ac]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes JMP 0 .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Explorer.EXE[1988] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1140] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00007fff6a1017f0 8 bytes JMP 0000800069eb00d8 .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 8 bytes JMP 0000800069eb0110 .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1140] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1140] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1140] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1140] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes JMP 0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes JMP 0 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes JMP 6da8 .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x4fee80]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x4dee30]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x45ee20]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x43ee10]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x51eb90]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x53eb40]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x57e400]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x4be3e0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x2dd720]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x29cb60]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x35bf10]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x5bb1c0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x31ae00]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x479960]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x2796c0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x39742c]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x25611c]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1f57d0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b38a0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 23] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x3d1cf0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x5d1b50]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x4913dc]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x20de1c]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x2ed620]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x58c600]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x2a9f08]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x3f0ab0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x52c950]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x309e80]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x389b50]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x1663d0]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x5b52c4]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1826b8]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x3739f8]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x2f30ac]} .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\svchost.exe[2536] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 69] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 53] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 61] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 5D] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 63] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 43] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 5B] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 4B] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 4D] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 5F] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 6D] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 3F] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 3D] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 55] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 45] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 41] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 49] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 47] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 65] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 6B] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 57] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes JMP 0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x59d150]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x4fd0b0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x51d020]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 00007fff697028c0 7 bytes JMP 00008000676d0340 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW 00007fff697043d8 7 bytes JMP 00008000676d0378 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 00007fff697b1f20 7 bytes JMP 00008000676d03e8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW 00007fff697b40b4 7 bytes JMP 00008000676d0420 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW 00007fff697b4510 7 bytes JMP 00008000676d03b0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fff697b4af0 7 bytes JMP 00008000676d02d0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fff697dcea0 7 bytes JMP 00008000676d0298 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fff697dcf10 7 bytes JMP 00008000676d0308 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 00007fff6773299c 7 bytes JMP 00008000676d00d8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 00007fff677354c8 5 bytes JMP 00008000676d0180 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 00007fff677355b0 5 bytes JMP 00008000676d0148 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 33] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 00007fff67735e58 5 bytes JMP 00008000676d0110 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x1da9770]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 6 bytes {JMP QWORD [RIP+0x1d80780]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x28cee80]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x28aee30]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x20eee20]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x20cee10]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x28eeb90]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x290eb40]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x294e400]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x23ce3e0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x1f6d720]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x1decb60]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x1febf10]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x298b1c0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x1faae00]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x2109960]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x1dc96c0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!CreateWindowExW 00007fff67ae7834 10 bytes JMP 00008000676d0500 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x202742c]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x1da611c]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1b557d0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 00007fff67aeb4d0 5 bytes JMP 00008000676d0490 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 00007fff67aec6d8 5 bytes JMP 00008000676d04c8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x1b138a0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 6 bytes {JMP QWORD [RIP+0x1d826f8]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x2061cf0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fff67aee39c 9 bytes JMP 00008000676d0458 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x29a1b50]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x21213dc]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x1d5de1c]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x1f7d620]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x295c600]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x1f39f08]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 4 bytes [FF, 25, B0, 0A] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendDlgItemMessageW + 5 00007fff67b0f585 1 byte [02] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x28fc950]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x1f99e80]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x2019b50]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x19f63d0]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x29852c4]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x1ae26b8]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x20039f8]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x1f830ac]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fff69f21500 8 bytes JMP 00008000676d01b8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fff69f21750 8 bytes JMP 00008000676d01f0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 00007fff67ca9318 7 bytes JMP 00008000676d0260 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 00007fff67cacbe0 7 bytes JMP 00008000676d0228 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\SearchIndexer.exe[2852] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 59] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 43] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 51] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 4D] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 53] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 33] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 4B] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 3B] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 3D] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4F] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 5D] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2F] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 2D] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 45] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 35] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 31] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 39] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 37] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 55] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 5B] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 47] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 57] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x49d150]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3fd0b0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x41d020]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 00007fff697028c0 7 bytes JMP 00008000676d0340 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW 00007fff697043d8 7 bytes JMP 00008000676d0378 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 00007fff697b1f20 7 bytes JMP 00008000676d03e8 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW 00007fff697b40b4 7 bytes JMP 00008000676d0420 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW 00007fff697b4510 7 bytes JMP 00008000676d03b0 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fff697b4af0 7 bytes JMP 00008000676d02d0 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fff697dcea0 7 bytes JMP 00008000676d0298 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fff697dcf10 7 bytes JMP 00008000676d0308 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 00007fff6773299c 7 bytes JMP 00008000676d00d8 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 00007fff677354c8 5 bytes JMP 00008000676d0180 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 00007fff677355b0 5 bytes JMP 00008000676d0148 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 00007fff67735e58 5 bytes JMP 00008000676d0110 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x212ee80]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x210ee30]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x208ee20]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x206ee10]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x214eb90]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x216eb40]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x21ae400]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x20ee3e0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x1dcd720]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x1d8cb60]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x1f8bf10]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x23cb1c0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x1f4ae00]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x20a9960]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x1d696c0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!CreateWindowExW 00007fff67ae7834 10 bytes JMP 00008000676d0500 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x1fc742c]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x1b5611c]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x1a257d0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 00007fff67aeb4d0 5 bytes JMP 00008000676d0490 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 00007fff67aec6d8 5 bytes JMP 00008000676d04c8 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x19e38a0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 6 bytes {JMP QWORD [RIP+0x1b326f8]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x2001cf0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fff67aee39c 9 bytes JMP 00008000676d0458 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x28a1b50]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x20c13dc]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x1b0de1c]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x1ddd620]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x21bc600]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x1d99f08]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x2020ab0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x215c950]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x1f39e80]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x1fb9b50]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x17563d0]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x28852c4]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x19b26b8]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x1fa39f8]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x1f230ac]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fff69f21500 8 bytes JMP 00008000676d01b8 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fff69f21750 8 bytes JMP 00008000676d01f0 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 00007fff67ca9318 7 bytes JMP 00008000676d0260 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 00007fff67cacbe0 7 bytes JMP 00008000676d0228 .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxEM.exe[2560] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00007fff6a091838 6 bytes {JMP QWORD [RIP+0x1de7f8]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtClose 00007fff6a101760 5 bytes [FF, 25, D0, E8, 14] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00007fff6a101830 5 bytes [FF, 25, 00, E8, 55] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00007fff6a101930 5 bytes [FF, 25, 00, E7, 3F] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fff6a1019a0 5 bytes [FF, 25, 90, E6, 4D] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00007fff6a1019e0 5 bytes [FF, 25, 50, E6, 49] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtAdjustPrivilegesToken 00007fff6a101a80 5 bytes [FF, 25, B0, E5, 4F] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00007fff6a101af0 5 bytes [FF, 25, 40, E5, 2F] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00007fff6a101b10 5 bytes [FF, 25, 20, E5, 47] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00007fff6a101b50 5 bytes [FF, 25, E0, E4, 37] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00007fff6a101ba0 5 bytes [FF, 25, 90, E4, 39] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fff6a101bc0 5 bytes [FF, 25, 70, E4, 4B] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcConnectPort 00007fff6a101dd0 5 bytes [FF, 25, 60, E2, 59] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcCreatePort 00007fff6a101df0 5 bytes [FF, 25, 40, E2, 2B] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00007fff6a101ef0 5 bytes [FF, 25, 40, E1, 29] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtConnectPort 00007fff6a101ff0 5 bytes [FF, 25, 40, E0, 41] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00007fff6a102040 5 bytes [FF, 25, F0, DF, 31] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00007fff6a1020d0 5 bytes [FF, 25, 60, DF, 2D] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreatePort 00007fff6a102100 5 bytes [FF, 25, 30, DF, 35] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00007fff6a102160 5 bytes [FF, 25, D0, DE, 33] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSymbolicLinkObject 00007fff6a102170 5 bytes [FF, 25, C0, DE, 51] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007fff6a102180 5 bytes [FF, 25, B0, DE, 57] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00007fff6a102590 5 bytes [FF, 25, A0, DA, 43] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtMakeTemporaryObject 00007fff6a102620 5 bytes [FF, 25, 10, DA, 53] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00007fff6a102ee0 6 bytes {JMP QWORD [RIP+0x45d150]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00007fff6a102f80 6 bytes {JMP QWORD [RIP+0x3bd0b0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00007fff6a103010 6 bytes {JMP QWORD [RIP+0x3dd020]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 00007fff697028c0 7 bytes JMP 00008000676d0340 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW 00007fff697043d8 7 bytes JMP 00008000676d0378 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 00007fff697b1f20 7 bytes JMP 00008000676d03e8 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW 00007fff697b40b4 7 bytes JMP 00008000676d0420 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW 00007fff697b4510 7 bytes JMP 00008000676d03b0 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fff697b4af0 7 bytes JMP 00008000676d02d0 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fff697dcea0 7 bytes JMP 00008000676d0298 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fff697dcf10 7 bytes JMP 00008000676d0308 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 00007fff6773299c 7 bytes JMP 00008000676d00d8 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 00007fff677354c8 5 bytes JMP 00008000676d0180 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 00007fff677355b0 5 bytes JMP 00008000676d0148 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fff67735676 3 bytes [94, A9, 10] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 00007fff67735e58 5 bytes JMP 00008000676d0110 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 00007fff677468c0 6 bytes {JMP QWORD [RIP+0x169770]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\KERNELBASE.dll!SetProcessShutdownParameters 00007fff6774f8b0 5 bytes [FF, 25, 80, 07, 14] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!MoveWindow 00007fff67ae11b0 6 bytes {JMP QWORD [RIP+0x6dee80]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SetParent 00007fff67ae1200 6 bytes {JMP QWORD [RIP+0x6bee30]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!GetKeyboardState 00007fff67ae1210 6 bytes {JMP QWORD [RIP+0x63ee20]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendInput 00007fff67ae1220 6 bytes {JMP QWORD [RIP+0x61ee10]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SetClipboardViewer 00007fff67ae14a0 6 bytes {JMP QWORD [RIP+0x6feb90]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!BlockInput 00007fff67ae14f0 6 bytes {JMP QWORD [RIP+0x71eb40]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!RegisterHotKey 00007fff67ae1c30 6 bytes {JMP QWORD [RIP+0x75e400]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!RegisterRawInputDevices 00007fff67ae1c50 6 bytes {JMP QWORD [RIP+0x69e3e0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!PostThreadMessageW 00007fff67ae2910 6 bytes {JMP QWORD [RIP+0x4bd720]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!PostMessageW 00007fff67ae34d0 6 bytes {JMP QWORD [RIP+0x47cb60]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendMessageTimeoutW + 1 00007fff67ae4121 5 bytes {JMP QWORD [RIP+0x53bf10]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SystemParametersInfoW 00007fff67ae4e70 6 bytes {JMP QWORD [RIP+0x79b1c0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendMessageW 00007fff67ae5230 6 bytes {JMP QWORD [RIP+0x4fae00]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!GetKeyState + 1 00007fff67ae66d1 5 bytes {JMP QWORD [RIP+0x659960]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!PostMessageA 00007fff67ae6970 6 bytes {JMP QWORD [RIP+0x4596c0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!CreateWindowExW 00007fff67ae7834 10 bytes JMP 00008000676d0500 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendMessageCallbackW 00007fff67ae8c04 6 bytes {JMP QWORD [RIP+0x57742c]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SetWindowLongW 00007fff67ae9f14 6 bytes {JMP QWORD [RIP+0x43611c]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SetWindowsHookExW 00007fff67aea860 6 bytes {JMP QWORD [RIP+0x3d57d0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 00007fff67aeb4d0 5 bytes JMP 00008000676d0490 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 00007fff67aec6d8 5 bytes JMP 00008000676d04c8 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!mouse_event 00007fff67aec790 6 bytes {JMP QWORD [RIP+0x3938a0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SetWindowLongA 00007fff67aed938 5 bytes [FF, 25, F8, 26, 41] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendNotifyMessageW 00007fff67aee340 6 bytes {JMP QWORD [RIP+0x5b1cf0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fff67aee39c 9 bytes JMP 00008000676d0458 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!EnableWindow 00007fff67aee4e0 6 bytes {JMP QWORD [RIP+0x7b1b50]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!GetAsyncKeyState 00007fff67aeec54 6 bytes {JMP QWORD [RIP+0x6713dc]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SetWinEventHook + 1 00007fff67af2215 5 bytes {JMP QWORD [RIP+0x3ede1c]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendMessageA 00007fff67af2a10 6 bytes {JMP QWORD [RIP+0x4cd620]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SystemParametersInfoA 00007fff67af3a30 6 bytes {JMP QWORD [RIP+0x76c600]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!PostThreadMessageA 00007fff67af6128 6 bytes {JMP QWORD [RIP+0x489f08]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendDlgItemMessageW 00007fff67b0f580 6 bytes {JMP QWORD [RIP+0x5d0ab0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!GetClipboardData 00007fff67b136e0 6 bytes {JMP QWORD [RIP+0x70c950]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendMessageTimeoutA 00007fff67b161b0 6 bytes {JMP QWORD [RIP+0x4e9e80]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendNotifyMessageA 00007fff67b164e0 6 bytes {JMP QWORD [RIP+0x569b50]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!keybd_event 00007fff67b19c60 6 bytes {JMP QWORD [RIP+0x3463d0]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!ExitWindowsEx 00007fff67b2ad6c 6 bytes {JMP QWORD [RIP+0x7952c4]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SetWindowsHookExA 00007fff67b3d978 6 bytes {JMP QWORD [RIP+0x3626b8]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendDlgItemMessageA 00007fff67b6c638 6 bytes {JMP QWORD [RIP+0x5539f8]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\USER32.dll!SendMessageCallbackA 00007fff67b6cf84 6 bytes {JMP QWORD [RIP+0x4d30ac]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fff69f21500 8 bytes JMP 00008000676d01b8 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fff69f21750 8 bytes JMP 00008000676d01f0 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!BitBlt 00007fff69f23bb0 6 bytes {JMP QWORD [RIP+0x3fc480]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!CreateDCA 00007fff69f32eec 6 bytes {JMP QWORD [RIP+0x35d144]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!CreateDCW 00007fff69f330d0 6 bytes {JMP QWORD [RIP+0x37cf60]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!StretchBlt 00007fff69f3e77c 6 bytes {JMP QWORD [RIP+0x4418b4]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!GetPixel 00007fff69f3e8e0 6 bytes {JMP QWORD [RIP+0x391750]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!MaskBlt 00007fff69f46598 6 bytes {JMP QWORD [RIP+0x3f9a98]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\GDI32.dll!PlgBlt 00007fff69f93514 6 bytes {JMP QWORD [RIP+0x3ccb1c]} .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 00007fff67ca9318 7 bytes JMP 00008000676d0260 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 00007fff67cacbe0 7 bytes JMP 00008000676d0228 .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff694b169a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff694b16a2 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff694b181a 4 bytes [4B, 69, FF, 7F] .text C:\Windows\system32\igfxHK.exe[2500] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff694b1832 4 bytes [4B, 69, FF, 7F] ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\system32\services.exe[700] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\lsass.exe[708] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[784] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[828] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[828] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[920] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[920] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[920] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[920] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\dwm.exe[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\dwmredir.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\uxtheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\dwm.exe[932] @ C:\Windows\system32\uDWM.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\COMCTL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\COMDLG32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\system32\uxtheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\System32\Dxtrans.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\System32\ATL.DLL[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\System32\ddrawex.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\System32\DDRAW.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\nvvsvc.exe[964] @ C:\Windows\System32\DCIMAN32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[972] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\svchost.exe[436] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\svchost.exe[436] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\svchost.exe[436] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[464] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[464] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[464] @ c:\windows\system32\ATL.DLL[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[464] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[464] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[512] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[512] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[512] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\SYSTEM32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.17227_none_932c0e57474f5080\gdiplus.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\system32\COMDLG32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.16384_none_34a8918f959016ea\COMCTL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[856] @ C:\Windows\SYSTEM32\UxTheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxCUIService.exe[1044] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxCUIService.exe[1044] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxCUIService.exe[1044] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\svchost.exe[1120] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\svchost.exe[1120] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\svchost.exe[1120] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\spoolsv.exe[1492] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\spoolsv.exe[1492] @ C:\Windows\System32\localspl.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\spoolsv.exe[1492] @ C:\Windows\System32\PrintIsolationProxy.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\spoolsv.exe[1492] @ C:\Windows\System32\ATL.DLL[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\System32\spoolsv.exe[1492] @ C:\Windows\system32\spool\PRTPROCS\x64\winprint.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[1544] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[1544] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[1544] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[1544] @ C:\Windows\System32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\uxtheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\MSUTB.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\taskhostex.exe[1884] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\Explorer.EXE[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\SYSTEM32\UxTheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\SYSTEM32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\SYSTEM32\DUI70.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\Comctl32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\SYSTEM32\DUser.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\twinui.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\explorerframe.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\System32\thumbcache.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\System32\InputSwitch.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\stobject.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\BatMeter.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\prnfldr.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\SYSTEM32\ntshrui.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.17227_none_932c0e57474f5080\gdiplus.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\authui.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\System32\AltTab.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\WSShared.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\NetworkExplorer.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\System32\Windows.UI.Xaml.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Program Files\MICROS~1\Office15\GROOVEEX.DLL[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\System32\hgcpl.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\System32\ieframe.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\SYSTEM32\MsftEdit.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\system32\UIRibbon.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Explorer.EXE[1988] @ C:\Windows\System32\werconcpl.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] @ C:\Windows\system32\shell32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2376] @ C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\wpfgfx_v0300.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\svchost.exe[2536] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.9600.16384_none_34a8918f959016ea\COMCTL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\system32\COMDLG32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.17227_none_932c0e57474f5080\gdiplus.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\SYSTEM32\UxTheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\SYSTEM32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2816] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\COMCTL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\SearchIndexer.exe[2852] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\SearchIndexer.exe[2852] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\SearchIndexer.exe[2852] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\SHELL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\uxtheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\comctl32.DLL[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\OPENGL32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\DDRAW.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxEM.exe[2560] @ C:\Windows\system32\DCIMAN32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxHK.exe[2500] @ C:\Windows\system32\USER32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxHK.exe[2500] @ C:\Windows\system32\ole32.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxHK.exe[2500] @ C:\Windows\system32\SHLWAPI.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxHK.exe[2500] @ C:\Windows\system32\MSCTF.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxHK.exe[2500] @ C:\Windows\system32\uxtheme.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxHK.exe[2500] @ C:\Windows\system32\dwmapi.dll[GDI32.dll!DeleteDC] [7fff6a220000] IAT C:\Windows\system32\igfxHK.exe[2500] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1\comctl32.DLL[GDI32.dll!DeleteDC] [7fff6a220000] ---- Devices - GMER 2.1 ---- Device \Driver\storahci \Device\RaidPort0 ffffe000c20132c0 Device \Driver\cdrom \Device\CdRom0 ffffe000c21af2c0 Device \Driver\storahci \Device\0000002d ffffe000c20132c0 Device \Driver\storahci \Device\ScsiPort0 ffffe000c20132c0 Device \Driver\storahci \Device\0000002e ffffe000c20132c0 ---- Trace I/O - GMER 2.1 ---- Trace ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xffffe000c20132c0]<< sptd.sys storport.sys hal.dll storahci.sys ffffe000c20132c0 Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000c204e6e0] ffffe000c204e6e0 Trace 3 CLASSPNP.SYS[fffff800ee81d27b] -> nt!IofCallDriver -> \Device\0000002d[0xffffe000c1e3f060] ffffe000c1e3f060 Trace \Driver\storahci[0xffffe000c1e085a0] -> IRP_MJ_CREATE -> 0xffffe000c20132c0 ffffe000c20132c0 ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\csrss.exe [608:636] fffff96000809b90 Thread C:\Windows\Explorer.EXE [1988:3432] 00007fff5c84d73c Thread C:\Windows\Explorer.EXE [1988:3632] 00007fff5c84d73c ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----

**Posty:** 4765 · przez **ordynat** 28 Gru 2014, 14:37

Tylko kosmetyka:
Otwórz Notatnik i wklej w nim:

CHR HKLM-x32\...\Chrome\Extension: [dghncoeocefmhkhiphdgikkamjeglbfh] - C:\Program Files (x86)\mystarttb\chrome-newtab-search.crx
EmptyTemp:

Plik zapisz pod nazwą [color="#483D8B"]fixlist.txt[/color] i umieść obok FRST. Uruchom FRST i kliknij przycisk Fix.
.