<s>[INST] You are a cybersecurity and NLP expert tasked with named entity extraction. You need to provide the named entities for each token in the given sentence. You will be penalized for incorrect predictions. Identify the entities for the following sentence: 'Copy the stage 5 DLL into winlogon.exe Allocate a chunk of memory in winlogon.exe process and copy the same APC routine seen previously Read and save the original pointer of the __fnDWORD internal User32 routine ( located at offset +0x10 of the KernelCallbackTable ) and replace this pointer with the address of the APC stub routine After this function pointer hijacking , when winlogon.exe makes any graphical call ( GDI ) , the malicious code can execute without using CreateRemoteThread or' [/INST] [Copy:O, the:O, stage:O, 5:O, DLL:O, into:O, winlogon.exe:B-Indicator, Allocate:O, a:O, chunk:O, of:O, memory:O, in:O, winlogon.exe:B-Indicator, process:O, and:O, copy:O, the:O, same:O, APC:O, routine:O, seen:O, previously:O, Read:O, and:O, save:O, the:O, original:O, pointer:O, of:O, the:O, __fnDWORD:O, internal:O, User32:O, routine:O, (:O, located:O, at:O, offset:O, +0x10:O, of:O, the:O, KernelCallbackTable:O, ):O, and:O, replace:O, this:O, pointer:O, with:O, the:O, address:O, of:O, the:O, APC:O, stub:O, routine:O, After:O, this:O, function:O, pointer:O, hijacking:O, ,:O, when:O, winlogon.exe:B-Indicator, makes:O, any:O, graphical:O, call:O, (:O, GDI:O, ):O, ,:O, the:O, malicious:O, code:O, can:O, execute:O, without:O, using:O, CreateRemoteThread:O, or:O] </s>