Mirrors/wavestone-cdt-edrsandblast
1
0
Fork 0
mirror of https://github.com/wavestone-cdt/EDRSandblast.git synced 2026-06-09 08:57:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit for public version

Browse Source 
Co-authored-by: Thomas Diot <thomas.diot@wavestone.com>
This commit is contained in:
Maxime Meignan
2021-11-08 09:54:05 +01:00
commit 4bff81986b
42 changed files with 8490 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Offsets/ExtractOffsets.py
+268
View File
@@ -0,0 +1,268 @@
import argparse
import csv
import os
from requests import get
from gzip import decompress
from json import loads, dumps
from subprocess import run
import win32api
from concurrent.futures import ThreadPoolExecutor
import threading
CSVLock = threading.Lock()
machineType = dict(x86=332, x64=34404)
knownImageVersions = dict(ntoskrnl=list(), wdigest=list())
extensions_by_mode = dict(ntoskrnl="exe", wdigest="dll")
def downloadSpecificFile(entry, pe_basename, pe_ext, knownPEVersions, output_folder):
pe_name = f'{pe_basename}.{pe_ext}'
if 'fileInfo' not in entry:
# print(f'[!] Entry {pe_hash} has no fileInfo, skipping it.')
return "SKIP"
if 'timestamp' not in entry['fileInfo']:
# print(f'[!] Entry {pe_hash} has no timestamp, skipping it.')
return "SKIP"
timestamp = entry['fileInfo']['timestamp']
if 'virtualSize' not in entry['fileInfo']:
# print(f'[!] Entry {pe_hash} has no virtualSize, skipping it.')
return "SKIP"
if "machineType" not in entry["fileInfo"] or entry["fileInfo"]["machineType"] != machineType["x64"]:
return "SKIP"
virtual_size = entry['fileInfo']['virtualSize']
file_id = hex(timestamp).replace('0x','').zfill(8).upper() + hex(virtual_size).replace('0x','')
url = 'https://msdl.microsoft.com/download/symbols/' + pe_name + '/' + file_id + '/' + pe_name
version = entry['fileInfo']['version'].split(' ')[0]
# Output file format: <PE>_build-revision.<exe | dll>
output_version = '-'.join(version.split('.')[-2:])
output_file = f'{pe_basename}_{output_version}.{pe_ext}'
# If the PE version is already known, skip download.
if output_file in knownPEVersions:
print(f'[*] Skipping download of known {pe_name} version: {output_file}')
return "SKIP"
output_file_path = os.path.join(output_folder, output_file)
if os.path.isfile(output_file_path):
print(f"[*] Skipping {output_file_path} which already exists")
return "SKIP"
print(f'[*] Downloading {pe_name} version {version}... ')
try:
peContent = get(url)
with open(output_file_path, 'wb') as f:
f.write(peContent.content)
print(f'[+] Finished download of {pe_name} version {version} (file: {output_file})!')
return "OK"
except Exception:
print(f'[!] ERROR : Could not download {pe_name} version {version} (URL: {url}).')
return "KO"
def dowloadPEFileFromMS(pe_basename, pe_ext, knownPEVersions, output_folder):
pe_name = f'{pe_basename}.{pe_ext}'
print (f'[*] Downloading {pe_name} files!')
pe_json_gz = get(f'https://winbindex.m417z.com/data/by_filename_compressed/{pe_name}.json.gz').content
pe_json = decompress(pe_json_gz)
pe_list = loads(pe_json)
futures = dict()
with ThreadPoolExecutor() as executor:
for pe_hash in pe_list:
entry = pe_list[pe_hash]
futures[pe_hash] = executor.submit(downloadSpecificFile,entry, pe_basename, pe_ext, knownPEVersions, output_folder)
for (i,f) in enumerate(futures):
res = futures[f].result()
print(f"{i+1}/{len(futures)}", end="\r")
def get_symbol_offset(symbols_info, symbol_name):
for line in symbols_info:
# sometimes, a "_" is prepended to the symbol name ...
if line.strip().split(" ")[-1].endswith(symbol_name):
return int(line.split(" ")[0], 16)
else:
return 0
def get_field_offset(symbols_info, field_name):
for line in symbols_info:
if field_name in line:
assert "offset" in line
symbol_offset = int(line.split("+")[-1], 16)
return symbol_offset
else:
return 0
def get_file_version(path):
info = win32api.GetFileVersionInfo(path, '\\')
ms = info['FileVersionMS']
ls = info['FileVersionLS']
return (win32api.HIWORD(ms), win32api.LOWORD(ms),
win32api.HIWORD(ls), win32api.LOWORD(ls))
def extractOffsets(input_file, output_file, mode):
if os.path.isfile(input_file):
try:
# check image type (ntoskrnl, wdigest, etc.)
r = run(["r2", "-c", "iE", "-qq", input_file], shell=True, capture_output=True)
for line in r.stdout.decode().splitlines():
if "ntoskrnl.exe" in line:
imageType = "ntoskrnl"
break
elif "wdigest.dll" in line:
imageType = "wdigest"
break
else:
print(f"[*] File {input_file} unrecognized")
return
#todo : remove this and make a unique function
if mode != imageType:
print(f"[*] Skipping {input_file} since we are in {mode} mode")
return
# dump version number
"""
r = run(["r2", "-c", "iV", "-qq", input_file], shell=True, capture_output=True)
for line in r.stdout.decode().splitlines():
line = line.strip()
if line.startswith("FileVersion:"):
full_version = [int(frag) for frag in line.split(" ")[-1].split(".")]
break
else:
assert(False)
"""
if os.path.sep not in input_file:
input_file = "." + os.path.sep + input_file
full_version = get_file_version(input_file)
# Checks if the image version is already present in the CSV
extension = extensions_by_mode[imageType]
imageVersion = f'{imageType}_{full_version[2]}-{full_version[3]}.{extension}'
if imageVersion in knownImageVersions[imageType]:
print(f'[*] Skipping known {imageType} version {imageVersion} (file: {input_file})')
return
print(f'[*] Processing {imageType} version {imageVersion} (file: {input_file})')
# download the PDB if needed
r = run(["r2", "-c", "idpd", "-qq", input_file], shell=True, capture_output=True)
# dump all symbols
r = run(["r2", "-c", "idpi", "-qq", '-B', '0', input_file], shell=True, capture_output=True)
all_symbols_info = [line.strip() for line in r.stdout.decode().splitlines()]
if imageType == "ntoskrnl":
symbols = [("PspCreateProcessNotifyRoutine",get_symbol_offset),
("PspCreateThreadNotifyRoutine",get_symbol_offset),
("PspLoadImageNotifyRoutine", get_symbol_offset),
('_PS_PROTECTION Protection', get_field_offset),
("EtwThreatIntProvRegHandle", get_symbol_offset),
('_ETW_GUID_ENTRY* GuidEntry', get_field_offset),
('_TRACE_ENABLE_INFO ProviderEnableInfo', get_field_offset)]
elif imageType == "wdigest":
symbols = [
("g_fParameter_UseLogonCredential",get_symbol_offset),
("g_IsCredGuardEnabled",get_symbol_offset)
]
symbols_values = list()
for symbol_name, get_offset in symbols:
symbol_value = get_offset(all_symbols_info, symbol_name)
symbols_values.append(symbol_value)
#print(f"[+] {symbol_name} = {hex(symbol_value)}")
with CSVLock:
with open(output_file, 'a') as output:
output.write(f'{imageVersion},{",".join(hex(val).replace("0x","") for val in symbols_values)}\n')
#print("wrote into CSV !")
knownImageVersions[imageType].append(imageVersion)
print(f'[+] Finished processing of {imageType} {input_file}!')
except Exception as e:
print(f'[!] ERROR : Could not process file {input_file}.')
print(f'[!] Error message: {e}')
print(f'[!] If error is of the like of "\'NoneType\' object has no attribute \'group\'", kernel callbacks may not be supported by this version.')
elif os.path.isdir(input_file):
print(f'[*] Processing folder: {input_file}')
with ThreadPoolExecutor() as extractorPool:
args = [(os.path.join(input_file, file), output_file, mode) for file in os.listdir(input_file)]
for (i,res) in enumerate(extractorPool.map(extractOffsets, *zip(*args))):
print(f"{i+1}/{len(args)}", end="\r")
print(f'[+] Finished processing of folder {input_file}!')
else:
print(f'[!] ERROR : The specified input {input_file} is neither a file nor a directory.')
def loadOffsetsFromCSV(loadedVersions, CSVPath):
print(f'[*] Loading the known known PE versions from "{CSVPath}".')
with open(CSVPath, "r") as csvFile:
csvReader = csv.reader(csvFile, delimiter=',')
next(csvReader)
for peLine in csvReader:
loadedVersions.append(peLine[0])
if __name__ == '__main__':
parser = argparse.ArgumentParser()
parser.add_argument('mode', help='ntoskrnl or wdigest. Mode to download and extract offsets for either ntoskrnl or wdigest')
parser.add_argument('-i', '--input', dest='input', required=True,
help='Single file or directory containing ntoskrnl.exe / wdigest.dll to extract offsets from. If in dowload mode, the PE downloaded from MS symbols servers will be placed in this folder.')
parser.add_argument('-o', '--output', dest='output',
help='CSV file to write offsets to. If the specified file already exists, only new ntoskrnl versions will be downloaded / analyzed. Defaults to NtoskrnlOffsets.csv / WdigestOffsets.csv in the current folder.')
parser.add_argument('-d', '--dowload', dest='dowload', action='store_true',
help='Flag to download the PE from Microsoft servers using list of versions from winbindex.m417z.com.')
args = parser.parse_args()
mode = args.mode
if mode not in knownImageVersions:
print(f'[!] ERROR : unsupported mode "{args.mode}", supported mode are: "ntoskrnl" and "wdigest"')
exit(1)
# check R2 version
output = run(["r2", "-V"], shell=True, capture_output=True).stdout.decode()
ma,me,mi = map(int, output.splitlines()[0].split(" ")[0].split("."))
if (ma, me, mi) < (5,4,3):
print("WARNING : This script has been tested with radare2 5.4.3 (works) and 4.3.1 (does NOT work)")
print(f"You have version {ma}.{me}.{mi}, if is does not work correctly, meaning most of the offsets are not found (i.e. 0), check radare2's 'idpi' command output and modify get_symbol_offset() & get_field_offset() to parse symbols correctly")
input("Press enter to continue")
# If the output file exists, load the already analyzed image versions.
# Otherwise, write CSV headers to the new file.
if not args.output:
args.output = mode.capitalize() + 'Offsets.csv'
if os.path.isfile(args.output):
loadOffsetsFromCSV(knownImageVersions[mode], args.output)
print(f'[+] Loaded {len(knownImageVersions[mode])} known {mode} versions from "{args.output}"')
else:
with open(args.output, 'w') as output:
if mode == "ntoskrnl":
output.write('ntoskrnlVersion,PspCreateProcessNotifyRoutineOffset,PspCreateThreadNotifyRoutineOffset,PspLoadImageNotifyRoutineOffset,_PS_PROTECTIONOffset,EtwThreatIntProvRegHandleOffset,EtwRegEntry_GuidEntryOffset,EtwGuidEntry_ProviderEnableInfoOffset\n')
elif mode == "wdigest":
output.write('wdigestVersion,g_fParameter_UseLogonCredentialOffset,g_IsCredGuardEnabledOffset\n')
else:
assert False
# In download mode, an updated list of image versions published will be retrieved from https://winbindex.m417z.com.
# The symbols for each version will be dowloaded from the Microsoft symbols servers.
# Only new versions will be downloaded if the specified output file already contains offsets.
if (args.dowload):
if not os.path.isdir(args.input):
print('[!] ERROR : in download mode, -i / --input option must specify a folder')
exit(1)
extension = extensions_by_mode[mode]
dowloadPEFileFromMS(mode, extension, knownImageVersions[mode], args.input)
# Extract the offsets from the specified file or the folders containing image files.
extractOffsets(args.input, args.output, mode)
Offsets/NtoskrnlOffsets.csv
+420
View File
@@ -0,0 +1,420 @@
ntoskrnlVersion,PspCreateProcessNotifyRoutineOffset,PspCreateThreadNotifyRoutineOffset,PspLoadImageNotifyRoutineOffset,_PS_PROTECTIONOffset,EtwThreatIntProvRegHandleOffset,EtwRegEntry_GuidEntryOffset,EtwGuidEntry_ProviderEnableInfoOffset
ntoskrnl_9600-20111.exe,2dac50,2daa50,2da850,67a,0,20,50
ntoskrnl_10240-16384.exe,35d2e0,35d0e0,35cee0,6aa,0,20,50
ntoskrnl_10240-17394.exe,35d420,35d220,35d020,6aa,0,20,50
ntoskrnl_10240-17443.exe,35c420,35c220,35c020,6aa,0,20,50
ntoskrnl_10240-17446.exe,35c420,35c220,35c020,6aa,0,20,50
ntoskrnl_10240-17488.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50
ntoskrnl_10240-17533.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50
ntoskrnl_10240-17609.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50
ntoskrnl_10240-17643.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50
ntoskrnl_10240-17709.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50
ntoskrnl_10240-17738.exe,366520,366320,366120,6b2,0,20,50
ntoskrnl_10240-17770.exe,366520,366320,366120,6b2,0,20,50
ntoskrnl_10240-17797.exe,366520,366320,366120,6b2,0,20,50
ntoskrnl_10240-17831.exe,366520,366320,366120,6b2,0,20,50
ntoskrnl_10240-17861.exe,3664e0,3662e0,3660e0,6b2,0,20,50
ntoskrnl_10240-17889.exe,3644e0,3642e0,3640e0,6b2,0,20,50
ntoskrnl_10240-17914.exe,3644e0,3642e0,3640e0,6b2,0,20,50
ntoskrnl_10240-17976.exe,3694e0,3692e0,3690e0,6b2,0,20,50
ntoskrnl_10240-18005.exe,3694e0,3692e0,3690e0,6b2,0,20,50
ntoskrnl_10240-18036.exe,369520,369320,369120,6b2,0,20,50
ntoskrnl_10240-18063.exe,369520,369320,369120,6b2,0,20,50
ntoskrnl_10240-18094.exe,369520,369320,369120,6b2,0,20,50
ntoskrnl_10240-18132.exe,369520,369320,369120,6b2,0,20,50
ntoskrnl_10240-18158.exe,369520,369320,369120,6b2,0,20,50
ntoskrnl_10240-18275.exe,369520,369320,369120,6b2,0,20,50
ntoskrnl_10240-18303.exe,369520,369320,369120,6b2,0,20,50
ntoskrnl_10240-18427.exe,367520,367320,367120,6b2,0,20,50
ntoskrnl_10240-18452.exe,367520,367320,367120,6b2,0,20,50
ntoskrnl_10240-18485.exe,3684e0,3682e0,3680e0,6b2,0,20,50
ntoskrnl_10240-18545.exe,3684e0,3682e0,3680e0,6b2,0,20,50
ntoskrnl_10240-18575.exe,3684e0,3682e0,3680e0,6b2,0,20,50
ntoskrnl_10240-18608.exe,3684e0,3682e0,3680e0,6b2,0,20,50
ntoskrnl_10240-18638.exe,3684e0,3682e0,3680e0,6b2,0,20,50
ntoskrnl_10240-18666.exe,367560,367360,367160,6b2,0,20,50
ntoskrnl_10240-18725.exe,367560,367360,367160,6b2,0,20,50
ntoskrnl_10240-18756.exe,367560,367360,367160,6b2,0,20,50
ntoskrnl_10240-18841.exe,367560,367360,367160,6b2,0,20,50
ntoskrnl_10240-18906.exe,367560,367360,367160,6b2,0,20,50
ntoskrnl_10586-0.exe,317180,316f80,316d80,6b2,0,20,50
ntoskrnl_10586-1176.exe,3161c0,315fc0,315dc0,6b2,0,20,50
ntoskrnl_10586-1177.exe,3161c0,315fc0,315dc0,6b2,0,20,50
ntoskrnl_10586-1295.exe,3161c0,315fc0,315dc0,6b2,0,20,50
ntoskrnl_10586-1356.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50
ntoskrnl_10586-1417.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50
ntoskrnl_10586-1478.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50
ntoskrnl_10586-1540.exe,31a300,31a100,319f00,6ba,0,20,50
ntoskrnl_14393-0.exe,33bba0,33b9a0,33b7a0,6c2,0,20,50
ntoskrnl_14393-1198.exe,335860,335660,335460,6c2,0,20,50
ntoskrnl_14393-1532.exe,3348a0,3346a0,3344a0,6c2,0,20,50
ntoskrnl_14393-1670.exe,3348a0,3346a0,3344a0,6c2,0,20,50
ntoskrnl_14393-1737.exe,3348a0,3346a0,3344a0,6c2,0,20,50
ntoskrnl_14393-1770.exe,3348a0,3346a0,3344a0,6c2,0,20,50
ntoskrnl_14393-2189.exe,33ea20,33e820,33e620,6ca,0,20,50
ntoskrnl_14393-2214.exe,33ea20,33e820,33e620,6ca,0,20,50
ntoskrnl_14393-2248.exe,33da60,33d860,33d660,6ca,0,20,50
ntoskrnl_14393-2273.exe,33da60,33d860,33d660,6ca,0,20,50
ntoskrnl_14393-2312.exe,33ca20,33c820,33c620,6ca,0,20,50
ntoskrnl_14393-2363.exe,33ca20,33c820,33c620,6ca,0,20,50
ntoskrnl_14393-2395.exe,33bb60,33b960,33b760,6ca,0,20,50
ntoskrnl_14393-2430.exe,338b60,338960,338760,6ca,0,20,50
ntoskrnl_14393-2485.exe,338b20,338920,338720,6ca,0,20,50
ntoskrnl_14393-2551.exe,338b20,338920,338720,6ca,0,20,50
ntoskrnl_14393-2580.exe,338b20,338920,338720,6ca,0,20,50
ntoskrnl_14393-2608.exe,338b20,338920,338720,6ca,0,20,50
ntoskrnl_14393-2636.exe,338be0,3389e0,3387e0,6ca,0,20,50
ntoskrnl_14393-2665.exe,338be0,3389e0,3387e0,6ca,0,20,50
ntoskrnl_14393-2724.exe,338be0,3389e0,3387e0,6ca,0,20,50
ntoskrnl_14393-2791.exe,338b20,338920,338720,6ca,0,20,50
ntoskrnl_14393-2848.exe,338b20,338920,338720,6ca,0,20,50
ntoskrnl_14393-2906.exe,338b20,338920,338720,6ca,0,20,50
ntoskrnl_14393-2969.exe,339a20,339820,339620,6ca,0,20,50
ntoskrnl_14393-3085.exe,339a20,339820,339620,6ca,0,20,50
ntoskrnl_14393-3115.exe,339a20,339820,339620,6ca,0,20,50
ntoskrnl_14393-3143.exe,339a20,339820,339620,6ca,0,20,50
ntoskrnl_14393-3204.exe,339a20,339820,339620,6ca,0,20,50
ntoskrnl_14393-3241.exe,339a60,339860,339660,6ca,0,20,50
ntoskrnl_14393-3269.exe,339a60,339860,339660,6ca,0,20,50
ntoskrnl_14393-3297.exe,339a60,339860,339660,6ca,0,20,50
ntoskrnl_14393-3321.exe,339a60,339860,339660,6ca,0,20,50
ntoskrnl_14393-3383.exe,339a60,339860,339660,6ca,0,20,50
ntoskrnl_14393-3442.exe,339a60,339860,339660,6ca,0,20,50
ntoskrnl_14393-3471.exe,33ae60,33ac60,33aa60,6ca,0,20,50
ntoskrnl_14393-3503.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3541.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3564.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3595.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3630.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3659.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3686.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3750.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3755.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3808.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3866.exe,33ae60,33ac60,33aa60,6ca,0,20,50
ntoskrnl_14393-3930.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-3986.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4046.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4104.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4169.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4225.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4283.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4350.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4402.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4467.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4470.exe,33aee0,33ace0,33aae0,6ca,0,20,50
ntoskrnl_14393-4530.exe,33ae60,33ac60,33aa60,6ca,0,20,50
ntoskrnl_14393-4583.exe,33ae60,33ac60,33aa60,6ca,0,20,50
ntoskrnl_14393-4651.exe,33ae60,33ac60,33aa60,6ca,0,20,50
ntoskrnl_14393-576.exe,33bca0,33baa0,33b8a0,6c2,0,20,50
ntoskrnl_14393-726.exe,335860,335660,335460,6c2,0,20,50
ntoskrnl_14393-953.exe,335860,335660,335460,6c2,0,20,50
ntoskrnl_15063-0.exe,382290,382090,381e90,6ca,341ea8,20,50
ntoskrnl_15063-1029.exe,389550,389350,389150,6ca,348fa8,20,50
ntoskrnl_15063-1088.exe,3894d0,3892d0,3890d0,6ca,348fb8,20,50
ntoskrnl_15063-1155.exe,387510,387310,387110,6ca,346f68,20,50
ntoskrnl_15063-1206.exe,387510,387310,387110,6ca,346f68,20,50
ntoskrnl_15063-1266.exe,384410,384210,384010,6ca,343f48,20,50
ntoskrnl_15063-13.exe,382290,382090,381e90,6ca,341ea8,20,50
ntoskrnl_15063-1324.exe,385490,385290,385090,6ca,344f88,20,50
ntoskrnl_15063-1387.exe,385490,385290,385090,6ca,344f98,20,50
ntoskrnl_15063-1418.exe,385490,385290,385090,6ca,344f98,20,50
ntoskrnl_15063-1446.exe,385490,385290,385090,6ca,344fa8,20,50
ntoskrnl_15063-1478.exe,385450,385250,385050,6ca,344f68,20,50
ntoskrnl_15063-1563.exe,385450,385250,385050,6ca,344f68,20,50
ntoskrnl_15063-1596.exe,385450,385250,385050,6ca,344f68,20,50
ntoskrnl_15063-1631.exe,385450,385250,385050,6ca,344f68,20,50
ntoskrnl_15063-1689.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50
ntoskrnl_15063-1746.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50
ntoskrnl_15063-1805.exe,3853d0,3851d0,384fd0,6ca,344e78,20,50
ntoskrnl_15063-1928.exe,385450,385250,385050,6ca,344e48,20,50
ntoskrnl_15063-1987.exe,385450,385250,385050,6ca,344e48,20,50
ntoskrnl_15063-2017.exe,385450,385250,385050,6ca,344e48,20,50
ntoskrnl_15063-2045.exe,385350,385150,384f50,6ca,344e48,20,50
ntoskrnl_15063-2076.exe,385350,385150,384f50,6ca,344e48,20,50
ntoskrnl_15063-2106.exe,385350,385150,384f50,6ca,344e48,20,50
ntoskrnl_15063-2283.exe,385410,385210,385010,6ca,344e68,20,50
ntoskrnl_15063-296.exe,382290,382090,381e90,6ca,341ea8,20,50
ntoskrnl_15063-674.exe,3822d0,3820d0,381ed0,6ca,341e88,20,50
ntoskrnl_15063-675.exe,3822d0,3820d0,381ed0,6ca,341e88,20,50
ntoskrnl_15063-786.exe,382310,382110,381f10,6ca,341ec8,20,50
ntoskrnl_15063-850.exe,389450,389250,389050,6ca,348fb8,20,50
ntoskrnl_15063-909.exe,389510,389310,389110,6ca,348fa8,20,50
ntoskrnl_15063-966.exe,389550,389350,389150,6ca,348fa8,20,50
ntoskrnl_16299-1004.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50
ntoskrnl_16299-1029.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50
ntoskrnl_16299-1087.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50
ntoskrnl_16299-1120.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50
ntoskrnl_16299-1146.exe,3a0d00,3a0f00,3a0b00,6ca,35e8a0,20,50
ntoskrnl_16299-1182.exe,3a0d00,3a0f00,3a0b00,6ca,35e8a0,20,50
ntoskrnl_16299-1217.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50
ntoskrnl_16299-125.exe,398a80,398c80,398e80,6ca,356980,20,50
ntoskrnl_16299-1331.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50
ntoskrnl_16299-1364.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50
ntoskrnl_16299-1419.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50
ntoskrnl_16299-1448.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50
ntoskrnl_16299-15.exe,398c80,398e80,398a80,6ca,356908,20,50
ntoskrnl_16299-1622.exe,3a0fc0,3a0bc0,3a0dc0,6ca,35e988,20,50
ntoskrnl_16299-1747.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50
ntoskrnl_16299-1775.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50
ntoskrnl_16299-19.exe,398c80,398e80,398a80,6ca,3568e8,20,50
ntoskrnl_16299-192.exe,39dd40,39df40,39db40,6ca,35b980,20,50
ntoskrnl_16299-1992.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50
ntoskrnl_16299-2045.exe,3a1100,3a0d00,3a0f00,6ca,35e988,20,50
ntoskrnl_16299-214.exe,39ddc0,39dfc0,39dbc0,6ca,35b980,20,50
ntoskrnl_16299-2166.exe,3a1100,3a0d00,3a0f00,6ca,35e988,20,50
ntoskrnl_16299-248.exe,39e100,39dd00,39df00,6ca,35bac8,20,50
ntoskrnl_16299-251.exe,39e100,39dd00,39df00,6ca,35bac8,20,50
ntoskrnl_16299-309.exe,39e0c0,39dcc0,39dec0,6ca,35bae8,20,50
ntoskrnl_16299-334.exe,39e0c0,39dcc0,39dec0,6ca,35bac8,20,50
ntoskrnl_16299-371.exe,39ce40,39d040,39cc40,6ca,35aa00,20,50
ntoskrnl_16299-402.exe,39d0c0,39ccc0,39cec0,6ca,35aaa8,20,50
ntoskrnl_16299-431.exe,39ce00,39d000,39cc00,6ca,35aa00,20,50
ntoskrnl_16299-461.exe,39d080,39cc80,39ce80,6ca,35aa88,20,50
ntoskrnl_16299-492.exe,39b080,39ac80,39ae80,6ca,358aa8,20,50
ntoskrnl_16299-522.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50
ntoskrnl_16299-547.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50
ntoskrnl_16299-551.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50
ntoskrnl_16299-579.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50
ntoskrnl_16299-611.exe,39fe00,3a0000,39fc00,6ca,35d9e0,20,50
ntoskrnl_16299-637.exe,39fe00,3a0000,39fc00,6ca,35d9e0,20,50
ntoskrnl_16299-64.exe,398c40,398e40,398a40,6ca,3568e8,20,50
ntoskrnl_16299-665.exe,39fe80,3a0080,39fc80,6ca,35dac0,20,50
ntoskrnl_16299-666.exe,39fe80,3a0080,39fc80,6ca,35dac0,20,50
ntoskrnl_16299-699.exe,39fdc0,39ffc0,39fbc0,6ca,35da00,20,50
ntoskrnl_16299-726.exe,39fdc0,39ffc0,39fbc0,6ca,35da00,20,50
ntoskrnl_16299-755.exe,3a0080,39fc80,39fe80,6ca,35da88,20,50
ntoskrnl_16299-785.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50
ntoskrnl_16299-820.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50
ntoskrnl_16299-846.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50
ntoskrnl_16299-904.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50
ntoskrnl_16299-967.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50
ntoskrnl_16299-98.exe,398ec0,398ac0,398cc0,6ca,356980,20,50
ntoskrnl_17134-1.exe,3f4ef0,3f50f0,3f4cf0,6ca,3b2120,20,50
ntoskrnl_17134-1006.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1fc8,20,50
ntoskrnl_17134-1038.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50
ntoskrnl_17134-1067.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fb0,20,50
ntoskrnl_17134-1098.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fb0,20,50
ntoskrnl_17134-112.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50
ntoskrnl_17134-1130.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50
ntoskrnl_17134-1184.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50
ntoskrnl_17134-1246.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50
ntoskrnl_17134-1304.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1fe8,20,50
ntoskrnl_17134-1345.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50
ntoskrnl_17134-1365.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50
ntoskrnl_17134-137.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50
ntoskrnl_17134-1425.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50
ntoskrnl_17134-1488.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50
ntoskrnl_17134-1550.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50
ntoskrnl_17134-1610.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50
ntoskrnl_17134-165.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50
ntoskrnl_17134-167.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50
ntoskrnl_17134-1726.exe,3e4ff0,3e4bf0,3e4df0,6ca,3a1f88,20,50
ntoskrnl_17134-1792.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50
ntoskrnl_17134-1845.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50
ntoskrnl_17134-1902.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50
ntoskrnl_17134-191.exe,3f2e30,3f3030,3f2c30,6ca,3b0088,20,50
ntoskrnl_17134-1967.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50
ntoskrnl_17134-2026.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50
ntoskrnl_17134-2087.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50
ntoskrnl_17134-2145.exe,3e4f70,3e4b70,3e4d70,6ca,3a1f88,20,50
ntoskrnl_17134-2208.exe,3e4f70,3e4b70,3e4d70,6ca,3a1f88,20,50
ntoskrnl_17134-228.exe,3e5ff0,3e5bf0,3e5df0,6ca,3a3108,20,50
ntoskrnl_17134-254.exe,3e5ff0,3e5bf0,3e5df0,6ca,3a3108,20,50
ntoskrnl_17134-285.exe,3e6030,3e5c30,3e5e30,6ca,3a3100,20,50
ntoskrnl_17134-286.exe,3e6030,3e5c30,3e5e30,6ca,3a3100,20,50
ntoskrnl_17134-320.exe,3e5eb0,3e60b0,3e5cb0,6ca,3a3120,20,50
ntoskrnl_17134-345.exe,3e5eb0,3e60b0,3e5cb0,6ca,3a3160,20,50
ntoskrnl_17134-376.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-407.exe,3e5f30,3e5b30,3e5d30,6ca,3a3108,20,50
ntoskrnl_17134-471.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-472.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-48.exe,3f5030,3f4c30,3f4e30,6ca,3b20e8,20,50
ntoskrnl_17134-523.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-556.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-590.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-619.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-648.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50
ntoskrnl_17134-677.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50
ntoskrnl_17134-706.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50
ntoskrnl_17134-753.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50
ntoskrnl_17134-765.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1f48,20,50
ntoskrnl_17134-766.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1f48,20,50
ntoskrnl_17134-799.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50
ntoskrnl_17134-81.exe,3f4f30,3f5130,3f4d30,6ca,3b2120,20,50
ntoskrnl_17134-829.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50
ntoskrnl_17134-83.exe,3f4f30,3f5130,3f4d30,6ca,3b2120,20,50
ntoskrnl_17134-858.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50
ntoskrnl_17134-885.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50
ntoskrnl_17134-915.exe,3e4d70,3e4f70,3e4b70,6ca,3a1fa8,20,50
ntoskrnl_17134-950.exe,3e4d70,3e4f70,3e4b70,6ca,3a1fa8,20,50
ntoskrnl_17134-982.exe,3e4f30,3e4b30,3e4d30,6ca,3a1fd0,20,50
ntoskrnl_17763-1.exe,45c4b0,45c0b0,45c2b0,6ca,40f038,20,50
ntoskrnl_17763-1007.exe,4d8c30,4d8830,4d8a30,6ca,4096a0,20,50
ntoskrnl_17763-1039.exe,4d8b30,4d8d30,4d8930,6ca,409698,20,50
ntoskrnl_17763-107.exe,45c430,45c030,45c230,6ca,40f018,20,50
ntoskrnl_17763-1098.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60
ntoskrnl_17763-1131.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60
ntoskrnl_17763-1158.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60
ntoskrnl_17763-1192.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60
ntoskrnl_17763-1217.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60
ntoskrnl_17763-1282.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60
ntoskrnl_17763-1294.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60
ntoskrnl_17763-1339.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60
ntoskrnl_17763-134.exe,45c430,45c030,45c230,6ca,40efd8,20,50
ntoskrnl_17763-1369.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60
ntoskrnl_17763-1397.exe,4d9bf0,4d97f0,4d99f0,6ca,40a6c0,20,60
ntoskrnl_17763-1432.exe,4d7b30,4d7d30,4d7930,6ca,408698,20,60
ntoskrnl_17763-1457.exe,4d7b30,4d7d30,4d7930,6ca,408698,20,60
ntoskrnl_17763-1490.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60
ntoskrnl_17763-1518.exe,4d5b30,4d5d30,4d5930,6ca,406698,20,60
ntoskrnl_17763-1554.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60
ntoskrnl_17763-1577.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60
ntoskrnl_17763-1613.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60
ntoskrnl_17763-1637.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60
ntoskrnl_17763-168.exe,4dad70,4da970,4dab70,6ca,40b078,20,50
ntoskrnl_17763-1697.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60
ntoskrnl_17763-1728.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60
ntoskrnl_17763-1757.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60
ntoskrnl_17763-1790.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60
ntoskrnl_17763-1817.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60
ntoskrnl_17763-1821.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60
ntoskrnl_17763-1823.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60
ntoskrnl_17763-1852.exe,4d5bf0,4d57f0,4d59f0,6ca,4066c0,20,60
ntoskrnl_17763-1879.exe,4d5bf0,4d57f0,4d59f0,6ca,4066c0,20,60
ntoskrnl_17763-1911.exe,4d6870,4d6a70,4d6670,6ca,407498,20,60
ntoskrnl_17763-1935.exe,4d6870,4d6a70,4d6670,6ca,407498,20,60
ntoskrnl_17763-194.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50
ntoskrnl_17763-195.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50
ntoskrnl_17763-1971.exe,4d6bb0,4d67b0,4d69b0,6ca,407498,20,60
ntoskrnl_17763-1999.exe,4d6bb0,4d67b0,4d69b0,6ca,407498,20,60
ntoskrnl_17763-2028.exe,4d67b0,4d69b0,4d65b0,6ca,407418,20,60
ntoskrnl_17763-2029.exe,4d67b0,4d69b0,4d65b0,6ca,407418,20,60
ntoskrnl_17763-2061.exe,4d58f0,4d5af0,4d56f0,6ca,406430,20,60
ntoskrnl_17763-2090.exe,4d5930,4d5b30,4d5730,6ca,406470,20,60
ntoskrnl_17763-2114.exe,4d5930,4d5b30,4d5730,6ca,406470,20,60
ntoskrnl_17763-2145.exe,4d68b0,4d6ab0,4d66b0,6ca,407480,20,60
ntoskrnl_17763-2183.exe,4d68b0,4d6ab0,4d66b0,6ca,407480,20,60
ntoskrnl_17763-253.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50
ntoskrnl_17763-292.exe,4daaf0,4dacf0,4da8f0,6ca,40b078,20,50
ntoskrnl_17763-316.exe,4daaf0,4dacf0,4da8f0,6ca,40b078,20,50
ntoskrnl_17763-348.exe,4dabb0,4da7b0,4da9b0,6ca,40afb8,20,50
ntoskrnl_17763-379.exe,4dabf0,4da7f0,4da9f0,6ca,40aff8,20,50
ntoskrnl_17763-404.exe,4dad70,4da970,4dab70,6ca,40b718,20,50
ntoskrnl_17763-437.exe,4dad70,4da970,4dab70,6ca,40b718,20,50
ntoskrnl_17763-439.exe,4dad70,4da970,4dab70,6ca,40b718,20,50
ntoskrnl_17763-475.exe,4daaf0,4dacf0,4da8f0,6ca,40b730,20,50
ntoskrnl_17763-503.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50
ntoskrnl_17763-504.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50
ntoskrnl_17763-529.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50
ntoskrnl_17763-55.exe,45c4f0,45c0f0,45c2f0,6ca,40f098,20,50
ntoskrnl_17763-557.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50
ntoskrnl_17763-593.exe,4dac70,4da870,4daa70,6ca,40b610,20,50
ntoskrnl_17763-615.exe,4dac70,4da870,4daa70,6ca,40b610,20,50
ntoskrnl_17763-652.exe,4dabf0,4da7f0,4da9f0,6ca,40b5f0,20,50
ntoskrnl_17763-678.exe,4dac30,4da830,4daa30,6ca,40b610,20,50
ntoskrnl_17763-719.exe,4daa30,4dac30,4da830,6ca,40b658,20,50
ntoskrnl_17763-737.exe,4da9f0,4dabf0,4da7f0,6ca,40b5d8,20,50
ntoskrnl_17763-771.exe,4dac70,4da870,4daa70,6ca,40b630,20,50
ntoskrnl_17763-802.exe,4dacb0,4da8b0,4daab0,6ca,40b6c0,20,50
ntoskrnl_17763-831.exe,4d8c70,4d8870,4d8a70,6ca,409610,20,50
ntoskrnl_17763-864.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50
ntoskrnl_17763-914.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50
ntoskrnl_17763-973.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50
ntoskrnl_18362-1016.exe,505fa0,505ba0,505da0,6fa,434bf8,20,60
ntoskrnl_18362-1049.exe,503fe0,503be0,503de0,6fa,432c38,20,60
ntoskrnl_18362-1082.exe,503fa0,503ba0,503da0,6fa,432bf8,20,60
ntoskrnl_18362-1110.exe,503fa0,503ba0,503da0,6fa,432c18,20,60
ntoskrnl_18362-1139.exe,5040a0,503ca0,503ea0,6fa,432c98,20,60
ntoskrnl_18362-116.exe,500de0,5009e0,500be0,6fa,42fa48,20,50
ntoskrnl_18362-1171.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60
ntoskrnl_18362-1198.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60
ntoskrnl_18362-1237.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60
ntoskrnl_18362-1256.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60
ntoskrnl_18362-1316.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60
ntoskrnl_18362-1350.exe,503b60,503d60,503960,6fa,432bf8,20,60
ntoskrnl_18362-1377.exe,503da0,5039a0,503ba0,6fa,432c38,20,60
ntoskrnl_18362-1379.exe,503da0,5039a0,503ba0,6fa,432c38,20,60
ntoskrnl_18362-1411.exe,503de0,5039e0,503be0,6fa,432c38,20,60
ntoskrnl_18362-1440.exe,503da0,5039a0,503ba0,6fa,432c38,20,60
ntoskrnl_18362-1441.exe,503da0,5039a0,503ba0,6fa,432c38,20,60
ntoskrnl_18362-145.exe,500de0,5009e0,500be0,6fa,42f9e8,20,50
ntoskrnl_18362-1474.exe,503ba0,503da0,5039a0,6fa,432c38,20,60
ntoskrnl_18362-1500.exe,503b60,503d60,503960,6fa,432c18,20,60
ntoskrnl_18362-1533.exe,503e20,503a20,503c20,6fa,432c78,20,60
ntoskrnl_18362-1556.exe,503e20,503a20,503c20,6fa,432c78,20,60
ntoskrnl_18362-1621.exe,503e20,503a20,503c20,6fa,432c78,20,60
ntoskrnl_18362-1679.exe,502da0,5029a0,502ba0,6fa,431bf8,20,60
ntoskrnl_18362-1734.exe,503de0,5039e0,503be0,6fa,432c38,20,60
ntoskrnl_18362-1801.exe,503ce0,503ee0,503ae0,6fa,432c38,20,60
ntoskrnl_18362-207.exe,500de0,5009e0,500be0,6fa,42fa48,20,50
ntoskrnl_18362-239.exe,500de0,5009e0,500be0,6fa,42fa48,20,50
ntoskrnl_18362-267.exe,503f60,503b60,503d60,6fa,432c60,20,50
ntoskrnl_18362-295.exe,503fa0,503ba0,503da0,6fa,432c48,20,50
ntoskrnl_18362-30.exe,500d60,500960,500b60,6fa,42fa40,20,50
ntoskrnl_18362-329.exe,504ee0,5050e0,504ce0,6fa,433c28,20,50
ntoskrnl_18362-356.exe,505060,504c60,504e60,6fa,433c90,20,50
ntoskrnl_18362-357.exe,505060,504c60,504e60,6fa,433c90,20,50
ntoskrnl_18362-387.exe,505fe0,505be0,505de0,6fa,434c38,20,50
ntoskrnl_18362-388.exe,505fe0,505be0,505de0,6fa,434c38,20,50
ntoskrnl_18362-418.exe,505ee0,5060e0,505ce0,6fa,434c58,20,50
ntoskrnl_18362-449.exe,505da0,505fa0,505ba0,6fa,434c58,20,50
ntoskrnl_18362-476.exe,506060,505c60,505e60,6fa,434c78,20,50
ntoskrnl_18362-535.exe,506020,505c20,505e20,6fa,434c78,20,50
ntoskrnl_18362-592.exe,506060,505c60,505e60,6fa,434c80,20,50
ntoskrnl_18362-628.exe,506060,505c60,505e60,6fa,434c78,20,50
ntoskrnl_18362-657.exe,505e60,506060,505c60,6fa,434c78,20,50
ntoskrnl_18362-693.exe,505de0,505fe0,505be0,6fa,434c38,20,60
ntoskrnl_18362-719.exe,505e20,506020,505c20,6fa,434c78,20,60
ntoskrnl_18362-720.exe,505e20,506020,505c20,6fa,434c78,20,60
ntoskrnl_18362-752.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60
ntoskrnl_18362-753.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60
ntoskrnl_18362-778.exe,505e60,506060,505c60,6fa,434c70,20,60
ntoskrnl_18362-815.exe,505e60,506060,505c60,6fa,434c70,20,60
ntoskrnl_18362-836.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60
ntoskrnl_18362-900.exe,505ea0,5060a0,505ca0,6fa,434c78,20,60
ntoskrnl_18362-904.exe,505ea0,5060a0,505ca0,6fa,434c78,20,60
ntoskrnl_18362-959.exe,505ea0,5060a0,505ca0,6fa,434cb8,20,60
ntoskrnl_18362-997.exe,505e60,506060,505c60,6fa,434c78,20,60
ntoskrnl_19041-1023.exe,cec460,cec260,cec060,87a,c19db8,20,60
ntoskrnl_19041-1052.exe,cebfe0,cec3e0,cec1e0,87a,c19790,20,60
ntoskrnl_19041-1055.exe,cec020,cec420,cec220,87a,c19790,20,60
ntoskrnl_19041-1081.exe,cec1e0,cebfe0,cec3e0,87a,c19758,20,60
ntoskrnl_19041-1082.exe,cec420,cec220,cec020,87a,c19758,20,60
ntoskrnl_19041-1083.exe,cec420,cec220,cec020,87a,c19758,20,60
ntoskrnl_19041-1110.exe,cec120,cebf20,cec320,87a,c197f8,20,60
ntoskrnl_19041-1151.exe,cec320,cec120,cebf20,87a,c197c0,20,60
ntoskrnl_19041-1165.exe,cec2e0,cec0e0,cebee0,87a,c197a0,20,60
ntoskrnl_19041-1202.exe,cec320,cec120,cebf20,87a,c197d0,20,60
ntoskrnl_19041-1237.exe,cec320,cec120,cebf20,87a,c197d0,20,60
ntoskrnl_19041-1266.exe,cec3a0,cec1a0,cebfa0,87a,c19770,20,60
ntoskrnl_19041-1288.exe,cec1a0,cebfa0,cec3a0,87a,c19790,20,60
ntoskrnl_19041-264.exe,cec060,cec260,cebe60,87a,c19858,20,60
ntoskrnl_19041-329.exe,cec320,cebf20,cec120,87a,c19898,20,60
ntoskrnl_19041-331.exe,cec320,cebf20,cec120,87a,c19898,20,60
ntoskrnl_19041-388.exe,cec3a0,cebfa0,cec1a0,87a,c19898,20,60
ntoskrnl_19041-423.exe,cec160,cec360,cebf60,87a,c198b8,20,60
ntoskrnl_19041-450.exe,cec320,cebf20,cec120,87a,c198b8,20,60
ntoskrnl_19041-488.exe,cec220,cec420,cec020,87a,c19918,20,60
ntoskrnl_19041-508.exe,cec3a0,cebfa0,cec1a0,87a,c19898,20,60
ntoskrnl_19041-546.exe,cec420,cec020,cec220,87a,c19938,20,60
ntoskrnl_19041-572.exe,cec420,cec020,cec220,87a,c19938,20,60
ntoskrnl_19041-610.exe,cec220,cec420,cec020,87a,c19978,20,60
ntoskrnl_19041-630.exe,cec220,cec420,cec020,87a,c19978,20,60
ntoskrnl_19041-631.exe,cec220,cec420,cec020,87a,c19978,20,60
ntoskrnl_19041-662.exe,cec3a0,cec1a0,cebfa0,87a,c198f8,20,60
ntoskrnl_19041-685.exe,cec3a0,cec1a0,cebfa0,87a,c198f8,20,60
ntoskrnl_19041-746.exe,cebfe0,cec3e0,cec1e0,87a,c198f8,20,60
ntoskrnl_19041-789.exe,cec220,cec620,cec420,87a,c19998,20,60
ntoskrnl_19041-804.exe,cec420,cec220,cec020,87a,c19918,20,60
ntoskrnl_19041-844.exe,cec660,cec460,cec260,87a,c19fa8,20,60
ntoskrnl_19041-867.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60
ntoskrnl_19041-868.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60
ntoskrnl_19041-870.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60
ntoskrnl_19041-906.exe,cec5e0,cec3e0,cec1e0,87a,c199d0,20,60
ntoskrnl_19041-928.exe,cec520,cec320,cec120,87a,c19950,20,60
ntoskrnl_19041-964.exe,cec0e0,cebee0,cec2e0,87a,c19d38,20,60
ntoskrnl_19041-985.exe,cec360,cec160,cebf60,87a,c19d78,20,60
ntoskrnl_22000-194.exe,cf5f40,cf5d40,cf6140,87a,c15d20,20,60
ntoskrnl_22000-258.exe,cf5f40,cf5d40,cf6140,87a,c15d20,20,60
ntoskrnl_22000-282.exe,cf5f00,cf5d00,cf6100,87a,c163d0,20,60
1 ntoskrnlVersion PspCreateProcessNotifyRoutineOffset PspCreateThreadNotifyRoutineOffset PspLoadImageNotifyRoutineOffset _PS_PROTECTIONOffset EtwThreatIntProvRegHandleOffset EtwRegEntry_GuidEntryOffset EtwGuidEntry_ProviderEnableInfoOffset
2 ntoskrnl_9600-20111.exe 2dac50 2daa50 2da850 67a 0 20 50
3 ntoskrnl_10240-16384.exe 35d2e0 35d0e0 35cee0 6aa 0 20 50
4 ntoskrnl_10240-17394.exe 35d420 35d220 35d020 6aa 0 20 50
5 ntoskrnl_10240-17443.exe 35c420 35c220 35c020 6aa 0 20 50
6 ntoskrnl_10240-17446.exe 35c420 35c220 35c020 6aa 0 20 50
7 ntoskrnl_10240-17488.exe 35c3e0 35c1e0 35bfe0 6aa 0 20 50
8 ntoskrnl_10240-17533.exe 35c3e0 35c1e0 35bfe0 6aa 0 20 50
9 ntoskrnl_10240-17609.exe 35c3e0 35c1e0 35bfe0 6aa 0 20 50
10 ntoskrnl_10240-17643.exe 35c3e0 35c1e0 35bfe0 6aa 0 20 50
11 ntoskrnl_10240-17709.exe 35c3e0 35c1e0 35bfe0 6aa 0 20 50
12 ntoskrnl_10240-17738.exe 366520 366320 366120 6b2 0 20 50
13 ntoskrnl_10240-17770.exe 366520 366320 366120 6b2 0 20 50
14 ntoskrnl_10240-17797.exe 366520 366320 366120 6b2 0 20 50
15 ntoskrnl_10240-17831.exe 366520 366320 366120 6b2 0 20 50
16 ntoskrnl_10240-17861.exe 3664e0 3662e0 3660e0 6b2 0 20 50
17 ntoskrnl_10240-17889.exe 3644e0 3642e0 3640e0 6b2 0 20 50
18 ntoskrnl_10240-17914.exe 3644e0 3642e0 3640e0 6b2 0 20 50
19 ntoskrnl_10240-17976.exe 3694e0 3692e0 3690e0 6b2 0 20 50
20 ntoskrnl_10240-18005.exe 3694e0 3692e0 3690e0 6b2 0 20 50
21 ntoskrnl_10240-18036.exe 369520 369320 369120 6b2 0 20 50
22 ntoskrnl_10240-18063.exe 369520 369320 369120 6b2 0 20 50
23 ntoskrnl_10240-18094.exe 369520 369320 369120 6b2 0 20 50
24 ntoskrnl_10240-18132.exe 369520 369320 369120 6b2 0 20 50
25 ntoskrnl_10240-18158.exe 369520 369320 369120 6b2 0 20 50
26 ntoskrnl_10240-18275.exe 369520 369320 369120 6b2 0 20 50
27 ntoskrnl_10240-18303.exe 369520 369320 369120 6b2 0 20 50
28 ntoskrnl_10240-18427.exe 367520 367320 367120 6b2 0 20 50
29 ntoskrnl_10240-18452.exe 367520 367320 367120 6b2 0 20 50
30 ntoskrnl_10240-18485.exe 3684e0 3682e0 3680e0 6b2 0 20 50
31 ntoskrnl_10240-18545.exe 3684e0 3682e0 3680e0 6b2 0 20 50
32 ntoskrnl_10240-18575.exe 3684e0 3682e0 3680e0 6b2 0 20 50
33 ntoskrnl_10240-18608.exe 3684e0 3682e0 3680e0 6b2 0 20 50
34 ntoskrnl_10240-18638.exe 3684e0 3682e0 3680e0 6b2 0 20 50
35 ntoskrnl_10240-18666.exe 367560 367360 367160 6b2 0 20 50
36 ntoskrnl_10240-18725.exe 367560 367360 367160 6b2 0 20 50
37 ntoskrnl_10240-18756.exe 367560 367360 367160 6b2 0 20 50
38 ntoskrnl_10240-18841.exe 367560 367360 367160 6b2 0 20 50
39 ntoskrnl_10240-18906.exe 367560 367360 367160 6b2 0 20 50
40 ntoskrnl_10586-0.exe 317180 316f80 316d80 6b2 0 20 50
41 ntoskrnl_10586-1176.exe 3161c0 315fc0 315dc0 6b2 0 20 50
42 ntoskrnl_10586-1177.exe 3161c0 315fc0 315dc0 6b2 0 20 50
43 ntoskrnl_10586-1295.exe 3161c0 315fc0 315dc0 6b2 0 20 50
44 ntoskrnl_10586-1356.exe 31a2c0 31a0c0 319ec0 6ba 0 20 50
45 ntoskrnl_10586-1417.exe 31a2c0 31a0c0 319ec0 6ba 0 20 50
46 ntoskrnl_10586-1478.exe 31a2c0 31a0c0 319ec0 6ba 0 20 50
47 ntoskrnl_10586-1540.exe 31a300 31a100 319f00 6ba 0 20 50
48 ntoskrnl_14393-0.exe 33bba0 33b9a0 33b7a0 6c2 0 20 50
49 ntoskrnl_14393-1198.exe 335860 335660 335460 6c2 0 20 50
50 ntoskrnl_14393-1532.exe 3348a0 3346a0 3344a0 6c2 0 20 50
51 ntoskrnl_14393-1670.exe 3348a0 3346a0 3344a0 6c2 0 20 50
52 ntoskrnl_14393-1737.exe 3348a0 3346a0 3344a0 6c2 0 20 50
53 ntoskrnl_14393-1770.exe 3348a0 3346a0 3344a0 6c2 0 20 50
54 ntoskrnl_14393-2189.exe 33ea20 33e820 33e620 6ca 0 20 50
55 ntoskrnl_14393-2214.exe 33ea20 33e820 33e620 6ca 0 20 50
56 ntoskrnl_14393-2248.exe 33da60 33d860 33d660 6ca 0 20 50
57 ntoskrnl_14393-2273.exe 33da60 33d860 33d660 6ca 0 20 50
58 ntoskrnl_14393-2312.exe 33ca20 33c820 33c620 6ca 0 20 50
59 ntoskrnl_14393-2363.exe 33ca20 33c820 33c620 6ca 0 20 50
60 ntoskrnl_14393-2395.exe 33bb60 33b960 33b760 6ca 0 20 50
61 ntoskrnl_14393-2430.exe 338b60 338960 338760 6ca 0 20 50
62 ntoskrnl_14393-2485.exe 338b20 338920 338720 6ca 0 20 50
63 ntoskrnl_14393-2551.exe 338b20 338920 338720 6ca 0 20 50
64 ntoskrnl_14393-2580.exe 338b20 338920 338720 6ca 0 20 50
65 ntoskrnl_14393-2608.exe 338b20 338920 338720 6ca 0 20 50
66 ntoskrnl_14393-2636.exe 338be0 3389e0 3387e0 6ca 0 20 50
67 ntoskrnl_14393-2665.exe 338be0 3389e0 3387e0 6ca 0 20 50
68 ntoskrnl_14393-2724.exe 338be0 3389e0 3387e0 6ca 0 20 50
69 ntoskrnl_14393-2791.exe 338b20 338920 338720 6ca 0 20 50
70 ntoskrnl_14393-2848.exe 338b20 338920 338720 6ca 0 20 50
71 ntoskrnl_14393-2906.exe 338b20 338920 338720 6ca 0 20 50
72 ntoskrnl_14393-2969.exe 339a20 339820 339620 6ca 0 20 50
73 ntoskrnl_14393-3085.exe 339a20 339820 339620 6ca 0 20 50
74 ntoskrnl_14393-3115.exe 339a20 339820 339620 6ca 0 20 50
75 ntoskrnl_14393-3143.exe 339a20 339820 339620 6ca 0 20 50
76 ntoskrnl_14393-3204.exe 339a20 339820 339620 6ca 0 20 50
77 ntoskrnl_14393-3241.exe 339a60 339860 339660 6ca 0 20 50
78 ntoskrnl_14393-3269.exe 339a60 339860 339660 6ca 0 20 50
79 ntoskrnl_14393-3297.exe 339a60 339860 339660 6ca 0 20 50
80 ntoskrnl_14393-3321.exe 339a60 339860 339660 6ca 0 20 50
81 ntoskrnl_14393-3383.exe 339a60 339860 339660 6ca 0 20 50
82 ntoskrnl_14393-3442.exe 339a60 339860 339660 6ca 0 20 50
83 ntoskrnl_14393-3471.exe 33ae60 33ac60 33aa60 6ca 0 20 50
84 ntoskrnl_14393-3503.exe 33aee0 33ace0 33aae0 6ca 0 20 50
85 ntoskrnl_14393-3541.exe 33aee0 33ace0 33aae0 6ca 0 20 50
86 ntoskrnl_14393-3564.exe 33aee0 33ace0 33aae0 6ca 0 20 50
87 ntoskrnl_14393-3595.exe 33aee0 33ace0 33aae0 6ca 0 20 50
88 ntoskrnl_14393-3630.exe 33aee0 33ace0 33aae0 6ca 0 20 50
89 ntoskrnl_14393-3659.exe 33aee0 33ace0 33aae0 6ca 0 20 50
90 ntoskrnl_14393-3686.exe 33aee0 33ace0 33aae0 6ca 0 20 50
91 ntoskrnl_14393-3750.exe 33aee0 33ace0 33aae0 6ca 0 20 50
92 ntoskrnl_14393-3755.exe 33aee0 33ace0 33aae0 6ca 0 20 50
93 ntoskrnl_14393-3808.exe 33aee0 33ace0 33aae0 6ca 0 20 50
94 ntoskrnl_14393-3866.exe 33ae60 33ac60 33aa60 6ca 0 20 50
95 ntoskrnl_14393-3930.exe 33aee0 33ace0 33aae0 6ca 0 20 50
96 ntoskrnl_14393-3986.exe 33aee0 33ace0 33aae0 6ca 0 20 50
97 ntoskrnl_14393-4046.exe 33aee0 33ace0 33aae0 6ca 0 20 50
98 ntoskrnl_14393-4104.exe 33aee0 33ace0 33aae0 6ca 0 20 50
99 ntoskrnl_14393-4169.exe 33aee0 33ace0 33aae0 6ca 0 20 50
100 ntoskrnl_14393-4225.exe 33aee0 33ace0 33aae0 6ca 0 20 50
101 ntoskrnl_14393-4283.exe 33aee0 33ace0 33aae0 6ca 0 20 50
102 ntoskrnl_14393-4350.exe 33aee0 33ace0 33aae0 6ca 0 20 50
103 ntoskrnl_14393-4402.exe 33aee0 33ace0 33aae0 6ca 0 20 50
104 ntoskrnl_14393-4467.exe 33aee0 33ace0 33aae0 6ca 0 20 50
105 ntoskrnl_14393-4470.exe 33aee0 33ace0 33aae0 6ca 0 20 50
106 ntoskrnl_14393-4530.exe 33ae60 33ac60 33aa60 6ca 0 20 50
107 ntoskrnl_14393-4583.exe 33ae60 33ac60 33aa60 6ca 0 20 50
108 ntoskrnl_14393-4651.exe 33ae60 33ac60 33aa60 6ca 0 20 50
109 ntoskrnl_14393-576.exe 33bca0 33baa0 33b8a0 6c2 0 20 50
110 ntoskrnl_14393-726.exe 335860 335660 335460 6c2 0 20 50
111 ntoskrnl_14393-953.exe 335860 335660 335460 6c2 0 20 50
112 ntoskrnl_15063-0.exe 382290 382090 381e90 6ca 341ea8 20 50
113 ntoskrnl_15063-1029.exe 389550 389350 389150 6ca 348fa8 20 50
114 ntoskrnl_15063-1088.exe 3894d0 3892d0 3890d0 6ca 348fb8 20 50
115 ntoskrnl_15063-1155.exe 387510 387310 387110 6ca 346f68 20 50
116 ntoskrnl_15063-1206.exe 387510 387310 387110 6ca 346f68 20 50
117 ntoskrnl_15063-1266.exe 384410 384210 384010 6ca 343f48 20 50
118 ntoskrnl_15063-13.exe 382290 382090 381e90 6ca 341ea8 20 50
119 ntoskrnl_15063-1324.exe 385490 385290 385090 6ca 344f88 20 50
120 ntoskrnl_15063-1387.exe 385490 385290 385090 6ca 344f98 20 50
121 ntoskrnl_15063-1418.exe 385490 385290 385090 6ca 344f98 20 50
122 ntoskrnl_15063-1446.exe 385490 385290 385090 6ca 344fa8 20 50
123 ntoskrnl_15063-1478.exe 385450 385250 385050 6ca 344f68 20 50
124 ntoskrnl_15063-1563.exe 385450 385250 385050 6ca 344f68 20 50
125 ntoskrnl_15063-1596.exe 385450 385250 385050 6ca 344f68 20 50
126 ntoskrnl_15063-1631.exe 385450 385250 385050 6ca 344f68 20 50
127 ntoskrnl_15063-1689.exe 3854d0 3852d0 3850d0 6ca 344fd8 20 50
128 ntoskrnl_15063-1746.exe 3854d0 3852d0 3850d0 6ca 344fd8 20 50
129 ntoskrnl_15063-1805.exe 3853d0 3851d0 384fd0 6ca 344e78 20 50
130 ntoskrnl_15063-1928.exe 385450 385250 385050 6ca 344e48 20 50
131 ntoskrnl_15063-1987.exe 385450 385250 385050 6ca 344e48 20 50
132 ntoskrnl_15063-2017.exe 385450 385250 385050 6ca 344e48 20 50
133 ntoskrnl_15063-2045.exe 385350 385150 384f50 6ca 344e48 20 50
134 ntoskrnl_15063-2076.exe 385350 385150 384f50 6ca 344e48 20 50
135 ntoskrnl_15063-2106.exe 385350 385150 384f50 6ca 344e48 20 50
136 ntoskrnl_15063-2283.exe 385410 385210 385010 6ca 344e68 20 50
137 ntoskrnl_15063-296.exe 382290 382090 381e90 6ca 341ea8 20 50
138 ntoskrnl_15063-674.exe 3822d0 3820d0 381ed0 6ca 341e88 20 50
139 ntoskrnl_15063-675.exe 3822d0 3820d0 381ed0 6ca 341e88 20 50
140 ntoskrnl_15063-786.exe 382310 382110 381f10 6ca 341ec8 20 50
141 ntoskrnl_15063-850.exe 389450 389250 389050 6ca 348fb8 20 50
142 ntoskrnl_15063-909.exe 389510 389310 389110 6ca 348fa8 20 50
143 ntoskrnl_15063-966.exe 389550 389350 389150 6ca 348fa8 20 50
144 ntoskrnl_16299-1004.exe 39fec0 3a00c0 39fcc0 6ca 35dac0 20 50
145 ntoskrnl_16299-1029.exe 39ff00 3a0100 39fd00 6ca 35dac0 20 50
146 ntoskrnl_16299-1087.exe 39ff00 3a0100 39fd00 6ca 35dac0 20 50
147 ntoskrnl_16299-1120.exe 39ff00 3a0100 39fd00 6ca 35dac0 20 50
148 ntoskrnl_16299-1146.exe 3a0d00 3a0f00 3a0b00 6ca 35e8a0 20 50
149 ntoskrnl_16299-1182.exe 3a0d00 3a0f00 3a0b00 6ca 35e8a0 20 50
150 ntoskrnl_16299-1217.exe 3a1000 3a0c00 3a0e00 6ca 35e968 20 50
151 ntoskrnl_16299-125.exe 398a80 398c80 398e80 6ca 356980 20 50
152 ntoskrnl_16299-1331.exe 3a1000 3a0c00 3a0e00 6ca 35e968 20 50
153 ntoskrnl_16299-1364.exe 3a1000 3a0c00 3a0e00 6ca 35e968 20 50
154 ntoskrnl_16299-1419.exe 3a1040 3a0c40 3a0e40 6ca 35e988 20 50
155 ntoskrnl_16299-1448.exe 3a1040 3a0c40 3a0e40 6ca 35e988 20 50
156 ntoskrnl_16299-15.exe 398c80 398e80 398a80 6ca 356908 20 50
157 ntoskrnl_16299-1622.exe 3a0fc0 3a0bc0 3a0dc0 6ca 35e988 20 50
158 ntoskrnl_16299-1747.exe 3a0cc0 3a0ec0 3a0ac0 6ca 35e8c0 20 50
159 ntoskrnl_16299-1775.exe 3a0cc0 3a0ec0 3a0ac0 6ca 35e8c0 20 50
160 ntoskrnl_16299-19.exe 398c80 398e80 398a80 6ca 3568e8 20 50
161 ntoskrnl_16299-192.exe 39dd40 39df40 39db40 6ca 35b980 20 50
162 ntoskrnl_16299-1992.exe 3a0cc0 3a0ec0 3a0ac0 6ca 35e8c0 20 50
163 ntoskrnl_16299-2045.exe 3a1100 3a0d00 3a0f00 6ca 35e988 20 50
164 ntoskrnl_16299-214.exe 39ddc0 39dfc0 39dbc0 6ca 35b980 20 50
165 ntoskrnl_16299-2166.exe 3a1100 3a0d00 3a0f00 6ca 35e988 20 50
166 ntoskrnl_16299-248.exe 39e100 39dd00 39df00 6ca 35bac8 20 50
167 ntoskrnl_16299-251.exe 39e100 39dd00 39df00 6ca 35bac8 20 50
168 ntoskrnl_16299-309.exe 39e0c0 39dcc0 39dec0 6ca 35bae8 20 50
169 ntoskrnl_16299-334.exe 39e0c0 39dcc0 39dec0 6ca 35bac8 20 50
170 ntoskrnl_16299-371.exe 39ce40 39d040 39cc40 6ca 35aa00 20 50
171 ntoskrnl_16299-402.exe 39d0c0 39ccc0 39cec0 6ca 35aaa8 20 50
172 ntoskrnl_16299-431.exe 39ce00 39d000 39cc00 6ca 35aa00 20 50
173 ntoskrnl_16299-461.exe 39d080 39cc80 39ce80 6ca 35aa88 20 50
174 ntoskrnl_16299-492.exe 39b080 39ac80 39ae80 6ca 358aa8 20 50
175 ntoskrnl_16299-522.exe 3a2f00 3a3100 3a2d00 6ca 360ac0 20 50
176 ntoskrnl_16299-547.exe 3a2f00 3a3100 3a2d00 6ca 360ac0 20 50
177 ntoskrnl_16299-551.exe 3a2f00 3a3100 3a2d00 6ca 360ac0 20 50
178 ntoskrnl_16299-579.exe 3a2f00 3a3100 3a2d00 6ca 360ac0 20 50
179 ntoskrnl_16299-611.exe 39fe00 3a0000 39fc00 6ca 35d9e0 20 50
180 ntoskrnl_16299-637.exe 39fe00 3a0000 39fc00 6ca 35d9e0 20 50
181 ntoskrnl_16299-64.exe 398c40 398e40 398a40 6ca 3568e8 20 50
182 ntoskrnl_16299-665.exe 39fe80 3a0080 39fc80 6ca 35dac0 20 50
183 ntoskrnl_16299-666.exe 39fe80 3a0080 39fc80 6ca 35dac0 20 50
184 ntoskrnl_16299-699.exe 39fdc0 39ffc0 39fbc0 6ca 35da00 20 50
185 ntoskrnl_16299-726.exe 39fdc0 39ffc0 39fbc0 6ca 35da00 20 50
186 ntoskrnl_16299-755.exe 3a0080 39fc80 39fe80 6ca 35da88 20 50
187 ntoskrnl_16299-785.exe 39fec0 3a00c0 39fcc0 6ca 35dac0 20 50
188 ntoskrnl_16299-820.exe 39fec0 3a00c0 39fcc0 6ca 35dac0 20 50
189 ntoskrnl_16299-846.exe 39fec0 3a00c0 39fcc0 6ca 35dac0 20 50
190 ntoskrnl_16299-904.exe 39fec0 3a00c0 39fcc0 6ca 35dac0 20 50
191 ntoskrnl_16299-967.exe 39fec0 3a00c0 39fcc0 6ca 35dac0 20 50
192 ntoskrnl_16299-98.exe 398ec0 398ac0 398cc0 6ca 356980 20 50
193 ntoskrnl_17134-1.exe 3f4ef0 3f50f0 3f4cf0 6ca 3b2120 20 50
194 ntoskrnl_17134-1006.exe 3e4ef0 3e4af0 3e4cf0 6ca 3a1fc8 20 50
195 ntoskrnl_17134-1038.exe 3e4db0 3e4fb0 3e4bb0 6ca 3a1fe0 20 50
196 ntoskrnl_17134-1067.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fb0 20 50
197 ntoskrnl_17134-1098.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fb0 20 50
198 ntoskrnl_17134-112.exe 3f1e30 3f2030 3f1c30 6ca 3af088 20 50
199 ntoskrnl_17134-1130.exe 3e4fb0 3e4bb0 3e4db0 6ca 3a1fb0 20 50
200 ntoskrnl_17134-1184.exe 3e4fb0 3e4bb0 3e4db0 6ca 3a1fb0 20 50
201 ntoskrnl_17134-1246.exe 3e4fb0 3e4bb0 3e4db0 6ca 3a1fb0 20 50
202 ntoskrnl_17134-1304.exe 3e4ef0 3e4af0 3e4cf0 6ca 3a1fe8 20 50
203 ntoskrnl_17134-1345.exe 3e4db0 3e4fb0 3e4bb0 6ca 3a1fe0 20 50
204 ntoskrnl_17134-1365.exe 3e4e30 3e5030 3e4c30 6ca 3a2000 20 50
205 ntoskrnl_17134-137.exe 3f1e30 3f2030 3f1c30 6ca 3af088 20 50
206 ntoskrnl_17134-1425.exe 3e4e30 3e5030 3e4c30 6ca 3a2000 20 50
207 ntoskrnl_17134-1488.exe 3e4db0 3e4fb0 3e4bb0 6ca 3a1fe0 20 50
208 ntoskrnl_17134-1550.exe 3e4db0 3e4fb0 3e4bb0 6ca 3a1fe0 20 50
209 ntoskrnl_17134-1610.exe 3e4db0 3e4fb0 3e4bb0 6ca 3a1fe0 20 50
210 ntoskrnl_17134-165.exe 3f1e30 3f2030 3f1c30 6ca 3af088 20 50
211 ntoskrnl_17134-167.exe 3f1e30 3f2030 3f1c30 6ca 3af088 20 50
212 ntoskrnl_17134-1726.exe 3e4ff0 3e4bf0 3e4df0 6ca 3a1f88 20 50
213 ntoskrnl_17134-1792.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fd0 20 50
214 ntoskrnl_17134-1845.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fd0 20 50
215 ntoskrnl_17134-1902.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fd0 20 50
216 ntoskrnl_17134-191.exe 3f2e30 3f3030 3f2c30 6ca 3b0088 20 50
217 ntoskrnl_17134-1967.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fd0 20 50
218 ntoskrnl_17134-2026.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fd0 20 50
219 ntoskrnl_17134-2087.exe 3e4f70 3e4b70 3e4d70 6ca 3a1fd0 20 50
220 ntoskrnl_17134-2145.exe 3e4f70 3e4b70 3e4d70 6ca 3a1f88 20 50
221 ntoskrnl_17134-2208.exe 3e4f70 3e4b70 3e4d70 6ca 3a1f88 20 50
222 ntoskrnl_17134-228.exe 3e5ff0 3e5bf0 3e5df0 6ca 3a3108 20 50
223 ntoskrnl_17134-254.exe 3e5ff0 3e5bf0 3e5df0 6ca 3a3108 20 50
224 ntoskrnl_17134-285.exe 3e6030 3e5c30 3e5e30 6ca 3a3100 20 50
225 ntoskrnl_17134-286.exe 3e6030 3e5c30 3e5e30 6ca 3a3100 20 50
226 ntoskrnl_17134-320.exe 3e5eb0 3e60b0 3e5cb0 6ca 3a3120 20 50
227 ntoskrnl_17134-345.exe 3e5eb0 3e60b0 3e5cb0 6ca 3a3160 20 50
228 ntoskrnl_17134-376.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
229 ntoskrnl_17134-407.exe 3e5f30 3e5b30 3e5d30 6ca 3a3108 20 50
230 ntoskrnl_17134-471.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
231 ntoskrnl_17134-472.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
232 ntoskrnl_17134-48.exe 3f5030 3f4c30 3f4e30 6ca 3b20e8 20 50
233 ntoskrnl_17134-523.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
234 ntoskrnl_17134-556.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
235 ntoskrnl_17134-590.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
236 ntoskrnl_17134-619.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
237 ntoskrnl_17134-648.exe 3e5fb0 3e5bb0 3e5db0 6ca 3a3108 20 50
238 ntoskrnl_17134-677.exe 3e4eb0 3e50b0 3e4cb0 6ca 3a2160 20 50
239 ntoskrnl_17134-706.exe 3e4eb0 3e50b0 3e4cb0 6ca 3a2160 20 50
240 ntoskrnl_17134-753.exe 3e4eb0 3e50b0 3e4cb0 6ca 3a2160 20 50
241 ntoskrnl_17134-765.exe 3e4ef0 3e4af0 3e4cf0 6ca 3a1f48 20 50
242 ntoskrnl_17134-766.exe 3e4ef0 3e4af0 3e4cf0 6ca 3a1f48 20 50
243 ntoskrnl_17134-799.exe 3e4f30 3e4b30 3e4d30 6ca 3a1f68 20 50
244 ntoskrnl_17134-81.exe 3f4f30 3f5130 3f4d30 6ca 3b2120 20 50
245 ntoskrnl_17134-829.exe 3e4f30 3e4b30 3e4d30 6ca 3a1f68 20 50
246 ntoskrnl_17134-83.exe 3f4f30 3f5130 3f4d30 6ca 3b2120 20 50
247 ntoskrnl_17134-858.exe 3e4f30 3e4b30 3e4d30 6ca 3a1f68 20 50
248 ntoskrnl_17134-885.exe 3e4f30 3e4b30 3e4d30 6ca 3a1f68 20 50
249 ntoskrnl_17134-915.exe 3e4d70 3e4f70 3e4b70 6ca 3a1fa8 20 50
250 ntoskrnl_17134-950.exe 3e4d70 3e4f70 3e4b70 6ca 3a1fa8 20 50
251 ntoskrnl_17134-982.exe 3e4f30 3e4b30 3e4d30 6ca 3a1fd0 20 50
252 ntoskrnl_17763-1.exe 45c4b0 45c0b0 45c2b0 6ca 40f038 20 50
253 ntoskrnl_17763-1007.exe 4d8c30 4d8830 4d8a30 6ca 4096a0 20 50
254 ntoskrnl_17763-1039.exe 4d8b30 4d8d30 4d8930 6ca 409698 20 50
255 ntoskrnl_17763-107.exe 45c430 45c030 45c230 6ca 40f018 20 50
256 ntoskrnl_17763-1098.exe 4d9d30 4d9930 4d9b30 6ca 40a670 20 60
257 ntoskrnl_17763-1131.exe 4d9af0 4d9cf0 4d98f0 6ca 40a678 20 60
258 ntoskrnl_17763-1158.exe 4d9af0 4d9cf0 4d98f0 6ca 40a678 20 60
259 ntoskrnl_17763-1192.exe 4d9d30 4d9930 4d9b30 6ca 40a670 20 60
260 ntoskrnl_17763-1217.exe 4d9d30 4d9930 4d9b30 6ca 40a670 20 60
261 ntoskrnl_17763-1282.exe 4d9d70 4d9970 4d9b70 6ca 40a6b0 20 60
262 ntoskrnl_17763-1294.exe 4d9d70 4d9970 4d9b70 6ca 40a6b0 20 60
263 ntoskrnl_17763-1339.exe 4d9d70 4d9970 4d9b70 6ca 40a6b0 20 60
264 ntoskrnl_17763-134.exe 45c430 45c030 45c230 6ca 40efd8 20 50
265 ntoskrnl_17763-1369.exe 4d9d70 4d9970 4d9b70 6ca 40a6b0 20 60
266 ntoskrnl_17763-1397.exe 4d9bf0 4d97f0 4d99f0 6ca 40a6c0 20 60
267 ntoskrnl_17763-1432.exe 4d7b30 4d7d30 4d7930 6ca 408698 20 60
268 ntoskrnl_17763-1457.exe 4d7b30 4d7d30 4d7930 6ca 408698 20 60
269 ntoskrnl_17763-1490.exe 4d5b70 4d5d70 4d5970 6ca 4066d8 20 60
270 ntoskrnl_17763-1518.exe 4d5b30 4d5d30 4d5930 6ca 406698 20 60
271 ntoskrnl_17763-1554.exe 4d5cf0 4d58f0 4d5af0 6ca 406630 20 60
272 ntoskrnl_17763-1577.exe 4d5cf0 4d58f0 4d5af0 6ca 406630 20 60
273 ntoskrnl_17763-1613.exe 4d5cf0 4d58f0 4d5af0 6ca 406630 20 60
274 ntoskrnl_17763-1637.exe 4d5cf0 4d58f0 4d5af0 6ca 406630 20 60
275 ntoskrnl_17763-168.exe 4dad70 4da970 4dab70 6ca 40b078 20 50
276 ntoskrnl_17763-1697.exe 4d5cf0 4d58f0 4d5af0 6ca 406630 20 60
277 ntoskrnl_17763-1728.exe 4d5cf0 4d58f0 4d5af0 6ca 406630 20 60
278 ntoskrnl_17763-1757.exe 4d5b70 4d5d70 4d5970 6ca 4066d8 20 60
279 ntoskrnl_17763-1790.exe 4d5b70 4d5d70 4d5970 6ca 4066d8 20 60
280 ntoskrnl_17763-1817.exe 4d5b70 4d5d70 4d5970 6ca 4066d8 20 60
281 ntoskrnl_17763-1821.exe 4d5b70 4d5d70 4d5970 6ca 4066d8 20 60
282 ntoskrnl_17763-1823.exe 4d5b70 4d5d70 4d5970 6ca 4066d8 20 60
283 ntoskrnl_17763-1852.exe 4d5bf0 4d57f0 4d59f0 6ca 4066c0 20 60
284 ntoskrnl_17763-1879.exe 4d5bf0 4d57f0 4d59f0 6ca 4066c0 20 60
285 ntoskrnl_17763-1911.exe 4d6870 4d6a70 4d6670 6ca 407498 20 60
286 ntoskrnl_17763-1935.exe 4d6870 4d6a70 4d6670 6ca 407498 20 60
287 ntoskrnl_17763-194.exe 4d9d70 4d9970 4d9b70 6ca 40a038 20 50
288 ntoskrnl_17763-195.exe 4d9d70 4d9970 4d9b70 6ca 40a038 20 50
289 ntoskrnl_17763-1971.exe 4d6bb0 4d67b0 4d69b0 6ca 407498 20 60
290 ntoskrnl_17763-1999.exe 4d6bb0 4d67b0 4d69b0 6ca 407498 20 60
291 ntoskrnl_17763-2028.exe 4d67b0 4d69b0 4d65b0 6ca 407418 20 60
292 ntoskrnl_17763-2029.exe 4d67b0 4d69b0 4d65b0 6ca 407418 20 60
293 ntoskrnl_17763-2061.exe 4d58f0 4d5af0 4d56f0 6ca 406430 20 60
294 ntoskrnl_17763-2090.exe 4d5930 4d5b30 4d5730 6ca 406470 20 60
295 ntoskrnl_17763-2114.exe 4d5930 4d5b30 4d5730 6ca 406470 20 60
296 ntoskrnl_17763-2145.exe 4d68b0 4d6ab0 4d66b0 6ca 407480 20 60
297 ntoskrnl_17763-2183.exe 4d68b0 4d6ab0 4d66b0 6ca 407480 20 60
298 ntoskrnl_17763-253.exe 4d9d70 4d9970 4d9b70 6ca 40a038 20 50
299 ntoskrnl_17763-292.exe 4daaf0 4dacf0 4da8f0 6ca 40b078 20 50
300 ntoskrnl_17763-316.exe 4daaf0 4dacf0 4da8f0 6ca 40b078 20 50
301 ntoskrnl_17763-348.exe 4dabb0 4da7b0 4da9b0 6ca 40afb8 20 50
302 ntoskrnl_17763-379.exe 4dabf0 4da7f0 4da9f0 6ca 40aff8 20 50
303 ntoskrnl_17763-404.exe 4dad70 4da970 4dab70 6ca 40b718 20 50
304 ntoskrnl_17763-437.exe 4dad70 4da970 4dab70 6ca 40b718 20 50
305 ntoskrnl_17763-439.exe 4dad70 4da970 4dab70 6ca 40b718 20 50
306 ntoskrnl_17763-475.exe 4daaf0 4dacf0 4da8f0 6ca 40b730 20 50
307 ntoskrnl_17763-503.exe 4da9b0 4dabb0 4da7b0 6ca 40b598 20 50
308 ntoskrnl_17763-504.exe 4da9b0 4dabb0 4da7b0 6ca 40b598 20 50
309 ntoskrnl_17763-529.exe 4da9b0 4dabb0 4da7b0 6ca 40b598 20 50
310 ntoskrnl_17763-55.exe 45c4f0 45c0f0 45c2f0 6ca 40f098 20 50
311 ntoskrnl_17763-557.exe 4da9b0 4dabb0 4da7b0 6ca 40b598 20 50
312 ntoskrnl_17763-593.exe 4dac70 4da870 4daa70 6ca 40b610 20 50
313 ntoskrnl_17763-615.exe 4dac70 4da870 4daa70 6ca 40b610 20 50
314 ntoskrnl_17763-652.exe 4dabf0 4da7f0 4da9f0 6ca 40b5f0 20 50
315 ntoskrnl_17763-678.exe 4dac30 4da830 4daa30 6ca 40b610 20 50
316 ntoskrnl_17763-719.exe 4daa30 4dac30 4da830 6ca 40b658 20 50
317 ntoskrnl_17763-737.exe 4da9f0 4dabf0 4da7f0 6ca 40b5d8 20 50
318 ntoskrnl_17763-771.exe 4dac70 4da870 4daa70 6ca 40b630 20 50
319 ntoskrnl_17763-802.exe 4dacb0 4da8b0 4daab0 6ca 40b6c0 20 50
320 ntoskrnl_17763-831.exe 4d8c70 4d8870 4d8a70 6ca 409610 20 50
321 ntoskrnl_17763-864.exe 4d8b70 4d8d70 4d8970 6ca 409698 20 50
322 ntoskrnl_17763-914.exe 4d8b70 4d8d70 4d8970 6ca 409698 20 50
323 ntoskrnl_17763-973.exe 4d8b70 4d8d70 4d8970 6ca 409698 20 50
324 ntoskrnl_18362-1016.exe 505fa0 505ba0 505da0 6fa 434bf8 20 60
325 ntoskrnl_18362-1049.exe 503fe0 503be0 503de0 6fa 432c38 20 60
326 ntoskrnl_18362-1082.exe 503fa0 503ba0 503da0 6fa 432bf8 20 60
327 ntoskrnl_18362-1110.exe 503fa0 503ba0 503da0 6fa 432c18 20 60
328 ntoskrnl_18362-1139.exe 5040a0 503ca0 503ea0 6fa 432c98 20 60
329 ntoskrnl_18362-116.exe 500de0 5009e0 500be0 6fa 42fa48 20 50
330 ntoskrnl_18362-1171.exe 5040a0 503ca0 503ea0 6fa 432c90 20 60
331 ntoskrnl_18362-1198.exe 5040a0 503ca0 503ea0 6fa 432c90 20 60
332 ntoskrnl_18362-1237.exe 5040a0 503ca0 503ea0 6fa 432c90 20 60
333 ntoskrnl_18362-1256.exe 5040a0 503ca0 503ea0 6fa 432c90 20 60
334 ntoskrnl_18362-1316.exe 5040a0 503ca0 503ea0 6fa 432c90 20 60
335 ntoskrnl_18362-1350.exe 503b60 503d60 503960 6fa 432bf8 20 60
336 ntoskrnl_18362-1377.exe 503da0 5039a0 503ba0 6fa 432c38 20 60
337 ntoskrnl_18362-1379.exe 503da0 5039a0 503ba0 6fa 432c38 20 60
338 ntoskrnl_18362-1411.exe 503de0 5039e0 503be0 6fa 432c38 20 60
339 ntoskrnl_18362-1440.exe 503da0 5039a0 503ba0 6fa 432c38 20 60
340 ntoskrnl_18362-1441.exe 503da0 5039a0 503ba0 6fa 432c38 20 60
341 ntoskrnl_18362-145.exe 500de0 5009e0 500be0 6fa 42f9e8 20 50
342 ntoskrnl_18362-1474.exe 503ba0 503da0 5039a0 6fa 432c38 20 60
343 ntoskrnl_18362-1500.exe 503b60 503d60 503960 6fa 432c18 20 60
344 ntoskrnl_18362-1533.exe 503e20 503a20 503c20 6fa 432c78 20 60
345 ntoskrnl_18362-1556.exe 503e20 503a20 503c20 6fa 432c78 20 60
346 ntoskrnl_18362-1621.exe 503e20 503a20 503c20 6fa 432c78 20 60
347 ntoskrnl_18362-1679.exe 502da0 5029a0 502ba0 6fa 431bf8 20 60
348 ntoskrnl_18362-1734.exe 503de0 5039e0 503be0 6fa 432c38 20 60
349 ntoskrnl_18362-1801.exe 503ce0 503ee0 503ae0 6fa 432c38 20 60
350 ntoskrnl_18362-207.exe 500de0 5009e0 500be0 6fa 42fa48 20 50
351 ntoskrnl_18362-239.exe 500de0 5009e0 500be0 6fa 42fa48 20 50
352 ntoskrnl_18362-267.exe 503f60 503b60 503d60 6fa 432c60 20 50
353 ntoskrnl_18362-295.exe 503fa0 503ba0 503da0 6fa 432c48 20 50
354 ntoskrnl_18362-30.exe 500d60 500960 500b60 6fa 42fa40 20 50
355 ntoskrnl_18362-329.exe 504ee0 5050e0 504ce0 6fa 433c28 20 50
356 ntoskrnl_18362-356.exe 505060 504c60 504e60 6fa 433c90 20 50
357 ntoskrnl_18362-357.exe 505060 504c60 504e60 6fa 433c90 20 50
358 ntoskrnl_18362-387.exe 505fe0 505be0 505de0 6fa 434c38 20 50
359 ntoskrnl_18362-388.exe 505fe0 505be0 505de0 6fa 434c38 20 50
360 ntoskrnl_18362-418.exe 505ee0 5060e0 505ce0 6fa 434c58 20 50
361 ntoskrnl_18362-449.exe 505da0 505fa0 505ba0 6fa 434c58 20 50
362 ntoskrnl_18362-476.exe 506060 505c60 505e60 6fa 434c78 20 50
363 ntoskrnl_18362-535.exe 506020 505c20 505e20 6fa 434c78 20 50
364 ntoskrnl_18362-592.exe 506060 505c60 505e60 6fa 434c80 20 50
365 ntoskrnl_18362-628.exe 506060 505c60 505e60 6fa 434c78 20 50
366 ntoskrnl_18362-657.exe 505e60 506060 505c60 6fa 434c78 20 50
367 ntoskrnl_18362-693.exe 505de0 505fe0 505be0 6fa 434c38 20 60
368 ntoskrnl_18362-719.exe 505e20 506020 505c20 6fa 434c78 20 60
369 ntoskrnl_18362-720.exe 505e20 506020 505c20 6fa 434c78 20 60
370 ntoskrnl_18362-752.exe 505ea0 5060a0 505ca0 6fa 434c58 20 60
371 ntoskrnl_18362-753.exe 505ea0 5060a0 505ca0 6fa 434c58 20 60
372 ntoskrnl_18362-778.exe 505e60 506060 505c60 6fa 434c70 20 60
373 ntoskrnl_18362-815.exe 505e60 506060 505c60 6fa 434c70 20 60
374 ntoskrnl_18362-836.exe 505ea0 5060a0 505ca0 6fa 434c58 20 60
375 ntoskrnl_18362-900.exe 505ea0 5060a0 505ca0 6fa 434c78 20 60
376 ntoskrnl_18362-904.exe 505ea0 5060a0 505ca0 6fa 434c78 20 60
377 ntoskrnl_18362-959.exe 505ea0 5060a0 505ca0 6fa 434cb8 20 60
378 ntoskrnl_18362-997.exe 505e60 506060 505c60 6fa 434c78 20 60
379 ntoskrnl_19041-1023.exe cec460 cec260 cec060 87a c19db8 20 60
380 ntoskrnl_19041-1052.exe cebfe0 cec3e0 cec1e0 87a c19790 20 60
381 ntoskrnl_19041-1055.exe cec020 cec420 cec220 87a c19790 20 60
382 ntoskrnl_19041-1081.exe cec1e0 cebfe0 cec3e0 87a c19758 20 60
383 ntoskrnl_19041-1082.exe cec420 cec220 cec020 87a c19758 20 60
384 ntoskrnl_19041-1083.exe cec420 cec220 cec020 87a c19758 20 60
385 ntoskrnl_19041-1110.exe cec120 cebf20 cec320 87a c197f8 20 60
386 ntoskrnl_19041-1151.exe cec320 cec120 cebf20 87a c197c0 20 60
387 ntoskrnl_19041-1165.exe cec2e0 cec0e0 cebee0 87a c197a0 20 60
388 ntoskrnl_19041-1202.exe cec320 cec120 cebf20 87a c197d0 20 60
389 ntoskrnl_19041-1237.exe cec320 cec120 cebf20 87a c197d0 20 60
390 ntoskrnl_19041-1266.exe cec3a0 cec1a0 cebfa0 87a c19770 20 60
391 ntoskrnl_19041-1288.exe cec1a0 cebfa0 cec3a0 87a c19790 20 60
392 ntoskrnl_19041-264.exe cec060 cec260 cebe60 87a c19858 20 60
393 ntoskrnl_19041-329.exe cec320 cebf20 cec120 87a c19898 20 60
394 ntoskrnl_19041-331.exe cec320 cebf20 cec120 87a c19898 20 60
395 ntoskrnl_19041-388.exe cec3a0 cebfa0 cec1a0 87a c19898 20 60
396 ntoskrnl_19041-423.exe cec160 cec360 cebf60 87a c198b8 20 60
397 ntoskrnl_19041-450.exe cec320 cebf20 cec120 87a c198b8 20 60
398 ntoskrnl_19041-488.exe cec220 cec420 cec020 87a c19918 20 60
399 ntoskrnl_19041-508.exe cec3a0 cebfa0 cec1a0 87a c19898 20 60
400 ntoskrnl_19041-546.exe cec420 cec020 cec220 87a c19938 20 60
401 ntoskrnl_19041-572.exe cec420 cec020 cec220 87a c19938 20 60
402 ntoskrnl_19041-610.exe cec220 cec420 cec020 87a c19978 20 60
403 ntoskrnl_19041-630.exe cec220 cec420 cec020 87a c19978 20 60
404 ntoskrnl_19041-631.exe cec220 cec420 cec020 87a c19978 20 60
405 ntoskrnl_19041-662.exe cec3a0 cec1a0 cebfa0 87a c198f8 20 60
406 ntoskrnl_19041-685.exe cec3a0 cec1a0 cebfa0 87a c198f8 20 60
407 ntoskrnl_19041-746.exe cebfe0 cec3e0 cec1e0 87a c198f8 20 60
408 ntoskrnl_19041-789.exe cec220 cec620 cec420 87a c19998 20 60
409 ntoskrnl_19041-804.exe cec420 cec220 cec020 87a c19918 20 60
410 ntoskrnl_19041-844.exe cec660 cec460 cec260 87a c19fa8 20 60
411 ntoskrnl_19041-867.exe cec1e0 cec5e0 cec3e0 87a c19fa8 20 60
412 ntoskrnl_19041-868.exe cec1e0 cec5e0 cec3e0 87a c19fa8 20 60
413 ntoskrnl_19041-870.exe cec1e0 cec5e0 cec3e0 87a c19fa8 20 60
414 ntoskrnl_19041-906.exe cec5e0 cec3e0 cec1e0 87a c199d0 20 60
415 ntoskrnl_19041-928.exe cec520 cec320 cec120 87a c19950 20 60
416 ntoskrnl_19041-964.exe cec0e0 cebee0 cec2e0 87a c19d38 20 60
417 ntoskrnl_19041-985.exe cec360 cec160 cebf60 87a c19d78 20 60
418 ntoskrnl_22000-194.exe cf5f40 cf5d40 cf6140 87a c15d20 20 60
419 ntoskrnl_22000-258.exe cf5f40 cf5d40 cf6140 87a c15d20 20 60
420 ntoskrnl_22000-282.exe cf5f00 cf5d00 cf6100 87a c163d0 20 60
Offsets/WdigestOffsets.csv
+33
View File
@@ -0,0 +1,33 @@
wdigestVersion,g_fParameter_UseLogonCredentialOffset,g_IsCredGuardEnabledOffset
wdigest_10240-18244.dll,35144,34ba0
wdigest_10240-18608.dll,35144,34ba0
wdigest_10586-0.dll,35db0,35ba8
wdigest_15254-245.dll,34d8c,34b88
wdigest_10240-17184.dll,35144,34ba0
wdigest_14393-3750.dll,35dc0,35ba8
wdigest_15063-1868.dll,34d8c,34b88
wdigest_14393-0.dll,35dc0,35ba8
wdigest_14393-3808.dll,35dc0,35ba8
wdigest_10240-18638.dll,35144,34ba0
wdigest_14393-3024.dll,35dc0,35ba8
wdigest_10240-16384.dll,35134,0
wdigest_16299-192.dll,35114,34b88
wdigest_16299-1937.dll,35114,34b88
wdigest_16299-1217.dll,35114,34b88
wdigest_17134-1610.dll,36114,35b88
wdigest_16299-1992.dll,35114,34b88
wdigest_17134-829.dll,35114,34b88
wdigest_17134-590.dll,35114,34b88
wdigest_17134-1553.dll,35114,34b88
wdigest_17763-194.dll,35114,34b88
wdigest_17763-1339.dll,36114,35b88
wdigest_17763-1294.dll,35114,34b88
wdigest_17763-557.dll,35114,34b88
wdigest_18362-175.dll,35124,34b88
wdigest_18362-959.dll,36124,35b88
wdigest_19041-1001.dll,361b4,35c08
wdigest_18362-904.dll,35124,34b88
wdigest_19041-388.dll,361b4,35c08
wdigest_19041-329.dll,361b4,35c08
wdigest_22406-1000.dll,3caa4,3cab0
wdigest_18362-1216.dll,35124,34b88
1 wdigestVersion g_fParameter_UseLogonCredentialOffset g_IsCredGuardEnabledOffset
2 wdigest_10240-18244.dll 35144 34ba0
3 wdigest_10240-18608.dll 35144 34ba0
4 wdigest_10586-0.dll 35db0 35ba8
5 wdigest_15254-245.dll 34d8c 34b88
6 wdigest_10240-17184.dll 35144 34ba0
7 wdigest_14393-3750.dll 35dc0 35ba8
8 wdigest_15063-1868.dll 34d8c 34b88
9 wdigest_14393-0.dll 35dc0 35ba8
10 wdigest_14393-3808.dll 35dc0 35ba8
11 wdigest_10240-18638.dll 35144 34ba0
12 wdigest_14393-3024.dll 35dc0 35ba8
13 wdigest_10240-16384.dll 35134 0
14 wdigest_16299-192.dll 35114 34b88
15 wdigest_16299-1937.dll 35114 34b88
16 wdigest_16299-1217.dll 35114 34b88
17 wdigest_17134-1610.dll 36114 35b88
18 wdigest_16299-1992.dll 35114 34b88
19 wdigest_17134-829.dll 35114 34b88
20 wdigest_17134-590.dll 35114 34b88
21 wdigest_17134-1553.dll 35114 34b88
22 wdigest_17763-194.dll 35114 34b88
23 wdigest_17763-1339.dll 36114 35b88
24 wdigest_17763-1294.dll 35114 34b88
25 wdigest_17763-557.dll 35114 34b88
26 wdigest_18362-175.dll 35124 34b88
27 wdigest_18362-959.dll 36124 35b88
28 wdigest_19041-1001.dll 361b4 35c08
29 wdigest_18362-904.dll 35124 34b88
30 wdigest_19041-388.dll 361b4 35c08
31 wdigest_19041-329.dll 361b4 35c08
32 wdigest_22406-1000.dll 3caa4 3cab0
33 wdigest_18362-1216.dll 35124 34b88
Offsets/requirements.txt
+2
View File
@@ -0,0 +1,2 @@
requests
pywin32