This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

PLease help me to remove the spyware / malware

15 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

This thread's last reply is from November 9, 2010, 5:40 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

dalitaj
October 30, 2010, 11:59 PM UTC
Hi my name is Dalita, and I am having computer problems. I called Microsoft to get my internet explorer fixed. I was told that I have certain viruses that are allowing people to gain access to my personal information via my computer. I have had money and personal information stolen as of recently. While I have adressed these issues, I want to ensure that these security breaches do not compromise my situation any further. I used to have limewire but I was told by my boyfriend to delete it about 3 months ago for these very reasons. I thought that this had solved my problems, but had never thought to address any remaining malware / viruses/ trojans/ spyware that may have remained on my computer. I do not download anything via peer-to-peer programs anymore. However now that the technician has made me aware of this problem, I would like to make sure that any software causing this type of security breach is removed . Please help me to remove all of this unwanted software from my computer.


here is a copy of my Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:28:17 PM, on 10/30/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2077543
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

--
End of file - 4516 bytes



and here is a copy of my uninstall log:


Acer Assist
Acer Crystal Eye webcam
Acer Crystal Eye webcam
Acer eAudio Management
Acer eDataSecurity Management
Acer eLock Management
Acer Empowering Technology
Acer eNet Management
Acer ePower Management
Acer ePresentation Management
Acer eSettings Management
Acer GridVista
Acer Mobility Center Plug-In
Acer Registration
Acer ScreenSaver
Acer Tour
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 9.3
Adobe Shockwave Player 11.5
ALPS Touch Pad Driver
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
Big Kahuna Reef 2
Bonjour
Browser Highlighter - Firefox
Comcast High-Speed Internet Install Wizard
CourseSmart Bookshelf
DivX Content Uploader
DivX Web Player
Dynasty
FoxyTunes for Firefox
Galapago
HDAUDIO Soft Data Fax Modem with SmartCP
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iTunes
Java(TM) 6 Update 7
Launch Manager
Luxor 2
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Essentials
Microsoft Security Essentials
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.6.3)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Mystery Case Files - Prime Suspects
NTI Backup NOW! 4.7
NTI CD & DVD-Maker
NVIDIA Drivers
NVIDIA PhysX
OGA Notifier 2.0.0048.0
OpenOffice.org Installer 1.0
PC SpeedScan Pro
PowerProducer 3.72
QuickTime
Realtek High Definition Audio Driver
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype Toolbars
Skype™ 4.2
Star Defender 3
SUPERAntiSpyware
Treasures of the Deep
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Ventrilo Client
VoiceOver Kit
World of Warcraft
Yahoo! Browser Services
Yahoo! Messenger
Yahoo! Toolbar
Zuma Deluxe
Cypher Admin/Teacher
November 1, 2010, 6:51 PM UTC
Hi and welcome to Malware Removal Forum.
My name is Cypher, and I will be helping you with your malware problems.
If you no longer require help i would be grateful if you would let me know.

Before we start please note the following important guidelines.
  • The instructions being given are for YOUR computer and system only!.
    Using these instructions on a different computer, can damage that computer and possibly make it inoperable!
  • If you don't know or understand something, please don't hesitate to ask.
  • Only post your problem at One help site. Applying fixes from multiple help sites can cause problems.
  • Only reply to this thread do not start another, Please continue responding until I give you the "All Clean"
    Absence of symptoms does not mean that everything is clear.
  • Please DO NOT run any other tools or scans whilst I am helping you.
  • Please DO NOT install any other software (or hardware) during the cleaning process.
  • Print each set of instructions... if possible...your Internet connection will not be available during some fix processes.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • Note: No Reply Within 3 Days Will Result In Your Topic Being Closed!


Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.
Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
Backup Made Easy - XP
How to backup your data - Vista



Vista Advice:
  • All applications I ask to be used will require to be run in Administrator mode. IE: Right click on and select Run as Administrator.
  • The Operating System(Vista aka Windows 6) in use comes with a inbuilt utility called User Access Control(UAC).
  • When prompted by this with anything I ask you to do carry out please select the option Allow.



Uninstall programs
  • Click on Start.
  • All programs.
  • Accessories.
  • Run.
  • In the open text box copy/paste appwiz.cpl Then click Ok.
  • Uninstall the following

Ask Toolbar
Java(TM) 6 Update 7
SUPERAntiSpyware

Next.

Fix HijackThis entries

Run HijackThis

If using Vista, you must right click (hijackthis.exe) and choose "Run As Administrator".
  • If you are on the Main Menu page... Click "Do a system scan only"
  • If you are on the "scan & fix stuff" page... Press the Scan...button.
  • When the scan finishes...Place a check mark next to the following entries (if they are still present)
  • Note: Only check those items listed below.
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll

  • After checking these items... CLOSE ALL open windows except HijackThis.
  • Click the Fix Checked ...button...to remove the entries you checked.
  • Choose YES...when prompted to fix the selected items.
  • Once it has fixed them, close HijackThis and reboot your computer normally.


Next.

Run CKScanner

  • Please download CKScanner from Here
  • Important: - Save it to your desktop.
  • Right-click CKScanner.exe > select " Run as administrator " then click Search For Files.
  • After a very short time, when the cursor hourglass disappears, click Save List To File.
  • A message box will verify the file saved.
  • Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.


Next.

Malwarebytes Anti-Malware:

  • Launch the application, Check for Updates >> Perform Quick Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Check all items except items in the C:\System Volume Information folder... and click Remove Selected.
    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply.
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt


Next.

RSIT (Random's System Information Tool)

Please download RSIT by random/random... and save it to your desktop.
  • Right click on RSIT.exe and select "Run As Administrator" to run it. If Windows UAC prompts you, please allow it.
  • Please read the disclaimer... click on Continue.
  • RSIT will start running. When done... 2 logs files...will be produced.
  • The first one, "log.txt", << will be maximized
  • The second one, "info.txt", << will be minimized.

Please post both... "log.txt" and "info.txt", file contents in your next reply.
(These logs can be lengthy, so post 1 log per reply please.)



Logs/Information to Post in your Next Reply

  • CKFiles.txt.
  • Malwarebytes log.
  • RSIT log.txt and info.txt contents.
  • Please give me an update on your computers performance.
dalitaj
November 3, 2010, 4:57 AM UTC
MalwareBytes did not generate a log that I was able to find. However it did states that no infections were found.

the CKfiles log you asked for is here:

<quote>CKScanner - Additional Security Risks - These are not necessarily bad
scanner sequence 3.MN.11
----- EOF ----- </quote>


as for the RSIT scans the Info.txt file gave me back this information:

<quote>info.txt logfile of random's system information tool 1.08 2010-11-02 21:14:03

======Uninstall list======

-->MsiExec /X{8AAB4176-A747-493A-A42C-B63CFADFD8E3}
Acer Assist-->C:\Program Files\Acer Assist\uninstall.exe
Acer Crystal Eye webcam-->C:\Program Files\InstallShield Installation Information\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}\setup.exe -runfromtemp -l0x0009 -removeonly -u
Acer Crystal Eye webcam-->C:\Program Files\InstallShield Installation Information\{AA047D7C-5E7C-4878-B75C-77589151B563}\setup.exe -runfromtemp -l0x0009 -removeonly
Acer eAudio Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57265292-228A-41FA-9AEC-4620CBCC2739}\Setup.exe" -uninstall
Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\eDSnstHelper.exe -Operation UNINSTALL
Acer eLock Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}\setup.exe" -l0x9 -removeonly
Acer Empowering Technology-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x9 -removeonly
Acer eNet Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C06554A1-2C1E-4D20-B613-EE62C79927CC}\setup.exe" -l0x9 -removeonly
Acer ePower Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\setup.exe" -l0x9 -removeonly
Acer ePresentation Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BF839132-BD43-4056-ACBF-4377F4A88E2A}\setup.exe" -l0x9 -removeonly
Acer eSettings Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CE65A9A0-9686-45C6-9098-3C9543A412F0}\setup.exe" -l0x9 -removeonly
Acer GridVista-->C:\Windows\UnInst32.exe GridV.UNI
Acer Mobility Center Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11316260-6666-467B-AC34-183FCB5D4335}\setup.exe" -l0x9 -removeonly
Acer Registration-->C:\Program Files\Acer Registration\uninstall.exe
Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
Acer Tour-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x9 -removeonly
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A93000000001}
Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
ALPS Touch Pad Driver-->C:\Program Files\Apoint2K\Uninstap.exe ADDREMOVE
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Big Kahuna Reef 2-->"C:\Program Files\Acer GameZone\Big Kahuna Reef 2\Uninstall.exe" "C:\Program Files\Acer GameZone\Big Kahuna Reef 2\install.log"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Browser Highlighter - Firefox-->MsiExec.exe /X{3B62CF95-5E25-4720-A3D6-B4A2B0501961}
Comcast High-Speed Internet Install Wizard-->C:\Program Files\support.com\uninstall\chsi_uninstaller.exe
CourseSmart Bookshelf-->MsiExec.exe /I{788040D7-8FD8-47F7-8D14-F4A99261330F}
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Dynasty-->"C:\Program Files\Acer GameZone\Dynasty\Uninstall.exe" "C:\Program Files\Acer GameZone\Dynasty\install.log"
FoxyTunes for Firefox-->"C:\Program Files\Mozilla Firefox\firefox.exe" -chrome chrome://foxytunes/content/extras/uninstallExtension.xul
Galapago-->"C:\Program Files\Acer GameZone\Galapago\Uninstall.exe" "C:\Program Files\Acer GameZone\Galapago\install.log"
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118\UIU32m.exe -U -Ic:\Release\Foxconn\51338\AcrZUn32z.inf
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
iTunes-->MsiExec.exe /I{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}
Launch Manager-->C:\Windows\UnInst32.exe LManager.UNI
Luxor 2-->"C:\Program Files\Acer GameZone\Luxor 2\Uninstall.exe" "C:\Program Files\Acer GameZone\Luxor 2\install.log"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Antimalware-->MsiExec.exe /X{E62A1F01-07B7-4541-A835-EE5B0BF064C2}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Security Essentials-->C:\Program Files\Microsoft Security Essentials\setup.exe /x
Microsoft Security Essentials-->MsiExec.exe /I{EF98A02A-1748-4762-9B7D-5ED1600520D5}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.6.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Mystery Case Files - Prime Suspects-->"C:\Program Files\Acer GameZone\Mystery Case Files - Prime Suspects\Uninstall.exe" "C:\Program Files\Acer GameZone\Mystery Case Files - Prime Suspects\install.log"
NTI Backup NOW! 4.7-->"C:\Program Files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe" -removeonly
NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1033 CDM7
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{8AAB4176-A747-493A-A42C-B63CFADFD8E3}
OGA Notifier 2.0.0048.0-->MsiExec.exe /I{B2544A03-10D0-4E5E-BA69-0362FFC20D18}
OpenOffice.org Installer 1.0-->MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
PC SpeedScan Pro-->C:\Program Files\InstallShield Installation Information\{80F24F31-F641-4349-83F3-59E335976D16}\setup.exe -runfromtemp -l0x0009 -removeonly
PowerProducer 3.72-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.EXE" -uninstall
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\setup.exe" -l0x9 anything
Security Update for 2007 Microsoft Office System (KB2288621)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5C497F0B-2061-4CC9-A61C-6B45B867354D}
Security Update for 2007 Microsoft Office System (KB2344875)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6FC5C4C1-D7AE-44C3-94B7-6424FC3E752F}
Security Update for 2007 Microsoft Office System (KB2345043)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {536FB502-775F-4494-BACE-C02CC90B7A5B}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB976321)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7F207DCA-3399-40CB-A968-6E5991B1421A}
Security Update for 2007 Microsoft Office System (KB982312)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B0EC5722-241F-4CDA-83B4-AA5846B6F9F4}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A8894F19-59C8-38D2-8A75-36C0CCE56A5B} /qb+ REBOOTPROMPT=""
Security Update for Microsoft Office Excel 2007 (KB2345035)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B23002DD-34EC-4988-B810-A5E2A0BF04F1}
Security Update for Microsoft Office InfoPath 2007 (KB979441)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
Security Update for Microsoft Office PowerPoint 2007 (KB982158)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F5B70033-E79C-4569-90BF-BC9B4E4F3F46}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB2344993)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7A5B74FA-7A92-4FC9-821A-2DD5D4E73E48}
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Star Defender 3-->"C:\Program Files\Acer GameZone\Star Defender 3\Uninstall.exe" "C:\Program Files\Acer GameZone\Star Defender 3\install.log"
Treasures of the Deep-->"C:\Program Files\Acer GameZone\Treasures of the Deep\Uninstall.exe" "C:\Program Files\Acer GameZone\Treasures of the Deep\install.log"
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office OneNote 2007 (KB980729)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {329050A9-EF80-40F9-B633-74508F54C1FF}
Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
VoiceOver Kit-->MsiExec.exe /I{6DE13770-01B7-4366-8DA6-48237793F445}
World of Warcraft-->C:\Program Files\Common Files\Blizzard Entertainment\Wrath of the Lich King\Uninstall.exe
Yahoo! Browser Services-->C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\unyt.exe
Zuma Deluxe-->"C:\Program Files\Acer GameZone\Zuma Deluxe\Uninstall.exe" "C:\Program Files\Acer GameZone\Zuma Deluxe\install.log"

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: [redacted]
Event Code: 4374
Message: Windows Servicing identified that package KB936330(Service Pack) is not applicable for this system
Record Number: 1248525
Source Name: Microsoft-Windows-Servicing
Time Written: 20100929202513.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: [redacted]
Event Code: 4374
Message: Windows Servicing identified that package KB936330(Service Pack) is not applicable for this system
Record Number: 1248520
Source Name: Microsoft-Windows-Servicing
Time Written: 20100929202512.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: [redacted]
Event Code: 4374
Message: Windows Servicing identified that package KB936330(Service Pack) is not applicable for this system
Record Number: 1248518
Source Name: Microsoft-Windows-Servicing
Time Written: 20100929202510.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: [redacted]
Event Code: 4374
Message: Windows Servicing identified that package KB936330(Service Pack) is not applicable for this system
Record Number: 1248511
Source Name: Microsoft-Windows-Servicing
Time Written: 20100929202508.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: [redacted]
Event Code: 4374
Message: Windows Servicing identified that package KB936330(Service Pack) is not applicable for this system
Record Number: 1248510
Source Name: Microsoft-Windows-Servicing
Time Written: 20100929202508.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

=====Application event log=====

Computer Name: [redacted]
Event Code: 3029
Message: The plug-in in <Search.TripoliIndexer> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
The content index cannot be read. (0xc0041800)

Record Number: 45116
Source Name: Microsoft-Windows-Search
Time Written: 20090902170547.000000-000
Event Type: Error
User:

Computer Name: [redacted]
Event Code: 5007
Message: The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9.
Record Number: 44898
Source Name: WerSvc
Time Written: 20090902054203.000000-000
Event Type: Error
User:

Computer Name: [redacted]
Event Code: 1002
Message: The program Launcher.exe version 2.0.0.446 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 978 Start Time: 01ca2b712e2103b8 Termination Time: 7
Record Number: 44773
Source Name: Application Hang
Time Written: 20090902020057.000000-000
Event Type: Error
User:

Computer Name: [redacted]
Event Code: 1002
Message: The program CurseClient.exe version 0.0.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: dc0 Start Time: 01ca2b7005c49368 Termination Time: 7
Record Number: 44761
Source Name: Application Hang
Time Written: 20090902015304.000000-000
Event Type: Error
User:

Computer Name: [redacted]
Event Code: 5007
Message: The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9.
Record Number: 44748
Source Name: WerSvc
Time Written: 20090902013832.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: [redacted]
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-21-1586106642-3842499553-3097037045-1000
Account Name: [redacted]
Account Domain: Owner-PC
Logon ID: 0x21659

Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
Record Number: 95579
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100422222826.446153-000
Event Type: Audit Success
User:

Computer Name: [redacted]
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: [redacted]
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 2

New Logon:
Security ID: S-1-5-21-1586106642-3842499553-3097037045-1000
Account Name: [redacted]
Account Domain: Owner-PC
Logon ID: 0x21659
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x2c4
Process Name: C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name: OWNER-PC
Source Network Address: 127.0.0.1
Source Port: 0

Detailed Authentication Information:
Logon Process: User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 95578
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100422222826.446153-000
Event Type: Audit Success
User:

Computer Name: [redacted]
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: [redacted]
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: [redacted]
Account Domain: Owner-PC
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x2c4
Process Name: C:\Windows\System32\winlogon.exe

Network Information:
Network Address: 127.0.0.1
Port: 0

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 95577
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100422222826.446153-000
Event Type: Audit Success
User:

Computer Name: [redacted]
Event Code: 5056
Message: A cryptographic self test was performed.

Subject:
Security ID: S-1-5-18
Account Name: [redacted]
Account Domain: WORKGROUP
Logon ID: 0x3e7

Module: ncrypt.dll

Return Code: 0x0
Record Number: 95576
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100422222825.712948-000
Event Type: Audit Success
User:

Computer Name: [redacted]
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: [redacted]
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 95575
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100422222824.215339-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Program Files\CA\SharedComponents\CAUpdate;C:\Program Files\CA\SharedComponents\ThirdParty;C:\Program Files\CA\SharedComponents\SubscriptionLicense
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 104 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=6801
"NUMBER_OF_PROCESSORS"=2
"CASHCOMP"=C:\Program Files\CA\SharedComponents\
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF----------------- </quote>
dalitaj
November 3, 2010, 4:59 AM UTC
the performance of my computer doesn't seem any different at all. I did not experience slow load times or anything after contracting the infections, but was having security breaches to sensitive personal information including banking information. This is where my concern lies since I did have some money stolen from my accounts. I did get this resolved with the banks, but I assumed that the same software that has allowed people onto my PC is what allowed my banking information to be compromised. Thank you and I hope this answers your question.

Here is the seperate post of the long version of the RSIT scan that generated the log.txt file:

Logfile of random's system information tool 1.08 (written by random/random)
Run by [redacted] at 2010-11-02 21:13:36
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 13 GB (18%) free of 71 GB
Total RAM: 1790 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:14:00 PM, on 11/2/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Users\Owner\Downloads\RSIT.exe
C:\Program Files\trend micro\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2077543
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

--
End of file - 3636 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2007-09-05 816400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 198136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-04-25 151552]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2007-09-05 816400]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-08-30 4670704]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-03-09 26100520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Assist Launcher]
C:\Program Files\Acer Assist\launcher.exe [2007-02-02 1261568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Product Registration]
C:\Program Files\Acer Registration\ACE1.exe [2007-02-02 3383296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
C:\Acer\AcerTour\Reminder.exe [2007-05-22 151552]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
C:\Program Files\Apoint2K\Apoint.exe [2007-06-06 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio]
C:\Acer\Empowering Technology\eAudio\eAudio.exe [2007-06-11 1286144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-04-25 457216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
C:\Windows\ehome\ehTray.exe [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2009-09-21 305440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\PROGRA~1\LAUNCH~1\LManager.exe [2007-06-27 752136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
C:\Program Files\Microsoft Security Essentials\msseces.exe [2010-09-15 1094224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\Windows\system32\NvCpl.dll [2009-01-30 13605408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\Windows\system32\NvMcTray.dll [2009-01-30 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSet]
C:\Windows\PLFSet.dll [2007-04-24 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
C:\Windows\RtHDVCpl.exe [2007-05-18 4468736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2010-03-09 26100520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
C:\Windows\Skytel.exe [2007-05-18 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tbhSystray]
C:\Program Files\tbh\base\bin\tbhSystray.exe [2010-10-29 492840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
C:\Acer\EMPOWE~1\EAPLAU~1.EXE [2007-04-14 535336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-11-02 21:13:36 ----D---- C:\rsit
2010-11-01 22:51:23 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-11-01 22:51:20 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-11-01 22:51:19 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-10-30 18:09:30 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2010-10-29 18:23:10 ----A---- C:\Windows\system32\gameux.dll
2010-10-29 18:23:00 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-10-29 18:22:59 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-10-17 15:35:30 ----D---- C:\Program Files\Windows Portable Devices
2010-10-17 15:20:26 ----A---- C:\Windows\system32\UIAnimation.dll
2010-10-17 15:20:24 ----A---- C:\Windows\system32\UIRibbonRes.dll
2010-10-17 15:20:24 ----A---- C:\Windows\system32\UIRibbon.dll
2010-10-17 15:19:34 ----A---- C:\Windows\system32\WMPhoto.dll
2010-10-17 15:19:32 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-10-17 15:19:32 ----A---- C:\Windows\system32\cdd.dll
2010-10-17 15:19:30 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2010-10-17 15:19:30 ----A---- C:\Windows\system32\d3d10warp.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\XpsRasterService.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\WindowsCodecs.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\dxdiagn.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\d2d1.dll
2010-10-17 15:19:28 ----A---- C:\Windows\system32\XpsPrint.dll
2010-10-17 15:19:28 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2010-10-17 15:19:28 ----A---- C:\Windows\system32\OpcServices.dll
2010-10-17 15:19:28 ----A---- C:\Windows\system32\dxdiag.exe
2010-10-17 15:19:27 ----A---- C:\Windows\system32\xpsservices.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\FntCache.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\DWrite.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d11.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d10level9.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d10core.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d10_1core.dll
2010-10-17 15:19:25 ----A---- C:\Windows\system32\dxgi.dll
2010-10-17 15:19:25 ----A---- C:\Windows\system32\d3d10_1.dll
2010-10-17 15:19:25 ----A---- C:\Windows\system32\d3d10.dll
2010-10-17 15:18:23 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2010-10-17 15:18:22 ----A---- C:\Windows\system32\wpdbusenum.dll
2010-10-17 15:18:22 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2010-10-17 15:18:09 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2010-10-17 15:17:56 ----A---- C:\Windows\system32\WpdConns.dll
2010-10-17 15:17:55 ----A---- C:\Windows\system32\WpdMtpUS.dll
2010-10-17 15:17:55 ----A---- C:\Windows\system32\drivers\WpdUsb.sys
2010-10-17 15:17:46 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\wpdshext.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\WpdMtp.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\wpd_ci.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2010-10-17 15:17:45 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2010-10-17 15:17:44 ----A---- C:\Windows\system32\WPDSp.dll
2010-10-17 15:17:44 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2010-10-17 15:17:44 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2010-10-17 15:14:25 ----A---- C:\Windows\system32\oleaccrc.dll
2010-10-17 15:14:23 ----A---- C:\Windows\system32\UIAutomationCore.dll
2010-10-17 15:14:23 ----A---- C:\Windows\system32\oleacc.dll
2010-10-14 15:39:24 ----D---- C:\ProgramData\WindowsSearch
2010-10-13 12:44:55 ----D---- C:\Windows\system32\eu-ES
2010-10-13 12:44:55 ----D---- C:\Windows\system32\ca-ES
2010-10-13 12:44:54 ----D---- C:\Windows\system32\vi-VN
2010-10-12 18:44:03 ----A---- C:\Windows\system32\srvsvc.dll
2010-10-12 18:44:02 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-10-12 18:44:02 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-10-12 18:44:02 ----A---- C:\Windows\system32\drivers\srv.sys
2010-10-12 18:44:01 ----A---- C:\Windows\system32\netevent.dll
2010-10-12 18:43:54 ----A---- C:\Windows\system32\mfc40.dll
2010-10-12 18:43:53 ----A---- C:\Windows\system32\mfc40u.dll
2010-10-12 18:38:19 ----A---- C:\Windows\system32\ieframe.dll
2010-10-12 18:38:17 ----A---- C:\Windows\system32\msfeeds.dll
2010-10-12 18:38:15 ----A---- C:\Windows\system32\mshtml.dll
2010-10-12 18:38:15 ----A---- C:\Windows\system32\ieapfltr.dll
2010-10-12 18:38:14 ----A---- C:\Windows\system32\mshtmled.dll
2010-10-12 18:38:13 ----A---- C:\Windows\system32\urlmon.dll
2010-10-12 18:38:12 ----A---- C:\Windows\system32\wininet.dll
2010-10-12 18:38:11 ----A---- C:\Windows\system32\iepeers.dll
2010-10-12 18:38:11 ----A---- C:\Windows\system32\ieencode.dll
2010-10-12 18:37:55 ----A---- C:\Windows\system32\wmp.dll
2010-10-12 18:37:52 ----A---- C:\Windows\system32\wmploc.DLL
2010-10-12 18:37:12 ----A---- C:\Windows\system32\schannel.dll
2010-10-12 18:37:09 ----A---- C:\Windows\system32\ole32.dll
2010-10-12 18:37:04 ----A---- C:\Windows\system32\t2embed.dll
2010-10-12 18:13:25 ----A---- C:\Windows\system32\comctl32.dll
2010-10-12 17:41:36 ----A---- C:\Windows\system32\win32k.sys
2010-10-12 17:35:07 ----A---- C:\Windows\system32\wmpmde.dll
2010-10-12 13:37:18 ----D---- C:\Windows\system32\EventProviders

======List of files/folders modified in the last 1 months======

2010-11-02 21:14:00 ----D---- C:\Program Files\Trend Micro
2010-11-02 21:13:38 ----D---- C:\Windows\temp
2010-11-02 21:08:10 ----D---- C:\Users\Owner\AppData\Roaming\Skype
2010-11-02 16:46:06 ----D---- C:\Users\Owner\AppData\Roaming\skypePM
2010-11-01 22:52:35 ----D---- C:\Windows\System32
2010-11-01 22:52:35 ----D---- C:\Windows\inf
2010-11-01 22:52:35 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-01 22:51:23 ----D---- C:\Windows\system32\drivers
2010-11-01 22:51:19 ----RD---- C:\Program Files
2010-11-01 21:57:41 ----SHD---- C:\System Volume Information
2010-11-01 21:56:45 ----D---- C:\Program Files\Mozilla Firefox
2010-11-01 21:50:53 ----SHD---- C:\Windows\Installer
2010-11-01 21:50:44 ----D---- C:\Program Files\Common Files
2010-11-01 20:46:46 ----D---- C:\Windows\Logs
2010-10-30 18:09:30 ----D---- C:\ProgramData
2010-10-30 12:21:09 ----D---- C:\Windows\winsxs
2010-10-30 12:21:08 ----D---- C:\Windows\AppPatch
2010-10-29 20:11:06 ----D---- C:\Windows\pss
2010-10-29 18:42:48 ----A---- C:\Windows\ntbtlog.txt
2010-10-26 15:30:35 ----D---- C:\Windows\system32\catroot2
2010-10-26 15:30:35 ----D---- C:\Windows\system32\catroot
2010-10-19 16:51:33 ----N---- C:\Windows\system32\MpSigStub.exe
2010-10-17 15:54:52 ----D---- C:\Windows\rescache
2010-10-17 15:39:57 ----D---- C:\Windows\system32\Tasks
2010-10-17 15:35:40 ----D---- C:\Windows
2010-10-17 15:35:31 ----D---- C:\Windows\system32\en-US
2010-10-17 15:35:30 ----D---- C:\Windows\system32\wbem
2010-10-17 15:35:30 ----D---- C:\Windows\system32\drivers\en-US
2010-10-17 15:35:28 ----D---- C:\Windows\system32\zh-TW
2010-10-17 15:35:28 ----D---- C:\Windows\system32\zh-HK
2010-10-17 15:35:28 ----D---- C:\Windows\system32\zh-CN
2010-10-17 15:35:28 ----D---- C:\Windows\system32\uk-UA
2010-10-17 15:35:28 ----D---- C:\Windows\system32\tr-TR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\th-TH
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sv-SE
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sr-Latn-CS
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sl-SI
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sk-SK
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ru-RU
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ro-RO
2010-10-17 15:35:28 ----D---- C:\Windows\system32\pt-PT
2010-10-17 15:35:28 ----D---- C:\Windows\system32\pt-BR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\pl-PL
2010-10-17 15:35:28 ----D---- C:\Windows\system32\nl-NL
2010-10-17 15:35:28 ----D---- C:\Windows\system32\nb-NO
2010-10-17 15:35:28 ----D---- C:\Windows\system32\lv-LV
2010-10-17 15:35:28 ----D---- C:\Windows\system32\lt-LT
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ko-KR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ja-JP
2010-10-17 15:35:28 ----D---- C:\Windows\system32\it-IT
2010-10-17 15:35:28 ----D---- C:\Windows\system32\hu-HU
2010-10-17 15:35:28 ----D---- C:\Windows\system32\hr-HR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\he-IL
2010-10-17 15:35:28 ----D---- C:\Windows\system32\fr-FR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\fi-FI
2010-10-17 15:35:28 ----D---- C:\Windows\system32\et-EE
2010-10-17 15:35:28 ----D---- C:\Windows\system32\es-ES
2010-10-17 15:35:28 ----D---- C:\Windows\system32\el-GR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\de-DE
2010-10-17 15:35:28 ----D---- C:\Windows\system32\da-DK
2010-10-17 15:35:28 ----D---- C:\Windows\system32\cs-CZ
2010-10-17 15:35:28 ----D---- C:\Windows\system32\bg-BG
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ar-SA
2010-10-17 15:35:14 ----D---- C:\Windows\system32\drivers\UMDF
2010-10-14 16:54:40 ----D---- C:\Windows\Minidump
2010-10-14 07:31:52 ----D---- C:\Windows\Microsoft.NET
2010-10-14 07:31:50 ----RSD---- C:\Windows\assembly
2010-10-13 12:55:22 ----SHD---- C:\Boot
2010-10-13 12:45:34 ----D---- C:\Program Files\Windows Sidebar
2010-10-13 12:45:34 ----D---- C:\Program Files\Windows Mail
2010-10-13 12:45:34 ----D---- C:\Program Files\Windows Calendar
2010-10-13 12:45:34 ----D---- C:\Program Files\Movie Maker
2010-10-13 12:45:34 ----D---- C:\Program Files\Internet Explorer
2010-10-13 12:45:33 ----D---- C:\Program Files\Windows Media Player
2010-10-13 12:45:33 ----D---- C:\Program Files\Windows Journal
2010-10-13 12:45:33 ----D---- C:\Program Files\Windows Collaboration
2010-10-13 12:45:33 ----D---- C:\Program Files\Common Files\System
2010-10-13 12:45:32 ----D---- C:\Program Files\Windows Photo Gallery
2010-10-13 12:45:31 ----D---- C:\Windows\servicing
2010-10-13 12:45:31 ----D---- C:\Windows\ehome
2010-10-13 12:45:31 ----D---- C:\Program Files\Windows Defender
2010-10-13 12:45:26 ----D---- C:\Windows\IME
2010-10-13 12:45:25 ----D---- C:\Windows\system32\XPSViewer
2010-10-13 12:45:23 ----D---- C:\Windows\system32\oobe
2010-10-13 12:45:23 ----D---- C:\Windows\system32\migration
2010-10-13 12:45:21 ----D---- C:\Windows\system32\SLUI
2010-10-13 12:45:21 ----D---- C:\Windows\system32\setup
2010-10-13 12:45:21 ----D---- C:\Windows\system32\AdvancedInstallers
2010-10-13 12:45:20 ----D---- C:\Windows\system32\manifeststore
2010-10-13 12:45:20 ----D---- C:\Windows\system32\en
2010-10-13 12:45:16 ----D---- C:\Windows\system32\migwiz
2010-10-13 12:45:02 ----RSD---- C:\Windows\Fonts
2010-10-13 12:44:54 ----D---- C:\Windows\system32\Boot
2010-10-13 12:42:07 ----D---- C:\Windows\system32\RTCOM
2010-10-13 12:28:08 ----A---- C:\Windows\fonts\GlobalUserInterface.CompositeFont
2010-10-13 03:13:54 ----D---- C:\ProgramData\Microsoft Help
2010-10-13 03:04:10 ----A---- C:\Windows\system32\mrt.exe
2010-10-12 19:05:13 ----HD---- C:\Windows\system32\GroupPolicy
2010-10-12 13:52:27 ----D---- C:\Program Files\Microsoft Security Essentials
2010-10-04 19:57:56 ----D---- C:\Program Files\Common Files\Blizzard Entertainment

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 phylock;phylock; C:\Windows\system32\drivers\phylock.sys [2006-12-18 18848]
R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-25 20776]
R0 PSDNServ;PSDNSERVER; C:\Windows\system32\drivers\PSDNServ.sys [2007-04-25 16680]
R0 psdvdisk;psdvdisk; C:\Windows\system32\drivers\psdvdisk.sys [2007-04-25 60712]
R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 20112]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2007-05-16 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-03-22 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-05-16 8192]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-13 154624]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-06-18 737280]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2007-05-16 32256]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-05-16 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-05-16 207360]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-05-18 1775712]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-08-07 6144]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-05-16 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-01-30 7544832]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-05-16 12032]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-02-07 1729152]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-05-16 659968]
S3 catchme;catchme; \??\C:\Users\Owner\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-09-30 40448]
S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 UIUSys;Conexant Setup API; C:\Windows\system32\DRIVERS\UIUSYS.SYS []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 ALaunchService;ALaunch Service; C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
S4 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
S4 eDataSecurity Service;eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-25 457512]
S4 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-04-23 24576]
S4 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-06-13 135168]
S4 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-07-03 53248]
S4 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-28 24576]
S4 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-09-21 545568]
S4 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
S4 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008]
S4 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-01-30 203296]
S4 tbhMonitor.exe;The Browser Highlighter Monitor; C:\Program Files\tbh\monitor\bin\tbhMonitor.exe [2009-10-22 70952]
S4 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-13 167936]
S4 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-05-16 386560]

-----------------EOF-----------------
Cypher Admin/Teacher
November 3, 2010, 9:35 AM UTC
Hi dalitajn.
C:\Users\Owner\Downloads\RSIT.exe

The first thing i would like you to do is move RSIT to your desktop.
It is important that you save any tools i ask you to download to the correct location so they function properly.

Next.

Back Up registry with ERUNT

  • Please use the following link and download ERUNT to your desktop. HERE
  • Right Click on the erunt-setup.exe and select " Run as administrator " to run it.
  • Follow the prompts to install ERUNT
  • Choose language
  • A set up window will pop up. It will ask: Create ERUNT entry in to the Start up folder, answer NO


  • Backup your registry to the default location


Note: To restore your registry (if needed), go to the folder and start ERDNT.exe

Next.

Download and run OTM

Download OTM.exe by Old Timer and save it to your Desktop.
  • Right-click OTM.exe and select " Run as administrator " to run it.
  • Right-click then copy the following code, Do not include the word Code.

    
:Reg
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Assist Launcher]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Product Registration]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSet]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tbhSystray]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
    
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-
    

    
:Commands
    
[EmptyFlash]
    
[emptytemp]
    
[start explorer]
    
[Reboot]

    • Return to OTM, right-click then paste the code into the blank box below
    • Next click on the large button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.


NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Next.

Re-run - RSIT (Random's System Information Tool)

You should still have this program on your desktop.
  • Right click on RSIT.exe and select "Run As Administrator" to run it. If Windows UAC prompts you, please allow it.
  • Please read the disclaimer... click on Continue.
  • RSIT will start running. When done... ONLY the "C:\RSIT\log.txt"...will be reproduced. ( it will be maximized )
  • Please post ONLY the "log.txt", file contents in your next reply.
    (This log can be lengthy, so a separate post may be needed.)


Next.

Please download GMER Rootkit Scanner from Here.
  • Right click the .exe file and chose Run as Administrator. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All << (don't miss this one)

    See image below, Click the image to enlarge it

  • Then click the Scan button & wait for it to finish
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
  • Save it where you can easily find it, such as your desktop, and post it in your next reply
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Note: Do not run any programs while Gmer is running.


Logs/Information to Post in your Next Reply

  • OTM log.
  • RSIT log.txt.
  • Gmer.txt log.
  • Please give me an update on your computers performance.
dalitaj
November 5, 2010, 3:03 AM UTC
Hello again,

so I had a few problems with the GMER.exe i ran the thing twice since the first time i thought it was a fluke, but it seems to be crashing my OS each time i attempt to scan. I unchecked the specified boxes, but it seems this hasn't prevented my system from exploding and forcing an error recovery restart.

as per the logs you requested, here is the RSIT log. I ran it from the desktop last time but for some reason you told me it was in my downloads. I uninstalled it and reinstalled it by forcing the pathing to the desktop this time. so now it should be 100% positvely on my desktop. however without further ado here is that RSIT log:


Logfile of random's system information tool 1.08 (written by random/random)
Run by [redacted] at 2010-11-04 22:34:29
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 13 GB (18%) free of 71 GB
Total RAM: 1790 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:34:48 PM, on 11/4/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\notepad.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Owner\Desktop\RSIT.exe
C:\Program Files\trend micro\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2077543
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

--
End of file - 3701 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2007-09-05 816400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 198136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-04-25 151552]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2007-09-05 816400]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2007-08-30 4670704]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-03-09 26100520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-11-04 22:24:09 ----D---- C:\_OTM
2010-11-04 17:57:13 ----D---- C:\Program Files\ERUNT
2010-11-04 17:46:36 ----D---- C:\rsit
2010-11-01 22:51:23 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-11-01 22:51:20 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-11-01 22:51:19 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-10-30 18:09:30 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2010-10-29 18:23:10 ----A---- C:\Windows\system32\gameux.dll
2010-10-29 18:23:00 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-10-29 18:22:59 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-10-17 15:35:30 ----D---- C:\Program Files\Windows Portable Devices
2010-10-17 15:20:26 ----A---- C:\Windows\system32\UIAnimation.dll
2010-10-17 15:20:24 ----A---- C:\Windows\system32\UIRibbonRes.dll
2010-10-17 15:20:24 ----A---- C:\Windows\system32\UIRibbon.dll
2010-10-17 15:19:34 ----A---- C:\Windows\system32\WMPhoto.dll
2010-10-17 15:19:32 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-10-17 15:19:32 ----A---- C:\Windows\system32\cdd.dll
2010-10-17 15:19:30 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2010-10-17 15:19:30 ----A---- C:\Windows\system32\d3d10warp.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\XpsRasterService.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\WindowsCodecs.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\dxdiagn.dll
2010-10-17 15:19:29 ----A---- C:\Windows\system32\d2d1.dll
2010-10-17 15:19:28 ----A---- C:\Windows\system32\XpsPrint.dll
2010-10-17 15:19:28 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2010-10-17 15:19:28 ----A---- C:\Windows\system32\OpcServices.dll
2010-10-17 15:19:28 ----A---- C:\Windows\system32\dxdiag.exe
2010-10-17 15:19:27 ----A---- C:\Windows\system32\xpsservices.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\FntCache.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\DWrite.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d11.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d10level9.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d10core.dll
2010-10-17 15:19:26 ----A---- C:\Windows\system32\d3d10_1core.dll
2010-10-17 15:19:25 ----A---- C:\Windows\system32\dxgi.dll
2010-10-17 15:19:25 ----A---- C:\Windows\system32\d3d10_1.dll
2010-10-17 15:19:25 ----A---- C:\Windows\system32\d3d10.dll
2010-10-17 15:18:23 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2010-10-17 15:18:22 ----A---- C:\Windows\system32\wpdbusenum.dll
2010-10-17 15:18:22 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2010-10-17 15:18:09 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2010-10-17 15:17:56 ----A---- C:\Windows\system32\WpdConns.dll
2010-10-17 15:17:55 ----A---- C:\Windows\system32\WpdMtpUS.dll
2010-10-17 15:17:55 ----A---- C:\Windows\system32\drivers\WpdUsb.sys
2010-10-17 15:17:46 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\wpdshext.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\WpdMtp.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\wpd_ci.dll
2010-10-17 15:17:46 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2010-10-17 15:17:45 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2010-10-17 15:17:44 ----A---- C:\Windows\system32\WPDSp.dll
2010-10-17 15:17:44 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2010-10-17 15:17:44 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2010-10-17 15:14:25 ----A---- C:\Windows\system32\oleaccrc.dll
2010-10-17 15:14:23 ----A---- C:\Windows\system32\UIAutomationCore.dll
2010-10-17 15:14:23 ----A---- C:\Windows\system32\oleacc.dll
2010-10-14 15:39:24 ----D---- C:\ProgramData\WindowsSearch
2010-10-13 12:44:55 ----D---- C:\Windows\system32\eu-ES
2010-10-13 12:44:55 ----D---- C:\Windows\system32\ca-ES
2010-10-13 12:44:54 ----D---- C:\Windows\system32\vi-VN
2010-10-12 18:44:03 ----A---- C:\Windows\system32\srvsvc.dll
2010-10-12 18:44:02 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-10-12 18:44:02 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-10-12 18:44:02 ----A---- C:\Windows\system32\drivers\srv.sys
2010-10-12 18:44:01 ----A---- C:\Windows\system32\netevent.dll
2010-10-12 18:43:54 ----A---- C:\Windows\system32\mfc40.dll
2010-10-12 18:43:53 ----A---- C:\Windows\system32\mfc40u.dll
2010-10-12 18:38:19 ----A---- C:\Windows\system32\ieframe.dll
2010-10-12 18:38:17 ----A---- C:\Windows\system32\msfeeds.dll
2010-10-12 18:38:15 ----A---- C:\Windows\system32\mshtml.dll
2010-10-12 18:38:15 ----A---- C:\Windows\system32\ieapfltr.dll
2010-10-12 18:38:14 ----A---- C:\Windows\system32\mshtmled.dll
2010-10-12 18:38:13 ----A---- C:\Windows\system32\urlmon.dll
2010-10-12 18:38:12 ----A---- C:\Windows\system32\wininet.dll
2010-10-12 18:38:11 ----A---- C:\Windows\system32\iepeers.dll
2010-10-12 18:38:11 ----A---- C:\Windows\system32\ieencode.dll
2010-10-12 18:37:55 ----A---- C:\Windows\system32\wmp.dll
2010-10-12 18:37:52 ----A---- C:\Windows\system32\wmploc.DLL
2010-10-12 18:37:12 ----A---- C:\Windows\system32\schannel.dll
2010-10-12 18:37:09 ----A---- C:\Windows\system32\ole32.dll
2010-10-12 18:37:04 ----A---- C:\Windows\system32\t2embed.dll
2010-10-12 18:13:25 ----A---- C:\Windows\system32\comctl32.dll
2010-10-12 17:41:36 ----A---- C:\Windows\system32\win32k.sys
2010-10-12 17:35:07 ----A---- C:\Windows\system32\wmpmde.dll
2010-10-12 13:37:18 ----D---- C:\Windows\system32\EventProviders

======List of files/folders modified in the last 1 months======

2010-11-04 22:34:45 ----D---- C:\Program Files\Trend Micro
2010-11-04 22:34:28 ----D---- C:\Windows\temp
2010-11-04 22:32:28 ----D---- C:\Users\Owner\AppData\Roaming\Skype
2010-11-04 22:19:47 ----D---- C:\Windows\ERDNT
2010-11-04 21:36:58 ----D---- C:\Users\Owner\AppData\Roaming\skypePM
2010-11-04 21:35:52 ----D---- C:\Windows\system32\catroot2
2010-11-04 17:57:13 ----RD---- C:\Program Files
2010-11-04 17:16:43 ----SHD---- C:\System Volume Information
2010-11-01 22:52:35 ----D---- C:\Windows\System32
2010-11-01 22:52:35 ----D---- C:\Windows\inf
2010-11-01 22:52:35 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-11-01 22:51:23 ----D---- C:\Windows\system32\drivers
2010-11-01 21:56:45 ----D---- C:\Program Files\Mozilla Firefox
2010-11-01 21:50:53 ----SHD---- C:\Windows\Installer
2010-11-01 21:50:44 ----D---- C:\Program Files\Common Files
2010-11-01 20:46:46 ----D---- C:\Windows\Logs
2010-10-30 18:09:30 ----D---- C:\ProgramData
2010-10-30 12:21:09 ----D---- C:\Windows\winsxs
2010-10-30 12:21:08 ----D---- C:\Windows\AppPatch
2010-10-29 20:11:06 ----D---- C:\Windows\pss
2010-10-29 18:42:48 ----A---- C:\Windows\ntbtlog.txt
2010-10-26 15:30:35 ----D---- C:\Windows\system32\catroot
2010-10-19 16:51:33 ----N---- C:\Windows\system32\MpSigStub.exe
2010-10-17 15:54:52 ----D---- C:\Windows\rescache
2010-10-17 15:39:57 ----D---- C:\Windows\system32\Tasks
2010-10-17 15:35:40 ----D---- C:\Windows
2010-10-17 15:35:31 ----D---- C:\Windows\system32\en-US
2010-10-17 15:35:30 ----D---- C:\Windows\system32\wbem
2010-10-17 15:35:30 ----D---- C:\Windows\system32\drivers\en-US
2010-10-17 15:35:28 ----D---- C:\Windows\system32\zh-TW
2010-10-17 15:35:28 ----D---- C:\Windows\system32\zh-HK
2010-10-17 15:35:28 ----D---- C:\Windows\system32\zh-CN
2010-10-17 15:35:28 ----D---- C:\Windows\system32\uk-UA
2010-10-17 15:35:28 ----D---- C:\Windows\system32\tr-TR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\th-TH
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sv-SE
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sr-Latn-CS
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sl-SI
2010-10-17 15:35:28 ----D---- C:\Windows\system32\sk-SK
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ru-RU
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ro-RO
2010-10-17 15:35:28 ----D---- C:\Windows\system32\pt-PT
2010-10-17 15:35:28 ----D---- C:\Windows\system32\pt-BR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\pl-PL
2010-10-17 15:35:28 ----D---- C:\Windows\system32\nl-NL
2010-10-17 15:35:28 ----D---- C:\Windows\system32\nb-NO
2010-10-17 15:35:28 ----D---- C:\Windows\system32\lv-LV
2010-10-17 15:35:28 ----D---- C:\Windows\system32\lt-LT
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ko-KR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ja-JP
2010-10-17 15:35:28 ----D---- C:\Windows\system32\it-IT
2010-10-17 15:35:28 ----D---- C:\Windows\system32\hu-HU
2010-10-17 15:35:28 ----D---- C:\Windows\system32\hr-HR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\he-IL
2010-10-17 15:35:28 ----D---- C:\Windows\system32\fr-FR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\fi-FI
2010-10-17 15:35:28 ----D---- C:\Windows\system32\et-EE
2010-10-17 15:35:28 ----D---- C:\Windows\system32\es-ES
2010-10-17 15:35:28 ----D---- C:\Windows\system32\el-GR
2010-10-17 15:35:28 ----D---- C:\Windows\system32\de-DE
2010-10-17 15:35:28 ----D---- C:\Windows\system32\da-DK
2010-10-17 15:35:28 ----D---- C:\Windows\system32\cs-CZ
2010-10-17 15:35:28 ----D---- C:\Windows\system32\bg-BG
2010-10-17 15:35:28 ----D---- C:\Windows\system32\ar-SA
2010-10-17 15:35:14 ----D---- C:\Windows\system32\drivers\UMDF
2010-10-14 16:54:40 ----D---- C:\Windows\Minidump
2010-10-14 07:31:52 ----D---- C:\Windows\Microsoft.NET
2010-10-14 07:31:50 ----RSD---- C:\Windows\assembly
2010-10-13 12:55:22 ----SHD---- C:\Boot
2010-10-13 12:45:34 ----D---- C:\Program Files\Windows Sidebar
2010-10-13 12:45:34 ----D---- C:\Program Files\Windows Mail
2010-10-13 12:45:34 ----D---- C:\Program Files\Windows Calendar
2010-10-13 12:45:34 ----D---- C:\Program Files\Movie Maker
2010-10-13 12:45:34 ----D---- C:\Program Files\Internet Explorer
2010-10-13 12:45:33 ----D---- C:\Program Files\Windows Media Player
2010-10-13 12:45:33 ----D---- C:\Program Files\Windows Journal
2010-10-13 12:45:33 ----D---- C:\Program Files\Windows Collaboration
2010-10-13 12:45:33 ----D---- C:\Program Files\Common Files\System
2010-10-13 12:45:32 ----D---- C:\Program Files\Windows Photo Gallery
2010-10-13 12:45:31 ----D---- C:\Windows\servicing
2010-10-13 12:45:31 ----D---- C:\Windows\ehome
2010-10-13 12:45:31 ----D---- C:\Program Files\Windows Defender
2010-10-13 12:45:26 ----D---- C:\Windows\IME
2010-10-13 12:45:25 ----D---- C:\Windows\system32\XPSViewer
2010-10-13 12:45:23 ----D---- C:\Windows\system32\oobe
2010-10-13 12:45:23 ----D---- C:\Windows\system32\migration
2010-10-13 12:45:21 ----D---- C:\Windows\system32\SLUI
2010-10-13 12:45:21 ----D---- C:\Windows\system32\setup
2010-10-13 12:45:21 ----D---- C:\Windows\system32\AdvancedInstallers
2010-10-13 12:45:20 ----D---- C:\Windows\system32\manifeststore
2010-10-13 12:45:20 ----D---- C:\Windows\system32\en
2010-10-13 12:45:16 ----D---- C:\Windows\system32\migwiz
2010-10-13 12:45:02 ----RSD---- C:\Windows\Fonts
2010-10-13 12:44:54 ----D---- C:\Windows\system32\Boot
2010-10-13 12:42:07 ----D---- C:\Windows\system32\RTCOM
2010-10-13 12:28:08 ----A---- C:\Windows\fonts\GlobalUserInterface.CompositeFont
2010-10-13 03:13:54 ----D---- C:\ProgramData\Microsoft Help
2010-10-13 03:04:10 ----A---- C:\Windows\system32\mrt.exe
2010-10-12 19:05:13 ----HD---- C:\Windows\system32\GroupPolicy
2010-10-12 13:52:27 ----D---- C:\Program Files\Microsoft Security Essentials

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 phylock;phylock; C:\Windows\system32\drivers\phylock.sys [2006-12-18 18848]
R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-25 20776]
R0 PSDNServ;PSDNSERVER; C:\Windows\system32\drivers\PSDNServ.sys [2007-04-25 16680]
R0 psdvdisk;psdvdisk; C:\Windows\system32\drivers\psdvdisk.sys [2007-04-25 60712]
R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 20112]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2007-05-16 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-03-22 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-05-16 8192]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-13 154624]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-06-18 737280]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2007-05-16 32256]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-05-18 26600]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-05-16 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-05-16 207360]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-05-18 1775712]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-08-07 6144]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-05-16 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-01-30 7544832]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-05-16 12032]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-02-07 1729152]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-05-16 659968]
S3 catchme;catchme; \??\C:\Users\Owner\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-09-30 40448]
S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 UIUSys;Conexant Setup API; C:\Windows\system32\DRIVERS\UIUSYS.SYS []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 ALaunchService;ALaunch Service; C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
S4 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
S4 eDataSecurity Service;eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-25 457512]
S4 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-04-23 24576]
S4 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-06-13 135168]
S4 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-07-03 53248]
S4 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-28 24576]
S4 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-09-21 545568]
S4 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
S4 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008]
S4 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-01-30 203296]
S4 tbhMonitor.exe;The Browser Highlighter Monitor; C:\Program Files\tbh\monitor\bin\tbhMonitor.exe [2009-10-22 70952]
S4 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-13 167936]
S4 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-05-16 386560]

-----------------EOF-----------------
dalitaj
November 5, 2010, 3:04 AM UTC
the performance of my system is fine overall with the exception of the crashes caused in the GMER.exe scans.

Here is your OTM log that you asked for as well


All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Assist Launcher\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Product Registration\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSet\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tbhSystray\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Owner
->Temp folder emptied: 17068594 bytes
->Temporary Internet Files folder emptied: 7969942 bytes
->Java cache emptied: 12755216 bytes
->FireFox cache emptied: 46344411 bytes
->Flash cache emptied: 157246 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 90864102 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 40135 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 167.00 mb


OTM by OldTimer - Version 3.1.17.2 log created on 11042010_222409

Files moved on Reboot...
File C:\Windows\temp\TMP00000001F8798D21BD85780E not found!

Registry entries deleted on Reboot...
Cypher Admin/Teacher
November 5, 2010, 10:04 AM UTC
Hi dalitaj.
Sorry to hear you had problems with the GMER scan, unfortunately this can happen on some systems.
We can run another scan in place of GMER so continue with the instructions below please.

Scan With RKUnHooker

  • Please Download Rootkit Unhooker Save it to your desktop.
  • Now right-click on RKUnhookerLE.exe and select "Run As Administrator" to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth, Files, Code Hooks. Uncheck the rest. then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • * This can take a while. Please be patient *.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of this log in you're next reply.
  • This log can be lengthy you may have to post it in separate replies.
  • Note: You may get the following warning - it is ok - just ignore it:
    "Rootkit Unhooker has detected a parasite inside itself!
    It is recommended to remove parasite, okay?"
dalitaj
November 6, 2010, 3:22 AM UTC
got the scanner to run that you asked me to use in that last post. here is the log. I broke it into a few parts due to the shear size of it. so here's the first part:

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6002 (Service Pack 2)
Number of processors #2
==============================================
>Drivers
==============================================
0x8BA0A000 C:\Windows\system32\DRIVERS\nvlddmkm.sys 7544832 bytes (NVIDIA Corporation, NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 179.48 )
0x8200F000 C:\Windows\system32\ntkrnlpa.exe 3903488 bytes (Microsoft Corporation, NT Kernel & System)
0x98480000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8C80F000 C:\Windows\system32\drivers\RTKVHDA.sys 1773568 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0x8D20A000 C:\Windows\system32\DRIVERS\snp2uvc.sys 1732608 bytes (-, USB2.0 PC Camera driver)
0x8760A000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver)
0x87272000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x8CA70000 C:\Windows\system32\DRIVERS\HSX_DPV.sys 1060864 bytes (Conexant Systems, Inc., HSF_DP driver)
0x8B80A000 C:\Windows\system32\DRIVERS\nvmfdx32.sys 1052672 bytes (NVIDIA Corporation, NVIDIA MCP Networking Function Driver.)
0x8740D000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver)
0x80662000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)
0x9F60E000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x8B90B000 C:\Windows\system32\DRIVERS\athr.sys 757760 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver)
0x8CC09000 C:\Windows\system32\DRIVERS\HSX_CNXT.sys 737280 bytes (Conexant Systems, Inc., HSF_CNXT driver)
0x8D088000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor)
0x8C13C000 C:\Windows\System32\drivers\dxgkrnl.sys 659456 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8B604000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x80742000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)
0x87201000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x8D18F000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x8B6EC000 C:\Windows\system32\DRIVERS\rixdptsk.sys 331776 bytes (REDC, RICOH XD SM Driver)
0x9F304000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver)
0x826B5000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8CB73000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x8260C000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)
0x80621000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)
0x8B73D000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x875C0000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8CA33000 C:\Windows\system32\DRIVERS\HSXHWAZL.sys 249856 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver)
0x8D00C000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x873A8000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem)
0x9F28B000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x8771A000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x807CB000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x823C8000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x8274D000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x8CDC0000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8B9C4000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)
0x8C9C0000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x8757D000 C:\Windows\system32\DRIVERS\Apfiltr.sys 176128 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver)
0x8737D000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x827B0000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)
0x8D148000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x9F2DC000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x87785000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)
0x82663000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x8CA0E000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0x8CCFD000 C:\Windows\system32\DRIVERS\MpFilter.sys 143360 bytes (Microsoft Corporation, Microsoft antimalware file system filter driver)
0x8B795000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x877BD000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)
0x9F24B000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0x8CD43000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x9F26C000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x8272F000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x9F200000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)
0x874F7000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x8D06D000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x8B6AF000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver)
0x9F21D000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x82798000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x9F2C4000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x8D056000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x8B77E000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x9F70A000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x8CBBB000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x8CD96000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)
0x9F236000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8B7DB000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x8B7C7000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x8B6D8000 C:\Windows\system32\DRIVERS\rimsptsk.sys 81920 bytes (REDC, RICOH MS Driver)
0x8CDAC000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)
0x87555000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)
0x8D17C000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x8CBDF000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x87543000 C:\Windows\system32\DRIVERS\enecir.sys 73728 bytes (ENE TECHNOLOGY INC., ENE Consumer IR Driver for eHome)
0x8775B000 C:\Windows\system32\drivers\psdvdisk.sys 73728 bytes (HiTRUST, PSD Virtual Disk Driver)
0x877AC000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x9F36A000 C:\Acer\Empowering Technology\eRecovery\int15.sys 69632 bytes
0x827E7000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x80608000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x87526000 C:\Windows\system32\DRIVERS\amdk8.sys 65536 bytes (Microsoft Corporation, Processor Device Driver)
0x8277F000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x8CCD5000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library)
0x8D138000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x82714000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)
0x8B691000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0x8B7F0000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)
0x8D3F1000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)
0x87776000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0x8268A000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)
0x8B7B8000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x8B6C9000 C:\Windows\system32\DRIVERS\rimmptsk.sys 61440 bytes (REDC, RICOH SD Driver)
0x873E3000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x826A6000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)
0x8B6A1000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0x986C0000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)
0x873F2000 C:\Windows\system32\DRIVERS\circlass.sys 57344 bytes (Microsoft Corporation, Consumer IR Class Driver for eHome)
0x8CBD1000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x8CD7F000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x82706000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8D3C7000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x8CCBD000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)
0x8D3B1000 C:\Windows\system32\DRIVERS\STREAM.SYS 53248 bytes (Microsoft Corporation, WDM CODEC Class Device Driver 2.0)
0x827DA000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x807BE000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0x9F6F6000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8CD37000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8C1DD000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver)
0x8D3D4000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0x8CCCA000 C:\Windows\system32\DRIVERS\hidir.sys 45056 bytes (Microsoft Corporation, Infrared Miniport Driver for Input Devices)
0x87572000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)
0x875A8000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)
0x8CD74000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x8C1F4000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8C1E9000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x87512000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8269C000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)
0x87568000 C:\Windows\system32\DRIVERS\DKbFltr.sys 40960 bytes (Dritek System Inc., Dritek PS2 Keyboard Filter Driver)
0x8D3E7000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x8B9F3000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x8D172000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x8D04C000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x9F6EC000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x875B6000 C:\Windows\system32\DRIVERS\usbohci.sys 40960 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0x877DE000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)
0x8CD20000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x8CCEC000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID Keyboard Filter Driver)
0x9F720000 C:\Windows\system32\DRIVERS\MpNWMon.sys 36864 bytes (Microsoft Corporation, Network monitor driver)
0x9F729000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0x8278F000 C:\Windows\system32\DRIVERS\psdfilter.sys 36864 bytes (HiTRUST, PSD Filter Driver)
0x8776D000 C:\Windows\system32\drivers\PSDNServ.sys 36864 bytes (HiTRUST, PSD Named Pipe Driver)
0x8CD8D000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0x986A0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x8751D000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x87536000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0x82652000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x8CDF2000 C:\Windows\system32\drivers\ws2ifsl.sys 36864 bytes (Microsoft Corporation, Winsock2 IFS Layer)
0x82727000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x80619000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8D3DF000 C:\Windows\System32\Drivers\dump_atapi.sys 32768 bytes
0x8CCF5000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0x8265B000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x8CD64000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8CD6C000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x87753000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x9F702000 C:\Windows\system32\DRIVERS\xaudio.sys 32768 bytes (Conexant Systems, Inc., Modem Audio Device Driver)
0x8CD30000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x8CCE5000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x80601000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0x8CD29000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x826FF000 C:\Windows\system32\drivers\pciide.sys 28672 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x8D3BE000 C:\Windows\system32\DRIVERS\sncduvc.SYS 28672 bytes (Microsoft Corporation, Universal Serial Bus Camera Driver)
0x87400000 C:\Windows\System32\Drivers\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x8753F000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x8D048000 C:\PROGRA~1\LAUNCH~1\DPortIO.sys 16384 bytes (Dritek System Inc., General Port I/O)
0x9F37B000 C:\Windows\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface x86 Driver)
0x82699000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0x875B3000 C:\Windows\system32\DRIVERS\nvsmu.sys 12288 bytes (NVIDIA Corporation, NVIDIA® nForce(TM) SMU Microcontroller Driver)
0x82724000 C:\Windows\system32\drivers\phylock.sys 12288 bytes (TeraByte, Inc., -)
0x87608000 C:\Windows\system32\DRIVERS\NTIDrvr.sys 8192 bytes (NewTech Infosystems, Inc., NTI CD-ROM Filter Driver)
0x8BA00000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x8D3C5000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
==============================================
>Stealth
==============================================
dalitaj
November 6, 2010, 3:25 AM UTC
PART 2:

==============================================
>Files
==============================================
!-->[Hidden] C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{67D46C07-2429-472E-91C7-3375313650CB}
!-->[Hidden] C:\Users\Owner\AppData\Roaming\Skype\dalita32\chatsync\d0\d04a3dfcfc3f96b7.dat
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Battle.net.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Blizzard Downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Blizzard Updater.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\ADB\enUS\Item-sparse.adb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\ADB\enUS\Item.adb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\ADB\enUS\KeyChain.adb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\ADB\Hotfix.tbl
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\baddons.wcf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\creaturecache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\gameobjectcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\itemtextcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\npccache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\pagetextcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\questcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\wowcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\art.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\enUS\patch-enUS-oldworld-13154.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\enUS\SoundCache-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\patch-base-oldworld-13154.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\SoundCache-0.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\SoundCache-1.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\SoundCache-2.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\SoundCache-3.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\Cache\SoundCache-patch.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\AccountBilling.url
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\backup-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\base-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\connection-help.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Credits.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Credits_BC.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Credits_CC.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Credits_LK.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Manual.pdf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Manual_TBC.pdf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Manual_WLK.pdf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\eula.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\expansion1-locale-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\expansion1-speech-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\expansion2-locale-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\expansion2-speech-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\Logo_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\Logo_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_FotLK_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_FotLK_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_BC_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_BC_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_LK_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_LK_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Wrathgate_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Wrathgate_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\locale-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\OldWorld-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\patch-enUS.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\realmlist.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\speech-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\TechSupport.url
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\tos.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\expansion1.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\expansion2.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\OldWorld.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\sound.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\world.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\wow-update-13164.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\wow-update-13205.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\wow-update-oldworld-13154.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\dbghelp.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\DBM-Icecrown.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\FrostwingHalls\FrostwingHallTrash.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\FrostwingHalls\Sindragosa.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\FrostwingHalls\Valithria.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.de.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.en.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.es.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.fr.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.kr.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.mx.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.ru.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\localization.tw.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\MapSizes.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheCrimsonHall\BPCouncil.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheCrimsonHall\CrimsonHallTrash.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheCrimsonHall\Lanathel.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheFrozenThrone\LichKing.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheLowerSpire\Deathbringer.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheLowerSpire\Deathwhisper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheLowerSpire\GunshipBattle.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheLowerSpire\LordMarrowgar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\TheLowerSpire\LowerSpireTrash.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\ThePlagueworks\Festergut.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\ThePlagueworks\PlagueworksTrash.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\ThePlagueworks\Putricide.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DBM-Icecrown\ThePlagueworks\Rotface.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DivxDecoder.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 21.57.56 Crash.dmp
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 21.57.56 Crash.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 21.58.53 Crash.dmp
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 21.58.53 Crash.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 22.11.22 Crash.dmp
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 22.11.22 Crash.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 22.16.28 Crash.dmp
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Errors\2010-10-14 22.16.28 Crash.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\ijl15.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\ActionBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\ActionBars.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\ActionButton.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\BagBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Bar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Bartender4.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Bartender4.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Bindings.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\ButtonBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Changelog-Bartender4-4.4.0.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceAddon-3.0\AceAddon-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceAddon-3.0\AceAddon-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfig-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfig-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfigCmd-3.0\AceConfigCmd-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfigCmd-3.0\AceConfigCmd-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfigDialog-3.0\AceConfigDialog-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfigDialog-3.0\AceConfigDialog-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfigRegistry-3.0\AceConfigRegistry-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConfig-3.0\AceConfigRegistry-3.0\AceConfigRegistry-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConsole-3.0\AceConsole-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceConsole-3.0\AceConsole-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceDB-3.0\AceDB-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceDB-3.0\AceDB-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceDBOptions-3.0\AceDBOptions-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceDBOptions-3.0\AceDBOptions-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceEvent-3.0\AceEvent-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceEvent-3.0\AceEvent-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\AceGUI-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\AceGUI-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-BlizOptionsGroup.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-Button.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-CheckBox.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-ColorPicker.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-DropDown-Items.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-DropDown.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-DropDownGroup.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-EditBox.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-Frame.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-Heading.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-Icon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-InlineGroup.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-InteractiveLabel.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-Keybinding.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-Label.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-MultiLineEditBox.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-ScrollFrame.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-SimpleGroup.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-Slider.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-TabGroup.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceGUI-3.0\widgets\AceGUIWidget-TreeGroup.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceHook-3.0\AceHook-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceHook-3.0\AceHook-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceLocale-3.0\AceLocale-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\AceLocale-3.0\AceLocale-3.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\CallbackHandler-1.0\CallbackHandler-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\CallbackHandler-1.0\CallbackHandler-1.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibDataBroker-1.1.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibDBIcon-1.0\LibDBIcon-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\lib.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\LibKeyBound-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-deDE.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-enUS.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-esES.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-esMX.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-frFR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-koKR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-ruRU.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-zhCN.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibKeyBound-1.0\Locale-zhTW.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibStub\LibStub.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibStub\LibStub.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\LibWindow-1.1\LibWindow-1.1.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\libs\SimpleSticky.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\Babelfish.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\deDE.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\enUS.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\esES.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\esMX.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\frFR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\koKR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\locale.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\ruRU.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\zhCN.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\locale\zhTW.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\MicroMenu.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\MultiCastBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\AceGUIWidget-NumberEditBox.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\ActionBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\BagBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\Bar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\ButtonBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\MicroMenu.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\MultiCastBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\Options.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\Options.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\PetBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\RepXPBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\StanceBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\StateBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\Options\VehicleBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\PetBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\PetButton.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\RepXPBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\StanceBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\StateBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\TODO.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Bartender4\VehicleBar.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_AchievementUI\Blizzard_AchievementUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_ArchaeologyUI\Blizzard_ArchaeologyUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_ArenaUI\Blizzard_ArenaUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_AuctionUI\Blizzard_AuctionUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_BarbershopUI\Blizzard_BarbershopUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_BattlefieldMinimap\Blizzard_BattlefieldMinimap.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_BindingUI\Blizzard_BindingUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_Calendar\Blizzard_Calendar.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_CombatLog\Blizzard_CombatLog.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_CombatText\Blizzard_CombatText.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_CompactRaidFrames\Blizzard_CompactRaidFrames.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_DebugTools\Blizzard_DebugTools.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GlyphUI\Blizzard_GlyphUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GMChatUI\Blizzard_GMChatUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GMSurveyUI\Blizzard_GMSurveyUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GuildBankUI\Blizzard_GuildBankUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GuildControlUI\Blizzard_GuildControlUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GuildUI\Blizzard_GuildUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_InspectUI\Blizzard_InspectUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_ItemSocketingUI\Blizzard_ItemSocketingUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_MacroUI\Blizzard_MacroUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_RaidUI\Blizzard_RaidUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_ReforgingUI\Blizzard_ReforgingUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TalentUI\Blizzard_TalentUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TimeManager\Blizzard_TimeManager.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TokenUI\Blizzard_TokenUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TradeSkillUI\Blizzard_TradeSkillUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TrainerUI\Blizzard_TrainerUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\BloodyRare\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\BloodyRare\BloodyRare.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\BloodyRare\BloodyRare.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\BloodyRare\localization.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\ArrowInner.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\ArrowOuter.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group1.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group2.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group3.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group4.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group5.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group6.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group7.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Group8.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\GuildInner.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\GuildOuter.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\PartyInner.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\PartyOuter.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Artwork\Portal.tga
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Bindings.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Cartographer3.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Changelog-Cartographer3-v0.11.2.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Constants.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\CorpsePOI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\embeds.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\FlagPOIs.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\GroupMembers.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\GuildMembers.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\InstanceData.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\InstancePortalPOIs.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Landmarks.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\CallbackHandler-1.0\CallbackHandler-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\CallbackHandler-1.0\CallbackHandler-1.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibBabble-Zone-3.0\lib.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibBabble-Zone-3.0\LibBabble-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibBabble-Zone-3.0\LibBabble-Zone-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibBabble-Zone-3.0\LibBabble-Zone-3.0.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibBabble-Zone-3.0\LibStub\LibStub.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuild-1.0\lib.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuild-1.0\LibGuild-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuildPositions-1.0\CallbackHandler-1.0\CallbackHandler-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuildPositions-1.0\CallbackHandler-1.0\CallbackHandler-1.0.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuildPositions-1.0\lib.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuildPositions-1.0\LibGuildPositions-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuildPositions-1.0\LibGuildPositions-1.0.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibGuildPositions-1.0\LibStub\LibStub.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibSimpleOptions-1.0\lib.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibSimpleOptions-1.0\LibSimpleOptions-1.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibSimpleOptions-1.0\LibSimpleOptions-1.0.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibSimpleOptions-1.0\LibStub\LibStub.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibStub\LibStub.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibStub\LibStub.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibTourist-3.0\lib.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibTourist-3.0\LibStub\LibStub.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibTourist-3.0\LibTourist-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibTourist-3.0\LibTourist-3.0.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\libs\LibTourist-3.0\LICENSE.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\Base.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\deDE.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\enUS.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\esES.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\frFR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\koKR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\load.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\ruRU.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\zhCN.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Localization\zhTW.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Main.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\modules.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Options.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\OverlayData.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\PlayerArrow.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Scripts\get_wmos.py
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Scripts\pack.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Scripts\world.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\TextureData.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3\Utils.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\Cartographer3_InstancePOIs.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\Data.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\deDE.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\embeds.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\esES.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\frFR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\InstancePOIs.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\InstancePOIs.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\koKR.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\libs\LibBabble-Boss-3.0\lib.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\libs\LibBabble-Boss-3.0\LibBabble-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\libs\LibBabble-Boss-3.0\LibBabble-Boss-3.0.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\libs\LibBabble-Boss-3.0\LibBabble-Boss-3.0.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\libs\LibBabble-Boss-3.0\LibStub\LibStub.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\localization.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\ruRU.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\zhCN.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_InstancePOIs\zhTW.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_Notes\Cartographer3_Notes.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_Notes\Notes.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_Notes\Notes.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_Waypoints\Arrow.blp
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_Waypoints\Cartographer3_Waypoints.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_Waypoints\Waypoints.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Cartographer3_Waypoints\Waypoints.xml
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\Changelog-CurseProfiler-v47.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\CurseProfiler.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\CurseProfiler.toc
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\data.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\GameObjects.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\NPCs.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\PlayerProfile.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\Quests.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\CurseProfiler\test.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Launcher.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\3.3.X to 4.0.XWLK Install Log.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Blizzard Updater Log.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\connection.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\cpu.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Downloader Termination.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Downloader.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\FrameXML.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\gx.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Launcher.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\repair-on-demand.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Repair.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Sound.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Microsoft.VC80.CRT.manifest
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\msvcr80.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Patch.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Repair.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Scan.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_020410_002534.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_060910_124133.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Temp\Logs\Downloader.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Temp\wow-4.0.0.1807-to-4.0.0.1979-enUS-tools-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Temp\wow-4.0.0.1807-to-4.0.0.1979-enUS-tools-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Temp\wow-patch.mpq
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\unicows.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\Installer Tome.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-12911-13164-Win-final.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-13164-13205-Win-final.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-3.3.0.10958-4.0.0.12911-NA-Stage-1
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-3.3.0.10958-4.0.0.12911-NA-Stage-2
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-3.3.0.10958-4.0.0.12911-NA-Stage-3
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Info.plist
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\MacOS\Installer
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\PkgInfo
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Alert.icns
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\CD.icns
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\English.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\en_GB.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Error.png
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\French.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\German.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Icon.icns
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\InstallerMainWindow.nib
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Italian.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Japanese.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\ko.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\listfile
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Message.png
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Polish.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Portugese.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Russian.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\signature
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\SkinUpdater.mpq
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Spanish.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\Warning.png
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\zh_CN.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.app\Contents\Resources\zh_TW.lproj\Localizable.strings
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\WoW-x.x.x.x-4.0.0.12911-Updater.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Wow - Shortcut (2).lnk
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Wow - Shortcut.lnk
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\wow-2.1.1.1897-enUS-tools-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\wow-2.1.1.1897-enUS-tools-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.10958-to-3.3.0.11159-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.10958-to-3.3.0.11159-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.11159-to-3.3.2.11403-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.11159-to-3.3.2.11403-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.2.11403-to-3.3.3.11685-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.3.11685-to-3.3.3.11723-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.3.11685-to-3.3.3.11723-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.3.11723-to-3.3.5.12213-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.3.11723-to-3.3.5.12213-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.5.12213-to-3.3.5.12340-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.5.12213-to-3.3.5.12340-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.5.12340-x86-Win-enUS-BKGND-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\wow-4.0.0.1807-to-4.0.0.1987-enUS-tools-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\wow-4.0.0.1807-to-4.0.0.1987-enUS-tools-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\wow-patch.mpq
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Wow.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW.mfil
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW.tfil
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WowError.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\SavedVariables\Blizzard_CombatLog.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\Shattered Halls\Felo\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\Shattered Halls\Felo\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\Shattered Halls\Felo\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\Shattered Halls\Felo\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\Shattered Halls\Felo\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\Shattered Halls\Felo\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\APOCDARKSUN\Shattered Halls\Felo\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Habbe\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Habbe\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Habbe\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Habbe\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Habbe\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Habbe\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Habbe\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Hvjhdgdfb\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Hvjhdgdfb\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Hvjhdgdfb\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Hvjhdgdfb\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Hvjhdgdfb\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Hvjhdgdfb\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Hvjhdgdfb\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Onlyblackguy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Revÿ\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Revÿ\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Revÿ\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Revÿ\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Revÿ\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Revÿ\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Revÿ\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Rëvy\SavedVariables\BloodyRare.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shershomaru\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\BloodyRare.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Shàdów\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Srgdr\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Srgdr\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Srgdr\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Srgdr\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Srgdr\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Srgdr\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Arthas\Srgdr\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Blackrock\Shädôw\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Lådydeath\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Rëvy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Rëvy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Rëvy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Rëvy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Rëvy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Rëvy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Cairne\Rëvy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\config-cache.oldsynchronizeConfig
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\BloodyRare.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Neyttiri\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Dalaran\Revy\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Reviy\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Revý\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\Bagnon.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Rëvy\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Demon Soul\Syaa\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Neyttiri\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Nëytiri\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Rgdfdb\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Rgdfdb\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Rgdfdb\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Rgdfdb\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Rgdfdb\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Rgdfdb\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Rgdfdb\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\BloodyRare.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Durotan\Sya\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Edaa\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamamama\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Mamamme\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\Bagnon.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\BloodyRare.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lethon\Sayaa\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Fainttsmile\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghdth\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghdth\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghdth\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghdth\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghdth\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghdth\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghdth\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghhdvsfg\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghhdvsfg\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghhdvsfg\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghhdvsfg\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghhdvsfg\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghhdvsfg\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Ghhdvsfg\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Kissmyahh\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Kissmyahh\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Kissmyahh\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Kissmyahh\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Kissmyahh\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Kissmyahh\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Kissmyahh\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Nëytiri\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rêvy\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Rëvy\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Serteu\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Serteu\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Serteu\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Serteu\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Serteu\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Serteu\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Serteu\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syaa\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syä\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syä\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syä\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syä\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syä\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syä\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Lightbringer\Syä\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\macros-cache.txt
dalitaj
November 6, 2010, 3:26 AM UTC
Part 3:


!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Magtheridon\Revyy\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Bagnon.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Bagnon_Forever.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Bagnon_Forever.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Bartender4.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Bartender4.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Blizzard_CombatLog.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Blizzard_CombatLog.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Cartographer3.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\Cartographer3.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\CurseProfiler.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\CurseProfiler.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\RareSpawnOverlay.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\RareSpawnOverlay.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\SilverDragon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\SilverDragon.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fenrall\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fgtete\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fgtete\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fgtete\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fgtete\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fgtete\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Fgtete\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Jscgl\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Kissmyoops\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Kissmyoops\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Kissmyoops\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Kissmyoops\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Kissmyoops\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Kissmyoops\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Nëytiri\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revii\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Reviy\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revvy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revvy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revvy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revvy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revvy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revvy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revyha\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revyha\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revyha\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revyha\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revyha\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revyha\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revý\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Revÿ\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Rêvy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Rêvy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Rêvy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Rêvy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Rêvy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Rêvy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sayaa\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Shàdów\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Siugfwbcu\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Siugfwbcu\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Siugfwbcu\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Siugfwbcu\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Siugfwbcu\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Siugfwbcu\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Starrzz\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Starrzz\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Starrzz\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Starrzz\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Starrzz\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Starrzz\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Starrzz\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\Bagnon.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syaa\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Sya\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\BloodyRare.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Shattered Halls\Syã\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Ysera\Syaa\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Gottapee\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Gottapee\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Gottapee\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Gottapee\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Gottapee\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Gottapee\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Gottapee\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Luccy\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Peepeepeepee\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Peepeepeepee\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Peepeepeepee\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Peepeepeepee\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Peepeepeepee\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Peepeepeepee\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Peepeepeepee\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reevi\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables\Bagnon.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Reviy\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Revyi\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sdhierhpiwru\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sdhierhpiwru\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sdhierhpiwru\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sdhierhpiwru\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sdhierhpiwru\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sdhierhpiwru\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sdhierhpiwru\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DALITA\Zuluhed\Sya\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\config-cache.oldsynchronizeConfig
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables\Bartender4.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables\Blizzard_CombatLog.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables\Blizzard_CombatLog.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables\RareSpawnOverlay.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Demonkingg\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Demonkingg\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Demonkingg\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Demonkingg\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Demonkingg\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Demonkingg\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DANASMITHJR\Shattered Halls\Shãdòw\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Cumme\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Syaa\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Vaelabing\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\AddOns.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\BloodyRare.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\BloodyRare.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Durotan\Xaatre\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Bagnon_Forever.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Bartender4.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Bartender4.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Blizzard_CombatLog.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Blizzard_CombatLog.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Cartographer3.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\Cartographer3.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\CurseProfiler.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\CurseProfiler.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\QuestHelper.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\RareSpawnOverlay.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\RareSpawnOverlay.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\SilverDragon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\SilverDragon.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\_NPCScan.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\SavedVariables\_NPCScan.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Itsmesya\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Itsmesya\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Itsmesya\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Itsmesya\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Itsmesya\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Itsmesya\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\SavedVariables\Bagnon.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\ZACKSHARK\Shattered Halls\Opasiatwo\SavedVariables\QuestHelper.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Config.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Launcher.WTF
dalitaj
November 6, 2010, 3:26 AM UTC
Part 4:

==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x000A87AA, Type: Inline - RelativeJump 0x820B77AA-->820B77B1 [ntkrnlpa.exe]
ntkrnlpa.exe-->AlpcGetHeaderSize, Type: EAT modification 0x8230E1A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->AlpcGetMessageAttribute, Type: EAT modification 0x8230E1A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->AlpcInitializeMessageAttribute, Type: EAT modification 0x8230E1A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->atoi, Type: EAT modification 0x8230FDF4-->8265F067 [msisadrv.sys]
ntkrnlpa.exe-->atol, Type: EAT modification 0x8230FDF8-->822EF072 [ntkrnlpa.exe]
ntkrnlpa.exe-->bsearch, Type: EAT modification 0x8230FDFC-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->CcCanIWrite, Type: EAT modification 0x8230E1AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcCopyRead, Type: EAT modification 0x8230E1B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcCopyWrite, Type: EAT modification 0x8230E1B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcDeferWrite, Type: EAT modification 0x8230E1B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcFastCopyRead, Type: EAT modification 0x8230E1BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcFastCopyWrite, Type: EAT modification 0x8230E1C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcFastMdlReadWait, Type: EAT modification 0x8230E1C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcFlushCache, Type: EAT modification 0x8230E1C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcGetDirtyPages, Type: EAT modification 0x8230E1CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcGetFileObjectFromBcb, Type: EAT modification 0x8230E1D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcGetFileObjectFromSectionPtrs, Type: EAT modification 0x8230E1D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcGetFileObjectFromSectionPtrsRef, Type: EAT modification 0x8230E1D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcGetFlushedValidData, Type: EAT modification 0x8230E1DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcGetLsnForFileObject, Type: EAT modification 0x8230E1E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcInitializeCacheMap, Type: EAT modification 0x8230E1E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcIsThereDirtyData, Type: EAT modification 0x8230E1E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcIsThereDirtyDataEx, Type: EAT modification 0x8230E1EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcMapData, Type: EAT modification 0x8230E1F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcMdlRead, Type: EAT modification 0x8230E1F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcMdlReadComplete, Type: EAT modification 0x8230E1F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcMdlWriteAbort, Type: EAT modification 0x8230E1FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcMdlWriteComplete, Type: EAT modification 0x8230E200-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcPinMappedData, Type: EAT modification 0x8230E204-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcPinRead, Type: EAT modification 0x8230E208-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcPrepareMdlWrite, Type: EAT modification 0x8230E20C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcPreparePinWrite, Type: EAT modification 0x8230E210-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcPurgeCacheSection, Type: EAT modification 0x8230E214-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcRemapBcb, Type: EAT modification 0x8230E218-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcRepinBcb, Type: EAT modification 0x8230E21C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcScheduleReadAhead, Type: EAT modification 0x8230E220-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetAdditionalCacheAttributes, Type: EAT modification 0x8230E224-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetBcbOwnerPointer, Type: EAT modification 0x8230E228-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetDirtyPageThreshold, Type: EAT modification 0x8230E22C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetDirtyPinnedData, Type: EAT modification 0x8230E230-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetFileSizes, Type: EAT modification 0x8230E234-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetFileSizesEx, Type: EAT modification 0x8230E238-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetLogHandleForFile, Type: EAT modification 0x8230E23C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetParallelFlushFile, Type: EAT modification 0x8230E240-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcSetReadAheadGranularity, Type: EAT modification 0x8230E244-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcTestControl, Type: EAT modification 0x8230E248-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcUninitializeCacheMap, Type: EAT modification 0x8230E24C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcUnpinData, Type: EAT modification 0x8230E250-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcUnpinDataForThread, Type: EAT modification 0x8230E254-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcUnpinRepinnedBcb, Type: EAT modification 0x8230E258-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcWaitForCurrentLazyWriterActivity, Type: EAT modification 0x8230E25C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CcZeroData, Type: EAT modification 0x8230E260-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CmCallbackGetKeyObjectID, Type: EAT modification 0x8230E264-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CmGetBoundTransaction, Type: EAT modification 0x8230E268-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CmGetCallbackVersion, Type: EAT modification 0x8230E26C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CmRegisterCallback, Type: EAT modification 0x8230E270-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CmRegisterCallbackEx, Type: EAT modification 0x8230E274-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CmSetCallbackObjectContext, Type: EAT modification 0x8230E278-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->CmUnRegisterCallback, Type: EAT modification 0x8230E27C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgBreakPoint, Type: EAT modification 0x8230E280-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgBreakPointWithStatus, Type: EAT modification 0x8230E284-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgCommandString, Type: EAT modification 0x8230E288-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgLoadImageSymbols, Type: EAT modification 0x8230E28C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgPrint, Type: EAT modification 0x8230E290-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgPrintEx, Type: EAT modification 0x8230E294-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgPrintReturnControlC, Type: EAT modification 0x8230E298-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgPrompt, Type: EAT modification 0x8230E29C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgQueryDebugFilterState, Type: EAT modification 0x8230E2A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgSetDebugFilterState, Type: EAT modification 0x8230E2A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->DbgSetDebugPrintCallback, Type: EAT modification 0x8230E2A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmClientQueryRuleState, Type: EAT modification 0x8230E2AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmClientRuleDeregisterNotification, Type: EAT modification 0x8230E2B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmClientRuleEvaluate, Type: EAT modification 0x8230E2B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmClientRuleRegisterNotification, Type: EAT modification 0x8230E2B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmpProviderRegister, Type: EAT modification 0x8230E2CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmProviderDeregister, Type: EAT modification 0x8230E2BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmProviderDeregisterEntry, Type: EAT modification 0x8230E2C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmProviderRegister, Type: EAT modification 0x8230E2C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EmProviderRegisterEntry, Type: EAT modification 0x8230E2C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwActivityIdControl, Type: EAT modification 0x8230E2D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwEnableTrace, Type: EAT modification 0x8230E2D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwEventEnabled, Type: EAT modification 0x8230E2D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwProviderEnabled, Type: EAT modification 0x8230E2DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwRegister, Type: EAT modification 0x8230E2E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwRegisterClassicProvider, Type: EAT modification 0x8230E2E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwSendTraceBuffer, Type: EAT modification 0x8230E2E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwUnregister, Type: EAT modification 0x8230E2EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwWrite, Type: EAT modification 0x8230E2F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwWriteEndScenario, Type: EAT modification 0x8230E2F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwWriteStartScenario, Type: EAT modification 0x8230E2F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwWriteString, Type: EAT modification 0x8230E2FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->EtwWriteTransfer, Type: EAT modification 0x8230E300-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireCacheAwarePushLockExclusive, Type: EAT modification 0x8230E304-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireFastMutexUnsafe, Type: EAT modification 0x8230E028-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireResourceExclusiveLite, Type: EAT modification 0x8230E308-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireResourceSharedLite, Type: EAT modification 0x8230E30C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireRundownProtection, Type: EAT modification 0x8230E02C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireRundownProtectionCacheAware, Type: EAT modification 0x8230E030-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireRundownProtectionCacheAwareEx, Type: EAT modification 0x8230E034-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireRundownProtectionEx, Type: EAT modification 0x8230E038-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireSharedStarveExclusive, Type: EAT modification 0x8230E310-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireSharedWaitForExclusive, Type: EAT modification 0x8230E314-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireSpinLockExclusive, Type: EAT modification 0x8230E318-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireSpinLockExclusiveAtDpcLevel, Type: EAT modification 0x8230E31C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireSpinLockShared, Type: EAT modification 0x8230E320-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAcquireSpinLockSharedAtDpcLevel, Type: EAT modification 0x8230E324-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocateCacheAwarePushLock, Type: EAT modification 0x8230E328-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocateCacheAwareRundownProtection, Type: EAT modification 0x8230E32C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocateFromPagedLookasideList, Type: EAT modification 0x8230E330-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocatePool, Type: EAT modification 0x8230E334-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocatePoolWithQuota, Type: EAT modification 0x8230E338-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocatePoolWithQuotaTag, Type: EAT modification 0x8230E33C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocatePoolWithTag, Type: EAT modification 0x8230E340-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExAllocatePoolWithTagPriority, Type: EAT modification 0x8230E344-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExConvertExclusiveToSharedLite, Type: EAT modification 0x8230E348-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExCreateCallback, Type: EAT modification 0x8230E34C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExDeleteLookasideListEx, Type: EAT modification 0x8230E350-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExDeleteNPagedLookasideList, Type: EAT modification 0x8230E354-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExDeletePagedLookasideList, Type: EAT modification 0x8230E358-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExDeleteResourceLite, Type: EAT modification 0x8230E35C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExDesktopObjectType, Type: EAT modification 0x8230E360-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExDisableResourceBoostLite, Type: EAT modification 0x8230E364-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEnterCriticalRegionAndAcquireFastMutexUnsafe, Type: EAT modification 0x8230E03C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEnterCriticalRegionAndAcquireResourceExclusive, Type: EAT modification 0x8230E368-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEnterCriticalRegionAndAcquireResourceShared, Type: EAT modification 0x8230E36C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEnterCriticalRegionAndAcquireSharedWaitForExclusive, Type: EAT modification 0x8230E370-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEnterPriorityRegionAndAcquireResourceExclusive, Type: EAT modification 0x8230E374-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEnterPriorityRegionAndAcquireResourceShared, Type: EAT modification 0x8230E378-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEnumHandleTable, Type: EAT modification 0x8230E37C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExEventObjectType, Type: EAT modification 0x8230E380-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExExtendZone, Type: EAT modification 0x8230E384-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfAcquirePushLockExclusive, Type: EAT modification 0x8230E094-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfAcquirePushLockShared, Type: EAT modification 0x8230E098-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExFetchLicenseData, Type: EAT modification 0x8230E388-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Exfi386InterlockedDecrementLong, Type: EAT modification 0x8230E0D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Exfi386InterlockedExchangeUlong, Type: EAT modification 0x8230E0D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Exfi386InterlockedIncrementLong, Type: EAT modification 0x8230E0D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfInterlockedAddUlong, Type: EAT modification 0x8230E09C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfInterlockedCompareExchange64, Type: EAT modification 0x8230E0A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfInterlockedInsertHeadList, Type: EAT modification 0x8230E0A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfInterlockedInsertTailList, Type: EAT modification 0x8230E0A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfInterlockedPopEntryList, Type: EAT modification 0x8230E0AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfInterlockedPushEntryList, Type: EAT modification 0x8230E0B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfInterlockedRemoveHeadList, Type: EAT modification 0x8230E0B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExFlushLookasideListEx, Type: EAT modification 0x8230E38C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExFreeCacheAwarePushLock, Type: EAT modification 0x8230E390-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExFreeCacheAwareRundownProtection, Type: EAT modification 0x8230E394-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExFreePool, Type: EAT modification 0x8230E398-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExFreePoolWithTag, Type: EAT modification 0x8230E39C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExFreeToPagedLookasideList, Type: EAT modification 0x8230E3A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfReleasePushLock, Type: EAT modification 0x8230E0B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfReleasePushLockExclusive, Type: EAT modification 0x8230E0BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfReleasePushLockShared, Type: EAT modification 0x8230E0C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfTryAcquirePushLockShared, Type: EAT modification 0x8230E0C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfTryToWakePushLock, Type: EAT modification 0x8230E0C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExfUnblockPushLock, Type: EAT modification 0x8230E0CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExGetCurrentProcessorCounts, Type: EAT modification 0x8230E3A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExGetCurrentProcessorCpuUsage, Type: EAT modification 0x8230E3A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExGetExclusiveWaiterCount, Type: EAT modification 0x8230E3AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExGetLicenseTamperState, Type: EAT modification 0x8230E3B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExGetPreviousMode, Type: EAT modification 0x8230E3B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExGetSharedWaiterCount, Type: EAT modification 0x8230E3B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Exi386InterlockedDecrementLong, Type: EAT modification 0x8230E488-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Exi386InterlockedExchangeUlong, Type: EAT modification 0x8230E48C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Exi386InterlockedIncrementLong, Type: EAT modification 0x8230E490-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExiAcquireFastMutex, Type: EAT modification 0x8230E0DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializeLookasideListEx, Type: EAT modification 0x8230E3BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializeNPagedLookasideList, Type: EAT modification 0x8230E3C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializePagedLookasideList, Type: EAT modification 0x8230E3C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializePushLock, Type: EAT modification 0x8230E3C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializeResourceLite, Type: EAT modification 0x8230E3CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializeRundownProtection, Type: EAT modification 0x8230E040-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializeRundownProtectionCacheAware, Type: EAT modification 0x8230E3D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInitializeZone, Type: EAT modification 0x8230E3D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedAddLargeInteger, Type: EAT modification 0x8230E3D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedAddLargeStatistic, Type: EAT modification 0x8230E044-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedAddUlong, Type: EAT modification 0x8230E3DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedCompareExchange64, Type: EAT modification 0x8230E048-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedDecrementLong, Type: EAT modification 0x8230E3E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedExchangeUlong, Type: EAT modification 0x8230E3E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedExtendZone, Type: EAT modification 0x8230E3E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedFlushSList, Type: EAT modification 0x8230E04C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedIncrementLong, Type: EAT modification 0x8230E3EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedInsertHeadList, Type: EAT modification 0x8230E3F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedInsertTailList, Type: EAT modification 0x8230E3F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedPopEntryList, Type: EAT modification 0x8230E3F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedPopEntrySList, Type: EAT modification 0x8230E050-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedPushEntryList, Type: EAT modification 0x8230E3FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedPushEntrySList, Type: EAT modification 0x8230E054-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExInterlockedRemoveHeadList, Type: EAT modification 0x8230E400-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExiReleaseFastMutex, Type: EAT modification 0x8230E0E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExIsProcessorFeaturePresent, Type: EAT modification 0x8230E404-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExIsResourceAcquiredExclusiveLite, Type: EAT modification 0x8230E408-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExIsResourceAcquiredSharedLite, Type: EAT modification 0x8230E40C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExiTryToAcquireFastMutex, Type: EAT modification 0x8230E0E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExLocalTimeToSystemTime, Type: EAT modification 0x8230E410-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExNotifyCallback, Type: EAT modification 0x8230E414-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExQueryPoolBlockSize, Type: EAT modification 0x8230E418-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExQueueWorkItem, Type: EAT modification 0x8230E41C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRaiseAccessViolation, Type: EAT modification 0x8230E420-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRaiseDatatypeMisalignment, Type: EAT modification 0x8230E424-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRaiseException, Type: EAT modification 0x8230E428-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRaiseHardError, Type: EAT modification 0x8230E42C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRaiseStatus, Type: EAT modification 0x8230E430-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRegisterCallback, Type: EAT modification 0x8230E434-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReinitializeResourceLite, Type: EAT modification 0x8230E438-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReInitializeRundownProtection, Type: EAT modification 0x8230E058-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReInitializeRundownProtectionCacheAware, Type: EAT modification 0x8230E05C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseCacheAwarePushLockExclusive, Type: EAT modification 0x8230E43C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseFastMutexUnsafe, Type: EAT modification 0x8230E060-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseFastMutexUnsafeAndLeaveCriticalRegion, Type: EAT modification 0x8230E064-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseResourceAndLeaveCriticalRegion, Type: EAT modification 0x8230E068-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseResourceAndLeavePriorityRegion, Type: EAT modification 0x8230E06C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseResourceForThreadLite, Type: EAT modification 0x8230E440-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseResourceLite, Type: EAT modification 0x8230E070-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseRundownProtection, Type: EAT modification 0x8230E074-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseRundownProtectionCacheAware, Type: EAT modification 0x8230E078-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseRundownProtectionCacheAwareEx, Type: EAT modification 0x8230E07C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseRundownProtectionEx, Type: EAT modification 0x8230E080-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseSpinLockExclusive, Type: EAT modification 0x8230E444-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseSpinLockExclusiveFromDpcLevel, Type: EAT modification 0x8230E448-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseSpinLockShared, Type: EAT modification 0x8230E44C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExReleaseSpinLockSharedFromDpcLevel, Type: EAT modification 0x8230E450-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRundownCompleted, Type: EAT modification 0x8230E084-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExRundownCompletedCacheAware, Type: EAT modification 0x8230E088-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExSemaphoreObjectType, Type: EAT modification 0x8230E454-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExSetLicenseTamperState, Type: EAT modification 0x8230E458-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExSetResourceOwnerPointer, Type: EAT modification 0x8230E45C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExSetTimerResolution, Type: EAT modification 0x8230E460-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExSizeOfRundownProtectionCacheAware, Type: EAT modification 0x8230E464-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExSystemExceptionFilter, Type: EAT modification 0x8230E468-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExSystemTimeToLocalTime, Type: EAT modification 0x8230E46C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExTryConvertSharedSpinLockExclusive, Type: EAT modification 0x8230E470-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExUnregisterCallback, Type: EAT modification 0x8230E474-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExUpdateLicenseData, Type: EAT modification 0x8230E478-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExUuidCreate, Type: EAT modification 0x8230E47C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExVerifySuite, Type: EAT modification 0x8230E480-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExWaitForRundownProtectionRelease, Type: EAT modification 0x8230E08C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExWaitForRundownProtectionReleaseCacheAware, Type: EAT modification 0x8230E090-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ExWindowStationObjectType, Type: EAT modification 0x8230E484-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FirstEntrySList, Type: EAT modification 0x8230E494-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAcknowledgeEcp, Type: EAT modification 0x8230E498-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAcquireFileExclusive, Type: EAT modification 0x8230E49C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAddBaseMcbEntry, Type: EAT modification 0x8230E4A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAddBaseMcbEntryEx, Type: EAT modification 0x8230E4A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAddLargeMcbEntry, Type: EAT modification 0x8230E4A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAddMcbEntry, Type: EAT modification 0x8230E4AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAddToTunnelCache, Type: EAT modification 0x8230E4B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocateExtraCreateParameter, Type: EAT modification 0x8230E4B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocateExtraCreateParameterFromLookasideList, Type: EAT modification 0x8230E4B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocateExtraCreateParameterList, Type: EAT modification 0x8230E4BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocateFileLock, Type: EAT modification 0x8230E4C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocatePool, Type: EAT modification 0x8230E4C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocatePoolWithQuota, Type: EAT modification 0x8230E4C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocatePoolWithQuotaTag, Type: EAT modification 0x8230E4CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocatePoolWithTag, Type: EAT modification 0x8230E4D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAllocateResource, Type: EAT modification 0x8230E4D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAreNamesEqual, Type: EAT modification 0x8230E4D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlAreVolumeStartupApplicationsComplete, Type: EAT modification 0x8230E4DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlBalanceReads, Type: EAT modification 0x8230E4E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCancellableWaitForMultipleObjects, Type: EAT modification 0x8230E4E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCancellableWaitForSingleObject, Type: EAT modification 0x8230E4E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlChangeBackingFileObject, Type: EAT modification 0x8230E4EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCheckLockForReadAccess, Type: EAT modification 0x8230E4F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCheckLockForWriteAccess, Type: EAT modification 0x8230E4F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCheckOplock, Type: EAT modification 0x8230E4F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCheckOplockEx, Type: EAT modification 0x8230E4FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCopyRead, Type: EAT modification 0x8230E500-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCopyWrite, Type: EAT modification 0x8230E504-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCreateSectionForDataScan, Type: EAT modification 0x8230E508-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCurrentBatchOplock, Type: EAT modification 0x8230E50C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlCurrentOplock, Type: EAT modification 0x8230E510-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDeleteExtraCreateParameterLookasideList, Type: EAT modification 0x8230E514-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDeleteKeyFromTunnelCache, Type: EAT modification 0x8230E518-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDeleteTunnelCache, Type: EAT modification 0x8230E51C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDeregisterUncProvider, Type: EAT modification 0x8230E520-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDissectDbcs, Type: EAT modification 0x8230E524-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDissectName, Type: EAT modification 0x8230E528-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDoesDbcsContainWildCards, Type: EAT modification 0x8230E52C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlDoesNameContainWildCards, Type: EAT modification 0x8230E530-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFastCheckLockForRead, Type: EAT modification 0x8230E534-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFastCheckLockForWrite, Type: EAT modification 0x8230E538-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFastUnlockAll, Type: EAT modification 0x8230E53C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFastUnlockAllByKey, Type: EAT modification 0x8230E540-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFastUnlockSingle, Type: EAT modification 0x8230E544-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFindExtraCreateParameter, Type: EAT modification 0x8230E548-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFindInTunnelCache, Type: EAT modification 0x8230E54C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFreeExtraCreateParameter, Type: EAT modification 0x8230E550-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFreeExtraCreateParameterList, Type: EAT modification 0x8230E554-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlFreeFileLock, Type: EAT modification 0x8230E558-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlGetEcpListFromIrp, Type: EAT modification 0x8230E55C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlGetFileSize, Type: EAT modification 0x8230E560-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlGetNextBaseMcbEntry, Type: EAT modification 0x8230E564-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlGetNextExtraCreateParameter, Type: EAT modification 0x8230E568-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlGetNextFileLock, Type: EAT modification 0x8230E56C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlGetNextLargeMcbEntry, Type: EAT modification 0x8230E570-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlGetNextMcbEntry, Type: EAT modification 0x8230E574-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIncrementCcFastMdlReadWait, Type: EAT modification 0x8230E578-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIncrementCcFastReadNotPossible, Type: EAT modification 0x8230E580-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIncrementCcFastReadNoWait, Type: EAT modification 0x8230E57C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIncrementCcFastReadResourceMiss, Type: EAT modification 0x8230E584-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIncrementCcFastReadWait, Type: EAT modification 0x8230E588-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitExtraCreateParameterLookasideList, Type: EAT modification 0x8230E58C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitializeBaseMcb, Type: EAT modification 0x8230E590-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitializeBaseMcbEx, Type: EAT modification 0x8230E594-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitializeFileLock, Type: EAT modification 0x8230E598-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitializeLargeMcb, Type: EAT modification 0x8230E59C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitializeMcb, Type: EAT modification 0x8230E5A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitializeOplock, Type: EAT modification 0x8230E5A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInitializeTunnelCache, Type: EAT modification 0x8230E5A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInsertExtraCreateParameter, Type: EAT modification 0x8230E5AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInsertPerFileContext, Type: EAT modification 0x8230E5B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInsertPerFileObjectContext, Type: EAT modification 0x8230E5B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlInsertPerStreamContext, Type: EAT modification 0x8230E5B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsDbcsInExpression, Type: EAT modification 0x8230E5BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsEcpAcknowledged, Type: EAT modification 0x8230E5C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsEcpFromUserMode, Type: EAT modification 0x8230E5C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsFatDbcsLegal, Type: EAT modification 0x8230E5C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsHpfsDbcsLegal, Type: EAT modification 0x8230E5CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsNameInExpression, Type: EAT modification 0x8230E5D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsNtstatusExpected, Type: EAT modification 0x8230E5D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsPagingFile, Type: EAT modification 0x8230E5D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlIsTotalDeviceFailure, Type: EAT modification 0x8230E5DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLegalAnsiCharacterArray, Type: EAT modification 0x8230E5E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLogCcFlushError, Type: EAT modification 0x8230E5E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupBaseMcbEntry, Type: EAT modification 0x8230E5E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupLargeMcbEntry, Type: EAT modification 0x8230E5EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupLastBaseMcbEntry, Type: EAT modification 0x8230E5F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupLastBaseMcbEntryAndIndex, Type: EAT modification 0x8230E5F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupLastLargeMcbEntry, Type: EAT modification 0x8230E5F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupLastLargeMcbEntryAndIndex, Type: EAT modification 0x8230E5FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupLastMcbEntry, Type: EAT modification 0x8230E600-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupMcbEntry, Type: EAT modification 0x8230E604-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupPerFileContext, Type: EAT modification 0x8230E608-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupPerFileObjectContext, Type: EAT modification 0x8230E60C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlLookupPerStreamContextInternal, Type: EAT modification 0x8230E610-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMdlRead, Type: EAT modification 0x8230E614-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMdlReadComplete, Type: EAT modification 0x8230E618-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMdlReadCompleteDev, Type: EAT modification 0x8230E61C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMdlReadDev, Type: EAT modification 0x8230E620-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMdlWriteComplete, Type: EAT modification 0x8230E624-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMdlWriteCompleteDev, Type: EAT modification 0x8230E628-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMupGetProviderIdFromName, Type: EAT modification 0x8230E62C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlMupGetProviderInfoFromFileObject, Type: EAT modification 0x8230E630-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNormalizeNtstatus, Type: EAT modification 0x8230E634-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyChangeDirectory, Type: EAT modification 0x8230E638-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyCleanup, Type: EAT modification 0x8230E63C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyCleanupAll, Type: EAT modification 0x8230E640-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyFilterChangeDirectory, Type: EAT modification 0x8230E644-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyFilterReportChange, Type: EAT modification 0x8230E648-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyFullChangeDirectory, Type: EAT modification 0x8230E64C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyFullReportChange, Type: EAT modification 0x8230E650-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyInitializeSync, Type: EAT modification 0x8230E654-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyReportChange, Type: EAT modification 0x8230E658-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyUninitializeSync, Type: EAT modification 0x8230E65C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyVolumeEvent, Type: EAT modification 0x8230E660-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNotifyVolumeEventEx, Type: EAT modification 0x8230E664-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNumberOfRunsInBaseMcb, Type: EAT modification 0x8230E668-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNumberOfRunsInLargeMcb, Type: EAT modification 0x8230E66C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlNumberOfRunsInMcb, Type: EAT modification 0x8230E670-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlOplockBreakToNone, Type: EAT modification 0x8230E674-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlOplockFsctrl, Type: EAT modification 0x8230E678-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlOplockIsFastIoPossible, Type: EAT modification 0x8230E67C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlPostPagingFileStackOverflow, Type: EAT modification 0x8230E680-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlPostStackOverflow, Type: EAT modification 0x8230E684-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlPrepareMdlWrite, Type: EAT modification 0x8230E688-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlPrepareMdlWriteDev, Type: EAT modification 0x8230E68C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlPrivateLock, Type: EAT modification 0x8230E690-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlProcessFileLock, Type: EAT modification 0x8230E694-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRegisterFileSystemFilterCallbacks, Type: EAT modification 0x8230E698-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRegisterFltMgrCalls, Type: EAT modification 0x8230E69C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRegisterMupCalls, Type: EAT modification 0x8230E6A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRegisterUncProvider, Type: EAT modification 0x8230E6A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRegisterUncProviderEx, Type: EAT modification 0x8230E6A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlReleaseFile, Type: EAT modification 0x8230E6AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemoveBaseMcbEntry, Type: EAT modification 0x8230E6B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemoveDotsFromPath, Type: EAT modification 0x8230E6B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemoveExtraCreateParameter, Type: EAT modification 0x8230E6B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemoveLargeMcbEntry, Type: EAT modification 0x8230E6BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemoveMcbEntry, Type: EAT modification 0x8230E6C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemovePerFileContext, Type: EAT modification 0x8230E6C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemovePerFileObjectContext, Type: EAT modification 0x8230E6C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlRemovePerStreamContext, Type: EAT modification 0x8230E6CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlResetBaseMcb, Type: EAT modification 0x8230E6D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlResetLargeMcb, Type: EAT modification 0x8230E6D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlSetEcpListIntoIrp, Type: EAT modification 0x8230E6D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlSplitBaseMcb, Type: EAT modification 0x8230E6DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlSplitLargeMcb, Type: EAT modification 0x8230E6E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlSyncVolumes, Type: EAT modification 0x8230E6E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlTeardownPerFileContexts, Type: EAT modification 0x8230E6E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlTeardownPerStreamContexts, Type: EAT modification 0x8230E6EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlTruncateBaseMcb, Type: EAT modification 0x8230E6F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlTruncateLargeMcb, Type: EAT modification 0x8230E6F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlTruncateMcb, Type: EAT modification 0x8230E6F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlUninitializeBaseMcb, Type: EAT modification 0x8230E6FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlUninitializeFileLock, Type: EAT modification 0x8230E700-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlUninitializeLargeMcb, Type: EAT modification 0x8230E704-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlUninitializeMcb, Type: EAT modification 0x8230E708-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlUninitializeOplock, Type: EAT modification 0x8230E70C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->FsRtlValidateReparsePointBuffer, Type: EAT modification 0x8230E710-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->HalDispatchTable, Type: EAT modification 0x8230E714-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->HalExamineMBR, Type: EAT modification 0x8230E0E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->HalPrivateDispatchTable, Type: EAT modification 0x8230E718-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->HeadlessDispatch, Type: EAT modification 0x8230E71C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->HvlQueryConnection, Type: EAT modification 0x8230E720-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvAcquireDisplayOwnership, Type: EAT modification 0x8230E724-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvCheckDisplayOwnership, Type: EAT modification 0x8230E728-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvDisplayString, Type: EAT modification 0x8230E72C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvEnableBootDriver, Type: EAT modification 0x8230E730-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvEnableDisplayString, Type: EAT modification 0x8230E734-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvInstallDisplayStringFilter, Type: EAT modification 0x8230E738-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvIsBootDriverInstalled, Type: EAT modification 0x8230E73C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvNotifyDisplayOwnershipLost, Type: EAT modification 0x8230E740-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvResetDisplay, Type: EAT modification 0x8230E744-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvSetScrollRegion, Type: EAT modification 0x8230E748-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvSetTextColor, Type: EAT modification 0x8230E74C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InbvSolidColorFill, Type: EAT modification 0x8230E750-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InitSafeBootMode, Type: EAT modification 0x8230E754-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InterlockedCompareExchange, Type: EAT modification 0x8230E0EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InterlockedDecrement, Type: EAT modification 0x8230E0F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InterlockedExchange, Type: EAT modification 0x8230E0F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InterlockedExchangeAdd, Type: EAT modification 0x8230E0F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InterlockedIncrement, Type: EAT modification 0x8230E0FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InterlockedPopEntrySList, Type: EAT modification 0x8230E100-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->InterlockedPushEntrySList, Type: EAT modification 0x8230E104-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAcquireCancelSpinLock, Type: EAT modification 0x8230E758-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAcquireRemoveLockEx, Type: EAT modification 0x8230E75C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAcquireVpbSpinLock, Type: EAT modification 0x8230E760-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAdapterObjectType, Type: EAT modification 0x8230E764-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateAdapterChannel, Type: EAT modification 0x8230E768-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateController, Type: EAT modification 0x8230E76C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateDriverObjectExtension, Type: EAT modification 0x8230E770-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateErrorLogEntry, Type: EAT modification 0x8230E774-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateIrp, Type: EAT modification 0x8230E778-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateMdl, Type: EAT modification 0x8230E77C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateMiniCompletionPacket, Type: EAT modification 0x8230E780-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateSfioStreamIdentifier, Type: EAT modification 0x8230E784-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAllocateWorkItem, Type: EAT modification 0x8230E788-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoApplyPriorityInfoThread, Type: EAT modification 0x8230E78C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAssignDriveLetters, Type: EAT modification 0x8230E108-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAssignResources, Type: EAT modification 0x8230E790-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAttachDevice, Type: EAT modification 0x8230E794-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAttachDeviceByPointer, Type: EAT modification 0x8230E798-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAttachDeviceToDeviceStack, Type: EAT modification 0x8230E79C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoAttachDeviceToDeviceStackSafe, Type: EAT modification 0x8230E7A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoBuildAsynchronousFsdRequest, Type: EAT modification 0x8230E7A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoBuildDeviceIoControlRequest, Type: EAT modification 0x8230E7A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoBuildPartialMdl, Type: EAT modification 0x8230E7AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoBuildSynchronousFsdRequest, Type: EAT modification 0x8230E7B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCallDriver, Type: EAT modification 0x8230E7B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCallDriverStackSafe, Type: EAT modification 0x8230E10C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCancelFileOpen, Type: EAT modification 0x8230E7B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCancelIrp, Type: EAT modification 0x8230E7BC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckDesiredAccess, Type: EAT modification 0x8230E7C0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckEaBufferValidity, Type: EAT modification 0x8230E7C4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckFunctionAccess, Type: EAT modification 0x8230E7C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckQuerySetFileInformation, Type: EAT modification 0x8230E7CC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckQuerySetVolumeInformation, Type: EAT modification 0x8230E7D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckQuotaBufferValidity, Type: EAT modification 0x8230E7D4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckShareAccess, Type: EAT modification 0x8230E7D8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCheckShareAccessEx, Type: EAT modification 0x8230E7DC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoClearDependency, Type: EAT modification 0x8230E7E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoClearIrpExtraCreateParameter, Type: EAT modification 0x8230E7E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCompleteRequest, Type: EAT modification 0x8230E7E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoConnectInterrupt, Type: EAT modification 0x8230E7EC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoConnectInterruptEx, Type: EAT modification 0x8230E7F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateArcName, Type: EAT modification 0x8230E7F4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateController, Type: EAT modification 0x8230E7F8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateDevice, Type: EAT modification 0x8230E7FC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateDisk, Type: EAT modification 0x8230E800-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateDriver, Type: EAT modification 0x8230E804-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateFile, Type: EAT modification 0x8230E808-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateFileEx, Type: EAT modification 0x8230E80C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateFileSpecifyDeviceObjectHint, Type: EAT modification 0x8230E810-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateNotificationEvent, Type: EAT modification 0x8230E814-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateStreamFileObject, Type: EAT modification 0x8230E818-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateStreamFileObjectEx, Type: EAT modification 0x8230E81C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateStreamFileObjectLite, Type: EAT modification 0x8230E820-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateSymbolicLink, Type: EAT modification 0x8230E824-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateSynchronizationEvent, Type: EAT modification 0x8230E828-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCreateUnprotectedSymbolicLink, Type: EAT modification 0x8230E82C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCsqInitialize, Type: EAT modification 0x8230E830-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCsqInitializeEx, Type: EAT modification 0x8230E834-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCsqInsertIrp, Type: EAT modification 0x8230E838-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCsqInsertIrpEx, Type: EAT modification 0x8230E83C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCsqRemoveIrp, Type: EAT modification 0x8230E840-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoCsqRemoveNextIrp, Type: EAT modification 0x8230E844-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeleteAllDependencyRelations, Type: EAT modification 0x8230E848-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeleteController, Type: EAT modification 0x8230E84C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeleteDevice, Type: EAT modification 0x8230E850-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeleteDriver, Type: EAT modification 0x8230E854-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeleteSymbolicLink, Type: EAT modification 0x8230E858-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDetachDevice, Type: EAT modification 0x8230E85C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeviceHandlerObjectSize, Type: EAT modification 0x8230E860-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeviceHandlerObjectType, Type: EAT modification 0x8230E864-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDeviceObjectType, Type: EAT modification 0x8230E868-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDisconnectInterrupt, Type: EAT modification 0x8230E86C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDisconnectInterruptEx, Type: EAT modification 0x8230E870-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDriverObjectType, Type: EAT modification 0x8230E874-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoDuplicateDependency, Type: EAT modification 0x8230E878-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoEnqueueIrp, Type: EAT modification 0x8230E87C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoEnumerateDeviceObjectList, Type: EAT modification 0x8230E880-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoEnumerateRegisteredFiltersList, Type: EAT modification 0x8230E884-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFastQueryNetworkAttributes, Type: EAT modification 0x8230E888-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IofCallDriver, Type: EAT modification 0x8230E120-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IofCompleteRequest, Type: EAT modification 0x8230E124-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFileObjectType, Type: EAT modification 0x8230E88C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoForwardAndCatchIrp, Type: EAT modification 0x8230E890-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoForwardIrpSynchronously, Type: EAT modification 0x8230E894-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFreeController, Type: EAT modification 0x8230E898-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFreeErrorLogEntry, Type: EAT modification 0x8230E89C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFreeIrp, Type: EAT modification 0x8230E8A0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFreeMdl, Type: EAT modification 0x8230E8A4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFreeMiniCompletionPacket, Type: EAT modification 0x8230E8A8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFreeSfioStreamIdentifier, Type: EAT modification 0x8230E8AC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoFreeWorkItem, Type: EAT modification 0x8230E8B0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetAttachedDevice, Type: EAT modification 0x8230E8B4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetAttachedDeviceReference, Type: EAT modification 0x8230E8B8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetBaseFileSystemDeviceObject, Type: EAT modification 0x8230E8BC-->82393FCC [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetBootDiskInformation, Type: EAT modification 0x8230E8C0-->B01412EB [unknown_code_page]
ntkrnlpa.exe-->IoGetBootDiskInformationLite, Type: EAT modification 0x8230E8C4-->8E0FF168 [unknown_code_page]
ntkrnlpa.exe-->IoGetConfigurationInformation, Type: EAT modification 0x8230E8C8-->936DE048 [unknown_code_page]
ntkrnlpa.exe-->IoGetCurrentProcess, Type: EAT modification 0x8230E8CC-->8239397C [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDeviceAttachmentBaseRef, Type: EAT modification 0x8230E8D0-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDeviceInterfaceAlias, Type: EAT modification 0x8230E8D4-->8200F400 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDeviceInterfaces, Type: EAT modification 0x8230E8D8-->8200F06C [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDeviceObjectPointer, Type: EAT modification 0x8230E8DC-->936DD838 [unknown_code_page]
ntkrnlpa.exe-->IoGetDeviceProperty, Type: EAT modification 0x8230E8E0-->82393974 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDevicePropertyData, Type: EAT modification 0x8230E8E4-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDeviceToVerify, Type: EAT modification 0x8230E8E8-->8200F200 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDiskDeviceObject, Type: EAT modification 0x8230E8EC-->8200F065 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetDmaAdapter, Type: EAT modification 0x8230E8F0-->936DD1F8 [unknown_code_page]
ntkrnlpa.exe-->IoGetDriverObjectExtension, Type: EAT modification 0x8230E8F4-->83CC5BF6 [unknown_code_page]
ntkrnlpa.exe-->IoGetFileObjectGenericMapping, Type: EAT modification 0x8230E8F8-->B01412EB [unknown_code_page]
ntkrnlpa.exe-->IoGetInitialStack, Type: EAT modification 0x8230E8FC-->8E0FF06D [unknown_code_page]
ntkrnlpa.exe-->IoGetIoPriorityHint, Type: EAT modification 0x8230E900-->936DEA98 [unknown_code_page]
ntkrnlpa.exe-->IoGetIrpExtraCreateParameter, Type: EAT modification 0x8230E904-->8239396C [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetLowerDeviceObject, Type: EAT modification 0x8230E908-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetPagingIoPriority, Type: EAT modification 0x8230E110-->8200F400 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetRelatedDeviceObject, Type: EAT modification 0x8230E90C-->8200F05F [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetRequestorProcess, Type: EAT modification 0x8230E910-->931C0008 [unknown_code_page]
ntkrnlpa.exe-->IoGetRequestorProcessId, Type: EAT modification 0x8230E914-->82393964 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetRequestorSessionId, Type: EAT modification 0x8230E918-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetSfioStreamIdentifier, Type: EAT modification 0x8230E91C-->8200F200 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetStackLimits, Type: EAT modification 0x8230E920-->8200F066 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoGetSymlinkSupportInformation, Type: EAT modification 0x8230E924-->936DE458 [unknown_code_page]
ntkrnlpa.exe-->IoGetTopLevelIrp, Type: EAT modification 0x8230E928-->8263F06F [acpi.sys]
ntkrnlpa.exe-->IoGetTransactionParameterBlock, Type: EAT modification 0x8230E92C-->B01412EB [unknown_code_page]
ntkrnlpa.exe-->IoInitializeIrp, Type: EAT modification 0x8230E930-->8E0FF06D [unknown_code_page]
ntkrnlpa.exe-->IoInitializeRemoveLockEx, Type: EAT modification 0x8230E934-->931C1668 [unknown_code_page]
ntkrnlpa.exe-->IoInitializeTimer, Type: EAT modification 0x8230E938-->8239395C [ntkrnlpa.exe]
ntkrnlpa.exe-->IoInitializeWorkItem, Type: EAT modification 0x8230E93C-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoInvalidateDeviceRelations, Type: EAT modification 0x8230E940-->8200F400 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoInvalidateDeviceState, Type: EAT modification 0x8230E944-->8200F069 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoIsFileObjectIgnoringSharing, Type: EAT modification 0x8230E948-->931C0E58 [unknown_code_page]
ntkrnlpa.exe-->IoIsFileOriginRemote, Type: EAT modification 0x8230E94C-->82393954 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoIsOperationSynchronous, Type: EAT modification 0x8230E950-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoIsSystemThread, Type: EAT modification 0x8230E954-->8200F200 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoIsValidNameGraftingBuffer, Type: EAT modification 0x8230E958-->8200F067 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoIsWdmVersionAvailable, Type: EAT modification 0x8230E95C-->931C0818 [unknown_code_page]
ntkrnlpa.exe-->IoMakeAssociatedIrp, Type: EAT modification 0x8230E960-->8206F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoOpenDeviceInterfaceRegistryKey, Type: EAT modification 0x8230E964-->B01412EB [unknown_code_page]
ntkrnlpa.exe-->IoOpenDeviceRegistryKey, Type: EAT modification 0x8230E968-->8E0FF06D [unknown_code_page]
ntkrnlpa.exe-->IoPageRead, Type: EAT modification 0x8230E96C-->931C28C8 [unknown_code_page]
ntkrnlpa.exe-->IoPnPDeliverServicePowerNotification, Type: EAT modification 0x8230E970-->8239394C [ntkrnlpa.exe]
ntkrnlpa.exe-->IoQueryDeviceDescription, Type: EAT modification 0x8230E974-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoQueryFileDosDeviceName, Type: EAT modification 0x8230E978-->8200F400 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoQueryFileInformation, Type: EAT modification 0x8230E97C-->8200F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoQueryVolumeInformation, Type: EAT modification 0x8230E980-->931C20B8 [unknown_code_page]
ntkrnlpa.exe-->IoQueueThreadIrp, Type: EAT modification 0x8230E984-->82393944 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoQueueWorkItem, Type: EAT modification 0x8230E988-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoQueueWorkItemEx, Type: EAT modification 0x8230E98C-->8200F200 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRaiseHardError, Type: EAT modification 0x8230E990-->8200F068 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRaiseInformationalHardError, Type: EAT modification 0x8230E994-->931C1A78 [unknown_code_page]
ntkrnlpa.exe-->IoReadDiskSignature, Type: EAT modification 0x8230E998-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoReadOperationCount, Type: EAT modification 0x8230E99C-->B01412EB [unknown_code_page]
ntkrnlpa.exe-->IoReadPartitionTable, Type: EAT modification 0x8230E114-->8E0FF06D [unknown_code_page]
ntkrnlpa.exe-->IoReadPartitionTableEx, Type: EAT modification 0x8230E9A0-->931C3B28 [unknown_code_page]
ntkrnlpa.exe-->IoReadTransferCount, Type: EAT modification 0x8230E9A4-->8239393C [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRegisterBootDriverReinitialization, Type: EAT modification 0x8230E9A8-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRegisterDeviceInterface, Type: EAT modification 0x8230E9AC-->8200F400 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRegisterDriverReinitialization, Type: EAT modification 0x8230E9B0-->8200F06D [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRegisterFileSystem, Type: EAT modification 0x8230E9B4-->931C3318 [unknown_code_page]
ntkrnlpa.exe-->IoRegisterFsRegistrationChange, Type: EAT modification 0x8230E9B8-->82393934 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRegisterLastChanceShutdownNotification, Type: EAT modification 0x8230E9BC-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRegisterPlugPlayNotification, Type: EAT modification 0x8230E9C0-->8200F200 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRegisterShutdownNotification, Type: EAT modification 0x8230E9C4-->8200F069 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoReleaseCancelSpinLock, Type: EAT modification 0x8230E9C8-->931C2CD8 [unknown_code_page]
ntkrnlpa.exe-->IoReleaseRemoveLockAndWaitEx, Type: EAT modification 0x8230E9CC-->8200F020 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoReleaseRemoveLockEx, Type: EAT modification 0x8230E9D0-->AC1312EE [unknown_code_page]
ntkrnlpa.exe-->IoReleaseVpbSpinLock, Type: EAT modification 0x8230E9D4-->820FF06D [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRemoveShareAccess, Type: EAT modification 0x8230E9D8-->850611E8 [unknown_code_page]
ntkrnlpa.exe-->IoReplacePartitionUnit, Type: EAT modification 0x8230E9DC-->85020FF8 [unknown_code_page]
ntkrnlpa.exe-->IoReportDetectedDevice, Type: EAT modification 0x8230E9E0-->A71C16EC [unknown_code_page]
ntkrnlpa.exe-->IoReportHalResourceUsage, Type: EAT modification 0x8230E9E4-->8A0FF068 [unknown_code_page]
ntkrnlpa.exe-->IoReportResourceForDetection, Type: EAT modification 0x8230E9E8-->821BE9C0 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoReportResourceUsage, Type: EAT modification 0x8230E9EC-->82164618 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoReportTargetDeviceChange, Type: EAT modification 0x8230E9F0-->8200F00D [ntkrnlpa.exe]
ntkrnlpa.exe-->IoRequestDeviceEject, Type: EAT modification 0x8230E9F8-->CFA85B0C [unknown_code_page]
ntkrnlpa.exe-->IoRetrievePriorityInfo, Type: EAT modification 0x8230EA00-->8208F326 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoReuseIrp, Type: EAT modification 0x8230EA04-->8209F346 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetCompletionRoutineEx, Type: EAT modification 0x8230EA08-->C200F0C2 [unknown_code_page]
ntkrnlpa.exe-->IoSetDependency, Type: EAT modification 0x8230EA0C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetDeviceInterfaceState, Type: EAT modification 0x8230EA10-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetDevicePropertyData, Type: EAT modification 0x8230EA14-->8200F4E3 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetDeviceToVerify, Type: EAT modification 0x8230EA18-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetFileOrigin, Type: EAT modification 0x8230EA1C-->8200F006 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetHardErrorOrVerifyDevice, Type: EAT modification 0x8230EA20-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetInformation, Type: EAT modification 0x8230EA24-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetIoCompletion, Type: EAT modification 0x8230EA28-->8200F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetIoCompletionEx, Type: EAT modification 0x8230EA2C-->8200F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetIoPriorityHint, Type: EAT modification 0x8230EA30-->8200F00D [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetIoPriorityHintIntoFileObject, Type: EAT modification 0x8230EA34-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetIoPriorityHintIntoThread, Type: EAT modification 0x8230EA38-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetPartitionInformation, Type: EAT modification 0x8230E118-->FD0AFDB6 [unknown_code_page]
ntkrnlpa.exe-->IoSetPartitionInformationEx, Type: EAT modification 0x8230EA40-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetShareAccess, Type: EAT modification 0x8230EA44-->8216A890 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetShareAccessEx, Type: EAT modification 0x8230EA48-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetStartIoAttributes, Type: EAT modification 0x8230EA4C-->8200F020 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetSystemPartition, Type: EAT modification 0x8230EA50-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetThreadHardErrorMode, Type: EAT modification 0x8230EA54-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSetTopLevelIrp, Type: EAT modification 0x8230EA58-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSizeofWorkItem, Type: EAT modification 0x8230EA5C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoStartNextPacket, Type: EAT modification 0x8230EA60-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoStartNextPacketByKey, Type: EAT modification 0x8230EA64-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoStartPacket, Type: EAT modification 0x8230EA68-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoStartTimer, Type: EAT modification 0x8230EA6C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoStatisticsLock, Type: EAT modification 0x8230EA70-->8200EFFF [unknown_code_page]
ntkrnlpa.exe-->IoStopTimer, Type: EAT modification 0x8230EA74-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSynchronousInvalidateDeviceRelations, Type: EAT modification 0x8230EA78-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoSynchronousPageWrite, Type: EAT modification 0x8230EA7C-->8200EFFF [unknown_code_page]
ntkrnlpa.exe-->IoThreadToProcess, Type: EAT modification 0x8230EA80-->8200F006 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoTranslateBusAddress, Type: EAT modification 0x8230EA84-->8200F006 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoUninitializeWorkItem, Type: EAT modification 0x8230EA88-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoUnregisterFileSystem, Type: EAT modification 0x8230EA8C-->8200EFFF [unknown_code_page]
ntkrnlpa.exe-->IoUnregisterFsRegistrationChange, Type: EAT modification 0x8230EA90-->8200EFFF [unknown_code_page]
ntkrnlpa.exe-->IoUnregisterPlugPlayNotification, Type: EAT modification 0x8230EA94-->8200F3E8 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoUnregisterShutdownNotification, Type: EAT modification 0x8230EA98-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoUpdateShareAccess, Type: EAT modification 0x8230EA9C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoValidateDeviceIoControlAccess, Type: EAT modification 0x8230EAA0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoVerifyPartitionTable, Type: EAT modification 0x8230EAA4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoVerifyVolume, Type: EAT modification 0x8230EAA8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoVolumeDeviceToDosName, Type: EAT modification 0x8230EAAC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWithinStackLimits, Type: EAT modification 0x8230EAEC-->8200F00D [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIAllocateInstanceIds, Type: EAT modification 0x8230EAB0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIDeviceObjectToInstanceName, Type: EAT modification 0x8230EAB4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIExecuteMethod, Type: EAT modification 0x8230EAB8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIHandleToInstanceName, Type: EAT modification 0x8230EABC-->8200F00F [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIOpenBlock, Type: EAT modification 0x8230EAC0-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIQueryAllData, Type: EAT modification 0x8230EAC4-->8209F346 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIQueryAllDataMultiple, Type: EAT modification 0x8230EAC8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIQuerySingleInstance, Type: EAT modification 0x8230EACC-->8205F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIQuerySingleInstanceMultiple, Type: EAT modification 0x8230EAD0-->8300EFFF [unknown_code_page]
ntkrnlpa.exe-->IoWMIRegistrationControl, Type: EAT modification 0x8230EAD4-->8100F000 [unknown_code_page]
ntkrnlpa.exe-->IoWMISetNotificationCallback, Type: EAT modification 0x8230EAD8-->8200EFFF [unknown_code_page]
ntkrnlpa.exe-->IoWMISetSingleInstance, Type: EAT modification 0x8230EADC-->8200F013 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMISetSingleItem, Type: EAT modification 0x8230EAE0-->8200F015 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMISuggestInstanceName, Type: EAT modification 0x8230EAE4-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWMIWriteEvent, Type: EAT modification 0x8230EAE8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWriteErrorLogEntry, Type: EAT modification 0x8230EAF0-->8200F005 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWriteOperationCount, Type: EAT modification 0x8230EAF4-->8200F018 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWritePartitionTable, Type: EAT modification 0x8230E11C-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->IoWritePartitionTableEx, Type: EAT modification 0x8230EAF8-->CFA85B2D [unknown_code_page]
ntkrnlpa.exe-->isdigit, Type: EAT modification 0x8230FE00-->822EF061 [ntkrnlpa.exe]
ntkrnlpa.exe-->islower, Type: EAT modification 0x8230FE04-->8261F062 [acpi.sys]
ntkrnlpa.exe-->isprint, Type: EAT modification 0x8230FE08-->8200F06B [ntkrnlpa.exe]
ntkrnlpa.exe-->isspace, Type: EAT modification 0x8230FE0C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->isupper, Type: EAT modification 0x8230FE10-->CFA86590 [unknown_code_page]
ntkrnlpa.exe-->KdChangeOption, Type: EAT modification 0x8230EB00-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdDebuggerEnabled, Type: EAT modification 0x8230EB04-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdDebuggerNotPresent, Type: EAT modification 0x8230EB08-->8200F020 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdDisableDebugger, Type: EAT modification 0x8230EB0C-->8223C200 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdEnableDebugger, Type: EAT modification 0x8230EB10-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdEnteredDebugger, Type: EAT modification 0x8230EB14-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdPollBreakIn, Type: EAT modification 0x8230EB18-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdPowerTransition, Type: EAT modification 0x8230EB1C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdRefreshDebuggerNotPresent, Type: EAT modification 0x8230EB20-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KdSystemDebugControl, Type: EAT modification 0x8230EB24-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Ke386CallBios, Type: EAT modification 0x8230EB28-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Ke386IoSetAccessProcess, Type: EAT modification 0x8230EB2C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Ke386QueryIoAccessMap, Type: EAT modification 0x8230EB30-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Ke386SetIoAccessMap, Type: EAT modification 0x8230EB34-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAcquireGuardedMutex, Type: EAT modification 0x8230E128-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAcquireGuardedMutexUnsafe, Type: EAT modification 0x8230E12C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAcquireInStackQueuedSpinLockAtDpcLevel, Type: EAT modification 0x8230E130-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAcquireInStackQueuedSpinLockForDpc, Type: EAT modification 0x8230E134-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAcquireInterruptSpinLock, Type: EAT modification 0x8230EB38-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAcquireSpinLockAtDpcLevel, Type: EAT modification 0x8230EB3C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAcquireSpinLockForDpc, Type: EAT modification 0x8230E138-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAddSystemServiceTable, Type: EAT modification 0x8230EB40-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAlertThread, Type: EAT modification 0x8230EB44-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAllocateCalloutStack, Type: EAT modification 0x8230EB48-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAreAllApcsDisabled, Type: EAT modification 0x8230EB4C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAreApcsDisabled, Type: EAT modification 0x8230EB50-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeAttachProcess, Type: EAT modification 0x8230EB54-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeBugCheck, Type: EAT modification 0x8230EB58-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeBugCheckEx, Type: EAT modification 0x8230EB5C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeCancelTimer, Type: EAT modification 0x8230EB60-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeCapturePersistentThreadState, Type: EAT modification 0x8230EB64-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeClearEvent, Type: EAT modification 0x8230EB68-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeDelayExecutionThread, Type: EAT modification 0x8230EB6C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeDeregisterBugCheckCallback, Type: EAT modification 0x8230EB70-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeDeregisterBugCheckReasonCallback, Type: EAT modification 0x8230EB74-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeDeregisterNmiCallback, Type: EAT modification 0x8230EB78-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeDeregisterProcessorChangeCallback, Type: EAT modification 0x8230EB7C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeDetachProcess, Type: EAT modification 0x8230EB80-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeEnterCriticalRegion, Type: EAT modification 0x8230EB84-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeEnterGuardedRegion, Type: EAT modification 0x8230EB88-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeEnterKernelDebugger, Type: EAT modification 0x8230EB8C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeExpandKernelStackAndCallout, Type: EAT modification 0x8230EB90-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeExpandKernelStackAndCalloutEx, Type: EAT modification 0x8230EB94-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KefAcquireSpinLockAtDpcLevel, Type: EAT modification 0x8230E168-->85023AEB [unknown_code_page]
ntkrnlpa.exe-->KeFindConfigurationEntry, Type: EAT modification 0x8230EB98-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeFindConfigurationNextEntry, Type: EAT modification 0x8230EB9C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeFlushEntireTb, Type: EAT modification 0x8230EBA0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeFlushQueuedDpcs, Type: EAT modification 0x8230EBA4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeFreeCalloutStack, Type: EAT modification 0x8230EBA8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KefReleaseSpinLockFromDpcLevel, Type: EAT modification 0x8230E16C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeGenericCallDpc, Type: EAT modification 0x8230EBAC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeGetCurrentThread, Type: EAT modification 0x8230EBB0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeGetPreviousMode, Type: EAT modification 0x8230EBB4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeGetRecommendedSharedDataAlignment, Type: EAT modification 0x8230EBB8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386AbiosCall, Type: EAT modification 0x8230EBBC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386AllocateGdtSelectors, Type: EAT modification 0x8230EBC0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386Call16BitCStyleFunction, Type: EAT modification 0x8230EBC4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386Call16BitFunction, Type: EAT modification 0x8230EBC8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Kei386EoiHelper, Type: EAT modification 0x8230E198-->8200F006 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386FlatToGdtSelector, Type: EAT modification 0x8230EBCC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386GetLid, Type: EAT modification 0x8230EBD0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386MachineType, Type: EAT modification 0x8230EBD4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386ReleaseGdtSelectors, Type: EAT modification 0x8230EBD8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386ReleaseLid, Type: EAT modification 0x8230EBDC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeI386SetGdtSelector, Type: EAT modification 0x8230EBE0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInitializeApc, Type: EAT modification 0x8230EBE4-->CFA85B42 [unknown_code_page]
ntkrnlpa.exe-->KeInitializeDeviceQueue, Type: EAT modification 0x8230EBEC-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInitializeDpc, Type: EAT modification 0x8230EBF0-->8200F010 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInitializeEvent, Type: EAT modification 0x8230EBF4-->850562B8 [unknown_code_page]
ntkrnlpa.exe-->KeInitializeGuardedMutex, Type: EAT modification 0x8230E13C-->84F7DFC1 [unknown_code_page]
ntkrnlpa.exe-->KeInitializeInterrupt, Type: EAT modification 0x8230EBF8-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInitializeMutant, Type: EAT modification 0x8230EBFC-->82221354 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInitializeMutex, Type: EAT modification 0x8230EC00-->8200F063 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInitializeQueue, Type: EAT modification 0x8230EC04-->82221356 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInitializeSpinLock, Type: EAT modification 0x8230EC0C-->83C17B18 [unknown_code_page]
ntkrnlpa.exe-->KeInitializeThreadedDpc, Type: EAT modification 0x8230EC10-->E59B1980 [unknown_code_page]
ntkrnlpa.exe-->KeInitializeTimer, Type: EAT modification 0x8230EC14-->83C29AB3 [unknown_code_page]
ntkrnlpa.exe-->KeInitializeTimerEx, Type: EAT modification 0x8230EC18-->8200F161 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInsertByKeyDeviceQueue, Type: EAT modification 0x8230EC1C-->822213D9 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInsertDeviceQueue, Type: EAT modification 0x8230EC20-->84F7E031 [unknown_code_page]
ntkrnlpa.exe-->KeInsertHeadQueue, Type: EAT modification 0x8230EC24-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInsertQueue, Type: EAT modification 0x8230EC28-->8222154A [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInsertQueueApc, Type: EAT modification 0x8230EC2C-->8200F08C [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInsertQueueDpc, Type: EAT modification 0x8230EC30-->82221550 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInvalidateAllCaches, Type: EAT modification 0x8230EC34-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeInvalidateRangeAllCaches, Type: EAT modification 0x8230E140-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeIpiGenericCall, Type: EAT modification 0x8230EC38-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeIsAttachedProcess, Type: EAT modification 0x8230EC3C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeIsExecutingDpc, Type: EAT modification 0x8230EC40-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeIsWaitListEmpty, Type: EAT modification 0x8230EC44-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeLeaveCriticalRegion, Type: EAT modification 0x8230EC48-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeLeaveGuardedRegion, Type: EAT modification 0x8230EC4C-->8200F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeLoaderBlock, Type: EAT modification 0x8230EC50-->850562C8 [unknown_code_page]
ntkrnlpa.exe-->KeNumberProcessors, Type: EAT modification 0x8230EC54-->D0B29BFD [unknown_code_page]
ntkrnlpa.exe-->KePulseEvent, Type: EAT modification 0x8230EC60-->F70F30FF [unknown_code_page]
ntkrnlpa.exe-->KeQueryActiveProcessorCount, Type: EAT modification 0x8230EC64-->85023A4B [unknown_code_page]
ntkrnlpa.exe-->KeQueryActiveProcessors, Type: EAT modification 0x8230EC68-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeQueryDpcWatchdogInformation, Type: EAT modification 0x8230EC6C-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeQueryInterruptTime, Type: EAT modification 0x8230EC70-->822215ED [ntkrnlpa.exe]
ntkrnlpa.exe-->KeQueryMaximumProcessorCount, Type: EAT modification 0x8230EC74-->85023A23 [unknown_code_page]
ntkrnlpa.exe-->KeQueryPriorityThread, Type: EAT modification 0x8230EC78-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeQueryRuntimeThread, Type: EAT modification 0x8230EC7C-->8200F004 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeQuerySystemTime, Type: EAT modification 0x8230EC80-->822215F8 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeQueryTickCount, Type: EAT modification 0x8230EC84-->8502395B [unknown_code_page]
ntkrnlpa.exe-->KeQueryTimeIncrement, Type: EAT modification 0x8230EC88-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRaiseUserException, Type: EAT modification 0x8230EC8C-->8200F08C [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReadStateEvent, Type: EAT modification 0x8230EC90-->82221607 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReadStateMutant, Type: EAT modification 0x8230EC94-->85087EE3 [unknown_code_page]
ntkrnlpa.exe-->KeReadStateMutex, Type: EAT modification 0x8230EC98-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReadStateQueue, Type: EAT modification 0x8230EC9C-->8200F017 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReadStateSemaphore, Type: EAT modification 0x8230ECA0-->8222169F [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReadStateTimer, Type: EAT modification 0x8230ECA4-->85023AEB [unknown_code_page]
ntkrnlpa.exe-->KeRegisterBugCheckCallback, Type: EAT modification 0x8230ECA8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRegisterBugCheckReasonCallback, Type: EAT modification 0x8230ECAC-->8200F006 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRegisterNmiCallback, Type: EAT modification 0x8230ECB0-->822216BF [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRegisterProcessorChangeCallback, Type: EAT modification 0x8230ECB4-->82234682 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseGuardedMutex, Type: EAT modification 0x8230E144-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseGuardedMutexUnsafe, Type: EAT modification 0x8230E148-->8200F423 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseInStackQueuedSpinLockForDpc, Type: EAT modification 0x8230E14C-->822216DC [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseInStackQueuedSpinLockFromDpcLevel, Type: EAT modification 0x8230E150-->85023A73 [unknown_code_page]
ntkrnlpa.exe-->KeReleaseInterruptSpinLock, Type: EAT modification 0x8230ECB8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseMutant, Type: EAT modification 0x8230ECBC-->8200F03D [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseMutex, Type: EAT modification 0x8230ECC0-->82221B08 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseSemaphore, Type: EAT modification 0x8230ECC4-->822346C2 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseSpinLockForDpc, Type: EAT modification 0x8230E154-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeReleaseSpinLockFromDpcLevel, Type: EAT modification 0x8230ECC8-->8200F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRemoveByKeyDeviceQueue, Type: EAT modification 0x8230ECCC-->82221B55 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRemoveByKeyDeviceQueueIfBusy, Type: EAT modification 0x8230ECD0-->CFA85B63 [unknown_code_page]
ntkrnlpa.exe-->KeRemoveEntryDeviceQueue, Type: EAT modification 0x8230ECD8-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRemoveQueue, Type: EAT modification 0x8230ECDC-->8200F010 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRemoveQueueDpc, Type: EAT modification 0x8230ECE0-->850563C0 [unknown_code_page]
ntkrnlpa.exe-->KeRemoveQueueEx, Type: EAT modification 0x8230ECE4-->84F7DFC1 [unknown_code_page]
ntkrnlpa.exe-->KeRemoveSystemServiceTable, Type: EAT modification 0x8230ECE8-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeResetEvent, Type: EAT modification 0x8230ECEC-->82221CA4 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRestoreFloatingPointState, Type: EAT modification 0x8230ECF0-->8200F063 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRevertToUserAffinityThread, Type: EAT modification 0x8230ECF4-->82221CA6 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeRundownQueue, Type: EAT modification 0x8230ECFC-->83C17A4F [unknown_code_page]
ntkrnlpa.exe-->KeSaveFloatingPointState, Type: EAT modification 0x8230ED00-->BB315980 [unknown_code_page]
ntkrnlpa.exe-->KeSaveStateForHibernate, Type: EAT modification 0x8230ED04-->83C299EA [unknown_code_page]
ntkrnlpa.exe-->KeServiceDescriptorTable, Type: EAT modification 0x8230ED08-->8200F14F [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetActualBasePriorityThread, Type: EAT modification 0x8230ED0C-->82221D29 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetAffinityThread, Type: EAT modification 0x8230ED10-->84F7E031 [unknown_code_page]
ntkrnlpa.exe-->KeSetBasePriorityThread, Type: EAT modification 0x8230ED14-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetDmaIoCoherency, Type: EAT modification 0x8230ED18-->82221E88 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetEvent, Type: EAT modification 0x8230ED1C-->8200F08C [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetEventBoostPriority, Type: EAT modification 0x8230ED20-->82221E8E [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetIdealProcessorThread, Type: EAT modification 0x8230ED24-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetImportanceDpc, Type: EAT modification 0x8230ED28-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetKernelStackSwapEnable, Type: EAT modification 0x8230ED2C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetPriorityThread, Type: EAT modification 0x8230ED30-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetProfileIrql, Type: EAT modification 0x8230ED34-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetSystemAffinityThread, Type: EAT modification 0x8230ED38-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetSystemAffinityThreadEx, Type: EAT modification 0x8230ED3C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetTargetProcessorDpc, Type: EAT modification 0x8230ED40-->8200F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSetTimeIncrement, Type: EAT modification 0x8230ED44-->850563D0 [unknown_code_page]
ntkrnlpa.exe-->KeSetTimer, Type: EAT modification 0x8230ED48-->C838896A [unknown_code_page]
ntkrnlpa.exe-->KeSignalCallDpcDone, Type: EAT modification 0x8230ED50-->B925299C [unknown_code_page]
ntkrnlpa.exe-->KeSignalCallDpcSynchronize, Type: EAT modification 0x8230ED54-->9D5280F7 [unknown_code_page]
ntkrnlpa.exe-->KeStackAttachProcess, Type: EAT modification 0x8230ED58-->85023A4B [unknown_code_page]
ntkrnlpa.exe-->KeStartDynamicProcessor, Type: EAT modification 0x8230ED5C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeSynchronizeExecution, Type: EAT modification 0x8230ED60-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeTerminateThread, Type: EAT modification 0x8230ED64-->82221F2B [ntkrnlpa.exe]
ntkrnlpa.exe-->KeTestAlertThread, Type: EAT modification 0x8230ED68-->85023A23 [unknown_code_page]
ntkrnlpa.exe-->KeTestSpinLock, Type: EAT modification 0x8230E158-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeTickCount, Type: EAT modification 0x8230ED6C-->8200F004 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeTryToAcquireGuardedMutex, Type: EAT modification 0x8230E15C-->82221F36 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeTryToAcquireSpinLockAtDpcLevel, Type: EAT modification 0x8230E160-->8502395B [unknown_code_page]
ntkrnlpa.exe-->KeUnstackDetachProcess, Type: EAT modification 0x8230ED70-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeUpdateRunTime, Type: EAT modification 0x8230E164-->8200F08C [ntkrnlpa.exe]
ntkrnlpa.exe-->KeUpdateSystemTime, Type: EAT modification 0x8230ED74-->82221F45 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeUserModeCallback, Type: EAT modification 0x8230ED78-->85087EE3 [unknown_code_page]
ntkrnlpa.exe-->KeWaitForMultipleObjects, Type: EAT modification 0x8230ED7C-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeWaitForMutexObject, Type: EAT modification 0x8230ED80-->8200F017 [ntkrnlpa.exe]
ntkrnlpa.exe-->KeWaitForSingleObject, Type: EAT modification 0x8230ED84-->82221FDD [ntkrnlpa.exe]
ntkrnlpa.exe-->KiAcquireSpinLock, Type: EAT modification 0x8230E170-->82221FFD [ntkrnlpa.exe]
ntkrnlpa.exe-->KiBugCheckData, Type: EAT modification 0x8230ED88-->82234682 [ntkrnlpa.exe]
ntkrnlpa.exe-->KiCheckForKernelApcDelivery, Type: EAT modification 0x8230ED8C-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->KiCheckForSListAddress, Type: EAT modification 0x8230E174-->8200F423 [ntkrnlpa.exe]
ntkrnlpa.exe-->KiCoprocessorError, Type: EAT modification 0x8230ED90-->8222201A [ntkrnlpa.exe]
dalitaj
November 6, 2010, 3:29 AM UTC
ntkrnlpa.exe-->KiDeliverApc, Type: EAT modification 0x8230ED94-->85023A73 [unknown_code_page]
ntkrnlpa.exe-->KiDispatchInterrupt, Type: EAT modification 0x8230ED98-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->Kii386SpinOnSpinLock, Type: EAT modification 0x8230E19C-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->KiIpiServiceRoutine, Type: EAT modification 0x8230ED9C-->8200F03D [ntkrnlpa.exe]
ntkrnlpa.exe-->KiReleaseSpinLock, Type: EAT modification 0x8230E178-->82222446 [ntkrnlpa.exe]
ntkrnlpa.exe-->KiUnexpectedInterrupt, Type: EAT modification 0x8230EDA0-->822346C2 [ntkrnlpa.exe]
ntkrnlpa.exe-->LdrAccessResource, Type: EAT modification 0x8230EDA4-->8200F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->LdrEnumResources, Type: EAT modification 0x8230EDA8-->82222493 [ntkrnlpa.exe]
ntkrnlpa.exe-->LdrFindResourceDirectory_U, Type: EAT modification 0x8230EDAC-->CFA85B80 [unknown_code_page]
ntkrnlpa.exe-->LdrFindResource_U, Type: EAT modification 0x8230EDB4-->8200F0A7 [ntkrnlpa.exe]
ntkrnlpa.exe-->LdrResFindResource, Type: EAT modification 0x8230EDB8-->8200F001 [ntkrnlpa.exe]
ntkrnlpa.exe-->LdrResFindResourceDirectory, Type: EAT modification 0x8230EDBC-->8200F002 [ntkrnlpa.exe]
ntkrnlpa.exe-->LdrResSearchResource, Type: EAT modification 0x8230EDC0-->8200F003 [ntkrnlpa.exe]
ntkrnlpa.exe-->LpcPortObjectType, Type: EAT modification 0x8230EDC4-->8200F004 [ntkrnlpa.exe]
ntkrnlpa.exe-->LpcReplyWaitReplyPort, Type: EAT modification 0x8230EDC8-->8200F005 [ntkrnlpa.exe]
ntkrnlpa.exe-->LpcRequestPort, Type: EAT modification 0x8230EDCC-->8200F006 [ntkrnlpa.exe]
ntkrnlpa.exe-->LpcRequestWaitReplyPort, Type: EAT modification 0x8230EDD0-->8200F007 [ntkrnlpa.exe]
ntkrnlpa.exe-->LpcRequestWaitReplyPortEx, Type: EAT modification 0x8230EDD4-->8200F008 [ntkrnlpa.exe]
ntkrnlpa.exe-->LpcSendWaitReceivePort, Type: EAT modification 0x8230EDD8-->8200F009 [ntkrnlpa.exe]
ntkrnlpa.exe-->LsaCallAuthenticationPackage, Type: EAT modification 0x8230EDDC-->8200F00A [ntkrnlpa.exe]
ntkrnlpa.exe-->LsaDeregisterLogonProcess, Type: EAT modification 0x8230EDE0-->8200F00B [ntkrnlpa.exe]
ntkrnlpa.exe-->LsaFreeReturnBuffer, Type: EAT modification 0x8230EDE4-->8200F00C [ntkrnlpa.exe]
ntkrnlpa.exe-->LsaLogonUser, Type: EAT modification 0x8230EDE8-->8200F00D [ntkrnlpa.exe]
ntkrnlpa.exe-->LsaLookupAuthenticationPackage, Type: EAT modification 0x8230EDEC-->8200F00E [ntkrnlpa.exe]
ntkrnlpa.exe-->LsaRegisterLogonProcess, Type: EAT modification 0x8230EDF0-->8200F00F [ntkrnlpa.exe]
ntkrnlpa.exe-->mbstowcs, Type: EAT modification 0x8230FE18-->823AF2B7 [ntkrnlpa.exe]
ntkrnlpa.exe-->mbtowc, Type: EAT modification 0x8230FE1C-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->memchr, Type: EAT modification 0x8230FE20-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->memcpy, Type: EAT modification 0x8230FE24-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->memmove, Type: EAT modification 0x8230FE28-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->memset, Type: EAT modification 0x8230FE2C-->8262F075 [acpi.sys]
ntkrnlpa.exe-->Mm64BitPhysicalAddress, Type: EAT modification 0x8230EDF4-->8200F010 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAddPhysicalMemory, Type: EAT modification 0x8230EDF8-->8200F011 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAddVerifierThunks, Type: EAT modification 0x8230EDFC-->8200F012 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAdjustWorkingSetSize, Type: EAT modification 0x8230EE00-->8200F013 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAdvanceMdl, Type: EAT modification 0x8230EE04-->8200F014 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAllocateContiguousMemory, Type: EAT modification 0x8230EE08-->8200F015 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAllocateContiguousMemorySpecifyCache, Type: EAT modification 0x8230EE0C-->8200F016 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAllocateContiguousMemorySpecifyCacheNode, Type: EAT modification 0x8230EE10-->8200F017 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAllocateMappingAddress, Type: EAT modification 0x8230EE14-->8200F018 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAllocateNonCachedMemory, Type: EAT modification 0x8230EE18-->8200F019 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAllocatePagesForMdl, Type: EAT modification 0x8230EE1C-->8200F01A [ntkrnlpa.exe]
ntkrnlpa.exe-->MmAllocatePagesForMdlEx, Type: EAT modification 0x8230EE20-->8200F01B [ntkrnlpa.exe]
ntkrnlpa.exe-->MmBadPointer, Type: EAT modification 0x8230EE24-->8200F01C [ntkrnlpa.exe]
ntkrnlpa.exe-->MmBuildMdlForNonPagedPool, Type: EAT modification 0x8230EE28-->8200F01D [ntkrnlpa.exe]
ntkrnlpa.exe-->MmCanFileBeTruncated, Type: EAT modification 0x8230EE2C-->8200F01E [ntkrnlpa.exe]
ntkrnlpa.exe-->MmCommitSessionMappedView, Type: EAT modification 0x8230EE30-->8200F01F [ntkrnlpa.exe]
ntkrnlpa.exe-->MmCopyVirtualMemory, Type: EAT modification 0x8230EE34-->8200F020 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmCreateMdl, Type: EAT modification 0x8230EE38-->8200F021 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmCreateMirror, Type: EAT modification 0x8230EE3C-->8200F022 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmCreateSection, Type: EAT modification 0x8230EE40-->8200F023 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmDisableModifiedWriteOfSection, Type: EAT modification 0x8230EE44-->8200F024 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmDoesFileHaveUserWritableReferences, Type: EAT modification 0x8230EE48-->8200F025 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmFlushImageSection, Type: EAT modification 0x8230EE4C-->8200F026 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmForceSectionClosed, Type: EAT modification 0x8230EE50-->8200F027 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmFreeContiguousMemory, Type: EAT modification 0x8230EE54-->8200F028 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmFreeContiguousMemorySpecifyCache, Type: EAT modification 0x8230EE58-->8200F029 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmFreeMappingAddress, Type: EAT modification 0x8230EE5C-->8200F02A [ntkrnlpa.exe]
ntkrnlpa.exe-->MmFreeNonCachedMemory, Type: EAT modification 0x8230EE60-->8200F02B [ntkrnlpa.exe]
ntkrnlpa.exe-->MmFreePagesFromMdl, Type: EAT modification 0x8230EE64-->8200F02C [ntkrnlpa.exe]
ntkrnlpa.exe-->MmGetPhysicalAddress, Type: EAT modification 0x8230EE68-->8200F02D [ntkrnlpa.exe]
ntkrnlpa.exe-->MmGetPhysicalMemoryRanges, Type: EAT modification 0x8230EE6C-->8200F02E [ntkrnlpa.exe]
ntkrnlpa.exe-->MmGetSystemRoutineAddress, Type: EAT modification 0x8230EE70-->8200F02F [ntkrnlpa.exe]
ntkrnlpa.exe-->MmGetVirtualForPhysical, Type: EAT modification 0x8230EE74-->8200F030 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmGrowKernelStack, Type: EAT modification 0x8230EE78-->8200F031 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmHighestUserAddress, Type: EAT modification 0x8230EE7C-->8200F032 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsAddressValid, Type: EAT modification 0x8230EE80-->8200F033 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsDriverVerifying, Type: EAT modification 0x8230EE84-->8200F034 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsDriverVerifyingByAddress, Type: EAT modification 0x8230EE88-->8200F035 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsIoSpaceActive, Type: EAT modification 0x8230EE8C-->8200F036 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsNonPagedSystemAddressValid, Type: EAT modification 0x8230EE90-->8200F037 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsRecursiveIoFault, Type: EAT modification 0x8230EE94-->8200F038 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsThisAnNtAsSystem, Type: EAT modification 0x8230EE98-->8200F039 [ntkrnlpa.exe]
ntkrnlpa.exe-->MmIsVerifierEnabled, Type: EAT modification 0x8230EE9C-->8200F03A [ntkrnlpa.exe]
ntkrnlpa.exe-->MmLockPagableDataSection, Type: EAT modification 0x8230EEA0-->8200F03B [ntkrnlpa.exe]
ntkrnlpa.exe-->MmLockPagableImageSection, Type: EAT modification 0x8230EEA4-->8200F03C [ntkrnlpa.exe]
ntkrnlpa.exe-->MmLockPagableSectionByHandle, Type: EAT modification 0x8230EEA8-->8200F03D [ntkrnlpa.exe]
ntkrnlpa.exe-->MmMapIoSpace, Type: EAT modification 0x8230EEAC-->8200F03E [ntkrnlpa.exe]
ntkrnlpa.exe-->MmMapLockedPages, Type: EAT modification 0x8230EEB0-->8200F03F [ntkrnlpa.exe]
ntkrnlpa.exe-->MmMapLockedPagesSpecifyCache, Type: EAT modification 0x8230EEB4-->CFA85BA1 [unknown_code_page]
ntkrnlpa.exe-->MmMapMemoryDumpMdl, Type: EAT modification 0x8230EEBC-->8505F0C8 [unknown_code_page]
ntkrnlpa.exe-->MmMapUserAddressesToPage, Type: EAT modification 0x8230EEC0-->8505FA40 [unknown_code_page]
ntkrnlpa.exe-->MmMapVideoDisplay, Type: EAT modification 0x8230EEC4-->8505FA88 [unknown_code_page]
ntkrnlpa.exe-->MmMapViewInSessionSpace, Type: EAT modification 0x8230EEC8-->8505FAD0 [unknown_code_page]
ntkrnlpa.exe-->MmMapViewInSystemSpace, Type: EAT modification 0x8230EECC-->8505FB18 [unknown_code_page]
ntkrnlpa.exe-->MmMapViewOfSection, Type: EAT modification 0x8230EED0-->8505FB60 [unknown_code_page]
ntkrnlpa.exe-->MmMarkPhysicalMemoryAsBad, Type: EAT modification 0x8230EED4-->8505FBA8 [unknown_code_page]
ntkrnlpa.exe-->MmMarkPhysicalMemoryAsGood, Type: EAT modification 0x8230EED8-->8505FBF0 [unknown_code_page]
ntkrnlpa.exe-->MmPageEntireDriver, Type: EAT modification 0x8230EEDC-->8505FC38 [unknown_code_page]
ntkrnlpa.exe-->MmPrefetchPages, Type: EAT modification 0x8230EEE0-->8505FCC8 [unknown_code_page]
ntkrnlpa.exe-->MmProbeAndLockPages, Type: EAT modification 0x8230EEE4-->8505FD58 [unknown_code_page]
ntkrnlpa.exe-->MmProbeAndLockProcessPages, Type: EAT modification 0x8230EEE8-->8505FDA0 [unknown_code_page]
ntkrnlpa.exe-->MmProbeAndLockSelectedPages, Type: EAT modification 0x8230EEEC-->8505FDE8 [unknown_code_page]
ntkrnlpa.exe-->MmProtectMdlSystemAddress, Type: EAT modification 0x8230EEF0-->8505FE78 [unknown_code_page]
ntkrnlpa.exe-->MmQuerySystemSize, Type: EAT modification 0x8230EEF4-->8505FEC0 [unknown_code_page]
ntkrnlpa.exe-->MmRemovePhysicalMemory, Type: EAT modification 0x8230EEF8-->8505FF08 [unknown_code_page]
ntkrnlpa.exe-->MmResetDriverPaging, Type: EAT modification 0x8230EEFC-->8505FF50 [unknown_code_page]
ntkrnlpa.exe-->MmRotatePhysicalView, Type: EAT modification 0x8230EF00-->8505F9F8 [unknown_code_page]
ntkrnlpa.exe-->MmSectionObjectType, Type: EAT modification 0x8230EF04-->8505F9B0 [unknown_code_page]
ntkrnlpa.exe-->MmSecureVirtualMemory, Type: EAT modification 0x8230EF08-->8505FFE0 [unknown_code_page]
ntkrnlpa.exe-->MmSetAddressRangeModified, Type: EAT modification 0x8230EF0C-->85060028 [unknown_code_page]
ntkrnlpa.exe-->MmSetBankedSection, Type: EAT modification 0x8230EF10-->85060070 [unknown_code_page]
ntkrnlpa.exe-->MmSetUserExceptionCallout, Type: EAT modification 0x8230EF14-->8505FF98 [unknown_code_page]
ntkrnlpa.exe-->MmSizeOfMdl, Type: EAT modification 0x8230EF18-->850600B8 [unknown_code_page]
ntkrnlpa.exe-->MmSystemRangeStart, Type: EAT modification 0x8230EF1C-->85060100 [unknown_code_page]
ntkrnlpa.exe-->MmTrimAllSystemPagableMemory, Type: EAT modification 0x8230EF20-->85060190 [unknown_code_page]
ntkrnlpa.exe-->MmUnlockPagableImageSection, Type: EAT modification 0x8230EF24-->850601D8 [unknown_code_page]
ntkrnlpa.exe-->MmUnlockPages, Type: EAT modification 0x8230EF28-->85060268 [unknown_code_page]
ntkrnlpa.exe-->MmUnmapIoSpace, Type: EAT modification 0x8230EF2C-->850602B0 [unknown_code_page]
ntkrnlpa.exe-->MmUnmapLockedPages, Type: EAT modification 0x8230EF30-->850604F0 [unknown_code_page]
ntkrnlpa.exe-->MmUnmapReservedMapping, Type: EAT modification 0x8230EF34-->85060538 [unknown_code_page]
ntkrnlpa.exe-->MmUnmapVideoDisplay, Type: EAT modification 0x8230EF38-->85060580 [unknown_code_page]
ntkrnlpa.exe-->MmUnmapViewInSessionSpace, Type: EAT modification 0x8230EF3C-->850605C8 [unknown_code_page]
ntkrnlpa.exe-->MmUnmapViewInSystemSpace, Type: EAT modification 0x8230EF40-->85060610 [unknown_code_page]
ntkrnlpa.exe-->MmUnmapViewOfSection, Type: EAT modification 0x8230EF44-->850602F8 [unknown_code_page]
ntkrnlpa.exe-->MmUnsecureVirtualMemory, Type: EAT modification 0x8230EF48-->85060340 [unknown_code_page]
ntkrnlpa.exe-->MmUserProbeAddress, Type: EAT modification 0x8230EF4C-->85060388 [unknown_code_page]
ntkrnlpa.exe-->NlsAnsiCodePage, Type: EAT modification 0x8230EF50-->850603D0 [unknown_code_page]
ntkrnlpa.exe-->NlsLeadByteInfo, Type: EAT modification 0x8230EF54-->85060418 [unknown_code_page]
ntkrnlpa.exe-->NlsMbCodePageTag, Type: EAT modification 0x8230EF58-->850604A8 [unknown_code_page]
ntkrnlpa.exe-->NlsMbOemCodePageTag, Type: EAT modification 0x8230EF5C-->8505F728 [unknown_code_page]
ntkrnlpa.exe-->NlsOemCodePage, Type: EAT modification 0x8230EF60-->8505F770 [unknown_code_page]
ntkrnlpa.exe-->NlsOemLeadByteInfo, Type: EAT modification 0x8230EF64-->8505F7B8 [unknown_code_page]
ntkrnlpa.exe-->NtAddAtom, Type: EAT modification 0x8230EF68-->8505F800 [unknown_code_page]
ntkrnlpa.exe-->NtAdjustPrivilegesToken, Type: EAT modification 0x8230EF6C-->8223B1E8 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtAllocateLocallyUniqueId, Type: EAT modification 0x8230EF70-->8223AED0 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtAllocateUuids, Type: EAT modification 0x8230EF74-->8223B0C8 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtAllocateVirtualMemory, Type: EAT modification 0x8230EF78-->8223B110 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtBuildGUID, Type: EAT modification 0x8230EF7C-->8223ACD8 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtBuildLab, Type: EAT modification 0x8230EF80-->8223B350 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtBuildNumber, Type: EAT modification 0x8230EF84-->8223B1A0 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtClose, Type: EAT modification 0x8230EF88-->821617D0 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtCommitComplete, Type: EAT modification 0x8230EF8C-->82161620 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtCommitEnlistment, Type: EAT modification 0x8230EF90-->82161AA0 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtCommitTransaction, Type: EAT modification 0x8230EF94-->82161AE8 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtConnectPort, Type: EAT modification 0x8230EF98-->821613E0 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtCreateEnlistment, Type: EAT modification 0x8230EF9C-->937890A8 [unknown_code_page]
ntkrnlpa.exe-->NtCreateEvent, Type: EAT modification 0x8230EFA0-->937890F0 [unknown_code_page]
ntkrnlpa.exe-->NtCreateFile, Type: EAT modification 0x8230EFA4-->93789180 [unknown_code_page]
ntkrnlpa.exe-->NtCreateResourceManager, Type: EAT modification 0x8230EFA8-->937891C8 [unknown_code_page]
ntkrnlpa.exe-->NtCreateSection, Type: EAT modification 0x8230EFAC-->93789258 [unknown_code_page]
ntkrnlpa.exe-->NtCreateTransaction, Type: EAT modification 0x8230EFB0-->937892A0 [unknown_code_page]
ntkrnlpa.exe-->NtDeleteAtom, Type: EAT modification 0x8230EFB4-->937892E8 [unknown_code_page]
ntkrnlpa.exe-->NtDeleteFile, Type: EAT modification 0x8230EFB8-->93789330 [unknown_code_page]
ntkrnlpa.exe-->NtDeviceIoControlFile, Type: EAT modification 0x8230EFBC-->CFA85BC6 [unknown_code_page]
ntkrnlpa.exe-->NtDuplicateToken, Type: EAT modification 0x8230EFC4-->823AF0E9 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtEnumerateTransactionObject, Type: EAT modification 0x8230EFC8-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->NtFindAtom, Type: EAT modification 0x8230EFCC-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->NtFreeVirtualMemory, Type: EAT modification 0x8230EFD0-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->NtFreezeTransactions, Type: EAT modification 0x8230EFD4-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->NtFsControlFile, Type: EAT modification 0x8230EFD8-->8262F075 [acpi.sys]
ntkrnlpa.exe-->NtGetEnvironmentVariableEx, Type: EAT modification 0x8230EFDC-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->NtGetNotificationResourceManager, Type: EAT modification 0x8230EFE0-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->NtGlobalFlag, Type: EAT modification 0x8230EFE4-->8261F047 [acpi.sys]
ntkrnlpa.exe-->NtLockFile, Type: EAT modification 0x8230EFE8-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->NtMakePermanentObject, Type: EAT modification 0x8230EFEC-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->NtMapViewOfSection, Type: EAT modification 0x8230EFF0-->826FF057 [pciide.sys]
ntkrnlpa.exe-->NtNotifyChangeDirectoryFile, Type: EAT modification 0x8230EFF4-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->NtOpenEnlistment, Type: EAT modification 0x8230EFF8-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtOpenFile, Type: EAT modification 0x8230EFFC-->8266F06F [pci.sys]
ntkrnlpa.exe-->NtOpenProcess, Type: EAT modification 0x8230F000-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->NtOpenProcessToken, Type: EAT modification 0x8230F004-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->NtOpenProcessTokenEx, Type: EAT modification 0x8230F008-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->NtOpenResourceManager, Type: EAT modification 0x8230F00C-->8266F061 [pci.sys]
ntkrnlpa.exe-->NtOpenThread, Type: EAT modification 0x8230F010-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->NtOpenThreadToken, Type: EAT modification 0x8230F014-->826EF049 [volmgrx.sys]
ntkrnlpa.exe-->NtOpenThreadTokenEx, Type: EAT modification 0x8230F018-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->NtOpenTransaction, Type: EAT modification 0x8230F01C-->8266F072 [pci.sys]
ntkrnlpa.exe-->NtPrepareComplete, Type: EAT modification 0x8230F024-->825CF065 [unknown_code_page]
ntkrnlpa.exe-->NtPrepareEnlistment, Type: EAT modification 0x8230F028-->8264F041 [acpi.sys]
ntkrnlpa.exe-->NtPrePrepareEnlistment, Type: EAT modification 0x8230F020-->8263F061 [acpi.sys]
ntkrnlpa.exe-->NtQueryDirectoryFile, Type: EAT modification 0x8230F02C-->824FF064 [unknown_code_page]
ntkrnlpa.exe-->NtQueryEaFile, Type: EAT modification 0x8230F030-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->NtQueryEnvironmentVariableInfoEx, Type: EAT modification 0x8230F034-->8242F05C [unknown_code_page]
ntkrnlpa.exe-->NtQueryInformationAtom, Type: EAT modification 0x8230F038-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->NtQueryInformationEnlistment, Type: EAT modification 0x8230F03C-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->NtQueryInformationFile, Type: EAT modification 0x8230F040-->8264F06E [acpi.sys]
ntkrnlpa.exe-->NtQueryInformationProcess, Type: EAT modification 0x8230F044-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->NtQueryInformationResourceManager, Type: EAT modification 0x8230F048-->825CF034 [unknown_code_page]
ntkrnlpa.exe-->NtQueryInformationThread, Type: EAT modification 0x8230F04C-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->NtQueryInformationToken, Type: EAT modification 0x8230F050-->8273F062 [ataport.SYS]
ntkrnlpa.exe-->NtQueryInformationTransaction, Type: EAT modification 0x8230F054-->8241F05C [unknown_code_page]
ntkrnlpa.exe-->NtQueryInformationTransactionManager, Type: EAT modification 0x8230F058-->8265F063 [msisadrv.sys]
ntkrnlpa.exe-->NtQueryQuotaInformationFile, Type: EAT modification 0x8230F05C-->8255F047 [unknown_code_page]
ntkrnlpa.exe-->NtQuerySecurityObject, Type: EAT modification 0x8230F060-->822DF049 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtQuerySystemInformation, Type: EAT modification 0x8230F064-->822EF033 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtQueryVolumeInformationFile, Type: EAT modification 0x8230F068-->825CF030 [unknown_code_page]
ntkrnlpa.exe-->NtReadFile, Type: EAT modification 0x8230F06C-->8269F077 [BATTC.SYS]
ntkrnlpa.exe-->NtRequestPort, Type: EAT modification 0x8230F070-->8267F064 [pci.sys]
ntkrnlpa.exe-->NtRequestWaitReplyPort, Type: EAT modification 0x8230F074-->8274F065 [fltmgr.sys]
ntkrnlpa.exe-->NtRollbackEnlistment, Type: EAT modification 0x8230F078-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->NtRollbackTransaction, Type: EAT modification 0x8230F07C-->8263F041 [acpi.sys]
ntkrnlpa.exe-->NtSetEaFile, Type: EAT modification 0x8230F080-->8247F065 [unknown_code_page]
ntkrnlpa.exe-->NtSetEvent, Type: EAT modification 0x8230F084-->8249F055 [unknown_code_page]
ntkrnlpa.exe-->NtSetInformationEnlistment, Type: EAT modification 0x8230F088-->8269F057 [BATTC.SYS]
ntkrnlpa.exe-->NtSetInformationFile, Type: EAT modification 0x8230F08C-->8267F064 [pci.sys]
ntkrnlpa.exe-->NtSetInformationProcess, Type: EAT modification 0x8230F090-->8274F065 [fltmgr.sys]
ntkrnlpa.exe-->NtSetInformationResourceManager, Type: EAT modification 0x8230F094-->8242F02D [unknown_code_page]
ntkrnlpa.exe-->NtSetInformationThread, Type: EAT modification 0x8230F098-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->NtSetInformationTransaction, Type: EAT modification 0x8230F09C-->824FF07A [unknown_code_page]
ntkrnlpa.exe-->NtSetQuotaInformationFile, Type: EAT modification 0x8230F0A0-->8274F070 [fltmgr.sys]
ntkrnlpa.exe-->NtSetSecurityObject, Type: EAT modification 0x8230F0A4-->826FF069 [pciide.sys]
ntkrnlpa.exe-->NtSetVolumeInformationFile, Type: EAT modification 0x8230F0A8-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->NtShutdownSystem, Type: EAT modification 0x8230F0AC-->8272F047 [ataport.SYS]
ntkrnlpa.exe-->NtThawTransactions, Type: EAT modification 0x8230F0B0-->8275F06F [fltmgr.sys]
ntkrnlpa.exe-->NtTraceControl, Type: EAT modification 0x8230F0B4-->822EF070 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtTraceEvent, Type: EAT modification 0x8230F0B8-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->NtUnlockFile, Type: EAT modification 0x8230F0BC-->8200F061 [ntkrnlpa.exe]
ntkrnlpa.exe-->NtVdmControl, Type: EAT modification 0x8230F0C0-->E89DD1BC [unknown_code_page]
ntkrnlpa.exe-->NtWaitForSingleObject, Type: EAT modification 0x8230F0C4-->CFA85BE7 [unknown_code_page]
ntkrnlpa.exe-->ObAssignSecurity, Type: EAT modification 0x8230F0CC-->823AF10A [ntkrnlpa.exe]
ntkrnlpa.exe-->ObCheckCreateObjectAccess, Type: EAT modification 0x8230F0D0-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->ObCheckObjectAccess, Type: EAT modification 0x8230F0D4-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->ObCloseHandle, Type: EAT modification 0x8230F0D8-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->ObCreateObject, Type: EAT modification 0x8230F0DC-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->ObCreateObjectType, Type: EAT modification 0x8230F0E0-->8262F075 [acpi.sys]
ntkrnlpa.exe-->ObDeleteCapturedInsertInfo, Type: EAT modification 0x8230F0E4-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->ObDereferenceObject, Type: EAT modification 0x8230F0E8-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->ObDereferenceObjectDeferDelete, Type: EAT modification 0x8230F0EC-->8261F047 [acpi.sys]
ntkrnlpa.exe-->ObDereferenceSecurityDescriptor, Type: EAT modification 0x8230F0F0-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->ObfDereferenceObject, Type: EAT modification 0x8230E17C-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->ObFindHandleForObject, Type: EAT modification 0x8230F0F4-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->ObfReferenceObject, Type: EAT modification 0x8230E180-->825CF034 [unknown_code_page]
ntkrnlpa.exe-->ObGetFilterVersion, Type: EAT modification 0x8230F0F8-->826FF057 [pciide.sys]
ntkrnlpa.exe-->ObGetObjectSecurity, Type: EAT modification 0x8230F0FC-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->ObInsertObject, Type: EAT modification 0x8230F100-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->ObIsDosDeviceLocallyMapped, Type: EAT modification 0x8230F104-->8266F06F [pci.sys]
ntkrnlpa.exe-->ObIsKernelHandle, Type: EAT modification 0x8230F108-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->ObLogSecurityDescriptor, Type: EAT modification 0x8230F10C-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->ObMakeTemporaryObject, Type: EAT modification 0x8230F110-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->ObOpenObjectByName, Type: EAT modification 0x8230F114-->8266F061 [pci.sys]
ntkrnlpa.exe-->ObOpenObjectByPointer, Type: EAT modification 0x8230F118-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->ObQueryNameString, Type: EAT modification 0x8230F11C-->826EF049 [volmgrx.sys]
ntkrnlpa.exe-->ObQueryObjectAuditingByHandle, Type: EAT modification 0x8230F120-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->ObReferenceObjectByHandle, Type: EAT modification 0x8230F124-->8266F072 [pci.sys]
ntkrnlpa.exe-->ObReferenceObjectByName, Type: EAT modification 0x8230F128-->8263F061 [acpi.sys]
ntkrnlpa.exe-->ObReferenceObjectByPointer, Type: EAT modification 0x8230F12C-->825CF065 [unknown_code_page]
ntkrnlpa.exe-->ObReferenceSecurityDescriptor, Type: EAT modification 0x8230F130-->8264F041 [acpi.sys]
ntkrnlpa.exe-->ObRegisterCallbacks, Type: EAT modification 0x8230F134-->824FF064 [unknown_code_page]
ntkrnlpa.exe-->ObReleaseObjectSecurity, Type: EAT modification 0x8230F138-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->ObSetHandleAttributes, Type: EAT modification 0x8230F13C-->8242F05C [unknown_code_page]
ntkrnlpa.exe-->ObSetSecurityDescriptorInfo, Type: EAT modification 0x8230F140-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->ObSetSecurityObjectByPointer, Type: EAT modification 0x8230F144-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->ObUnRegisterCallbacks, Type: EAT modification 0x8230F148-->8264F06E [acpi.sys]
ntkrnlpa.exe-->PfFileInfoNotify, Type: EAT modification 0x8230F150-->8273F062 [ataport.SYS]
ntkrnlpa.exe-->PfxFindPrefix, Type: EAT modification 0x8230F154-->8241F05C [unknown_code_page]
ntkrnlpa.exe-->PfxInitialize, Type: EAT modification 0x8230F158-->8265F063 [msisadrv.sys]
ntkrnlpa.exe-->PfxInsertPrefix, Type: EAT modification 0x8230F15C-->8255F047 [unknown_code_page]
ntkrnlpa.exe-->PfxRemovePrefix, Type: EAT modification 0x8230F160-->822DF049 [ntkrnlpa.exe]
ntkrnlpa.exe-->PoCallDriver, Type: EAT modification 0x8230F164-->822EF033 [ntkrnlpa.exe]
ntkrnlpa.exe-->PoCancelDeviceNotify, Type: EAT modification 0x8230F168-->825CF030 [unknown_code_page]
ntkrnlpa.exe-->PoDisableSleepStates, Type: EAT modification 0x8230F16C-->8269F077 [BATTC.SYS]
ntkrnlpa.exe-->PoGetSystemWake, Type: EAT modification 0x8230F170-->8267F064 [pci.sys]
ntkrnlpa.exe-->POGOBuffer, Type: EAT modification 0x8230F14C-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->PoQueueShutdownWorkItem, Type: EAT modification 0x8230F174-->8274F065 [fltmgr.sys]
ntkrnlpa.exe-->PoReenableSleepStates, Type: EAT modification 0x8230F178-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->PoRegisterDeviceForIdleDetection, Type: EAT modification 0x8230F17C-->8263F041 [acpi.sys]
ntkrnlpa.exe-->PoRegisterDeviceNotify, Type: EAT modification 0x8230F180-->8247F065 [unknown_code_page]
ntkrnlpa.exe-->PoRegisterPowerSettingCallback, Type: EAT modification 0x8230F184-->8249F055 [unknown_code_page]
ntkrnlpa.exe-->PoRegisterSystemState, Type: EAT modification 0x8230F188-->8269F057 [BATTC.SYS]
ntkrnlpa.exe-->PoRequestPowerIrp, Type: EAT modification 0x8230F18C-->8267F064 [pci.sys]
ntkrnlpa.exe-->PoRequestShutdownEvent, Type: EAT modification 0x8230F190-->8274F065 [fltmgr.sys]
ntkrnlpa.exe-->PoSetDeviceBusyEx, Type: EAT modification 0x8230F194-->8249F02D [unknown_code_page]
ntkrnlpa.exe-->PoSetFixedWakeSource, Type: EAT modification 0x8230F198-->8274F06E [fltmgr.sys]
ntkrnlpa.exe-->PoSetHiberRange, Type: EAT modification 0x8230F19C-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->PoSetPowerState, Type: EAT modification 0x8230F1A0-->8263F061 [acpi.sys]
ntkrnlpa.exe-->PoSetSystemState, Type: EAT modification 0x8230F1A4-->8269F074 [BATTC.SYS]
ntkrnlpa.exe-->PoSetSystemWake, Type: EAT modification 0x8230F1A8-->8265F076 [msisadrv.sys]
ntkrnlpa.exe-->PoShutdownBugCheck, Type: EAT modification 0x8230F1AC-->8261F04C [acpi.sys]
ntkrnlpa.exe-->PoStartNextPowerIrp, Type: EAT modification 0x8230F1B0-->8265F062 [msisadrv.sys]
ntkrnlpa.exe-->PoUnregisterPowerSettingCallback, Type: EAT modification 0x8230F1B4-->822EF06C [ntkrnlpa.exe]
ntkrnlpa.exe-->PoUnregisterSystemState, Type: EAT modification 0x8230F1B8-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->PoUserShutdownInitiated, Type: EAT modification 0x8230F1BC-->8200F061 [ntkrnlpa.exe]
ntkrnlpa.exe-->ProbeForRead, Type: EAT modification 0x8230F1C0-->E89DD1BC [unknown_code_page]
ntkrnlpa.exe-->ProbeForWrite, Type: EAT modification 0x8230F1C4-->CFA85A04 [unknown_code_page]
ntkrnlpa.exe-->PsAssignImpersonationToken, Type: EAT modification 0x8230F1CC-->823AF12B [ntkrnlpa.exe]
ntkrnlpa.exe-->PsChargePoolQuota, Type: EAT modification 0x8230F1D0-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->PsChargeProcessCpuCycles, Type: EAT modification 0x8230F1D4-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->PsChargeProcessNonPagedPoolQuota, Type: EAT modification 0x8230F1D8-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->PsChargeProcessPagedPoolQuota, Type: EAT modification 0x8230F1DC-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->PsChargeProcessPoolQuota, Type: EAT modification 0x8230F1E0-->8262F075 [acpi.sys]
ntkrnlpa.exe-->PsCreateSystemThread, Type: EAT modification 0x8230F1E4-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->PsDereferenceImpersonationToken, Type: EAT modification 0x8230F1E8-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->PsDereferencePrimaryToken, Type: EAT modification 0x8230F1EC-->8261F047 [acpi.sys]
ntkrnlpa.exe-->PsDisableImpersonation, Type: EAT modification 0x8230F1F0-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->PsEnterPriorityRegion, Type: EAT modification 0x8230F1F4-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->PsEstablishWin32Callouts, Type: EAT modification 0x8230F1F8-->826FF057 [pciide.sys]
ntkrnlpa.exe-->PsGetContextThread, Type: EAT modification 0x8230F1FC-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->PsGetCurrentProcess, Type: EAT modification 0x8230F200-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsGetCurrentProcessId, Type: EAT modification 0x8230F204-->8266F06F [pci.sys]
ntkrnlpa.exe-->PsGetCurrentProcessSessionId, Type: EAT modification 0x8230F208-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->PsGetCurrentProcessWin32Process, Type: EAT modification 0x8230F20C-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->PsGetCurrentThread, Type: EAT modification 0x8230F210-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->PsGetCurrentThreadId, Type: EAT modification 0x8230F214-->8266F061 [pci.sys]
ntkrnlpa.exe-->PsGetCurrentThreadPreviousMode, Type: EAT modification 0x8230F218-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->PsGetCurrentThreadProcess, Type: EAT modification 0x8230F21C-->826EF049 [volmgrx.sys]
ntkrnlpa.exe-->PsGetCurrentThreadProcessId, Type: EAT modification 0x8230F220-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->PsGetCurrentThreadStackBase, Type: EAT modification 0x8230F224-->8266F072 [pci.sys]
ntkrnlpa.exe-->PsGetCurrentThreadStackLimit, Type: EAT modification 0x8230F228-->8263F061 [acpi.sys]
ntkrnlpa.exe-->PsGetCurrentThreadTeb, Type: EAT modification 0x8230F22C-->825CF065 [unknown_code_page]
ntkrnlpa.exe-->PsGetCurrentThreadWin32Thread, Type: EAT modification 0x8230F230-->8264F041 [acpi.sys]
ntkrnlpa.exe-->PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion, Type: EAT modification 0x8230F234-->824FF064 [unknown_code_page]
ntkrnlpa.exe-->PsGetJobLock, Type: EAT modification 0x8230F238-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->PsGetJobSessionId, Type: EAT modification 0x8230F23C-->8242F05C [unknown_code_page]
ntkrnlpa.exe-->PsGetJobUIRestrictionsClass, Type: EAT modification 0x8230F240-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->PsGetProcessCreateTimeQuadPart, Type: EAT modification 0x8230F244-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->PsGetProcessDebugPort, Type: EAT modification 0x8230F248-->8264F06E [acpi.sys]
ntkrnlpa.exe-->PsGetProcessExitProcessCalled, Type: EAT modification 0x8230F24C-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->PsGetProcessExitStatus, Type: EAT modification 0x8230F250-->825CF034 [unknown_code_page]
ntkrnlpa.exe-->PsGetProcessExitTime, Type: EAT modification 0x8230F254-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->PsGetProcessId, Type: EAT modification 0x8230F258-->8273F062 [ataport.SYS]
ntkrnlpa.exe-->PsGetProcessImageFileName, Type: EAT modification 0x8230F25C-->8241F05C [unknown_code_page]
ntkrnlpa.exe-->PsGetProcessInheritedFromUniqueProcessId, Type: EAT modification 0x8230F260-->8265F063 [msisadrv.sys]
ntkrnlpa.exe-->PsGetProcessJob, Type: EAT modification 0x8230F264-->8255F047 [unknown_code_page]
ntkrnlpa.exe-->PsGetProcessPeb, Type: EAT modification 0x8230F268-->822DF049 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsGetProcessPriorityClass, Type: EAT modification 0x8230F26C-->822EF033 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsGetProcessSectionBaseAddress, Type: EAT modification 0x8230F270-->825CF030 [unknown_code_page]
ntkrnlpa.exe-->PsGetProcessSecurityPort, Type: EAT modification 0x8230F274-->8269F077 [BATTC.SYS]
ntkrnlpa.exe-->PsGetProcessSessionId, Type: EAT modification 0x8230F278-->8267F064 [pci.sys]
ntkrnlpa.exe-->PsGetProcessSessionIdEx, Type: EAT modification 0x8230F27C-->8274F065 [fltmgr.sys]
ntkrnlpa.exe-->PsGetProcessWin32Process, Type: EAT modification 0x8230F280-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->PsGetProcessWin32WindowStation, Type: EAT modification 0x8230F284-->8263F041 [acpi.sys]
ntkrnlpa.exe-->PsGetThreadFreezeCount, Type: EAT modification 0x8230F288-->8247F065 [unknown_code_page]
ntkrnlpa.exe-->PsGetThreadHardErrorsAreDisabled, Type: EAT modification 0x8230F28C-->8249F055 [unknown_code_page]
ntkrnlpa.exe-->PsGetThreadId, Type: EAT modification 0x8230F290-->8269F057 [BATTC.SYS]
ntkrnlpa.exe-->PsGetThreadProcess, Type: EAT modification 0x8230F294-->8267F064 [pci.sys]
ntkrnlpa.exe-->PsGetThreadProcessId, Type: EAT modification 0x8230F298-->8274F065 [fltmgr.sys]
ntkrnlpa.exe-->PsGetThreadSessionId, Type: EAT modification 0x8230F29C-->824DF02D [unknown_code_page]
ntkrnlpa.exe-->PsGetThreadTeb, Type: EAT modification 0x8230F2A0-->826CF075 [volmgrx.sys]
ntkrnlpa.exe-->PsGetThreadWin32Thread, Type: EAT modification 0x8230F2A4-->8269F074 [BATTC.SYS]
ntkrnlpa.exe-->PsGetVersion, Type: EAT modification 0x8230F2A8-->8269F04C [BATTC.SYS]
ntkrnlpa.exe-->PsImpersonateClient, Type: EAT modification 0x8230F2AC-->8265F06E [msisadrv.sys]
ntkrnlpa.exe-->PsInitialSystemProcess, Type: EAT modification 0x8230F2B0-->8264F045 [acpi.sys]
ntkrnlpa.exe-->PsIsCurrentThreadPrefetching, Type: EAT modification 0x8230F2B4-->8274F069 [fltmgr.sys]
ntkrnlpa.exe-->PsIsProcessBeingDebugged, Type: EAT modification 0x8230F2B8-->826FF042 [pciide.sys]
ntkrnlpa.exe-->PsIsProtectedProcess, Type: EAT modification 0x8230F2BC-->822EF078 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsIsSystemProcess, Type: EAT modification 0x8230F2C0-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->PsIsSystemThread, Type: EAT modification 0x8230F2C4-->8200F061 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsIsThreadImpersonating, Type: EAT modification 0x8230F2C8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsIsThreadTerminating, Type: EAT modification 0x8230F2CC-->CFA85A25 [unknown_code_page]
ntkrnlpa.exe-->PsLeavePriorityRegion, Type: EAT modification 0x8230F2D4-->823AF14C [ntkrnlpa.exe]
ntkrnlpa.exe-->PsLookupProcessByProcessId, Type: EAT modification 0x8230F2D8-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->PsLookupProcessThreadByCid, Type: EAT modification 0x8230F2DC-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->PsLookupThreadByThreadId, Type: EAT modification 0x8230F2E0-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->psMUITest, Type: EAT modification 0x8230FE30-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->PsProcessType, Type: EAT modification 0x8230F2E4-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->PsQueryProcessExceptionFlags, Type: EAT modification 0x8230F2E8-->8262F075 [acpi.sys]
ntkrnlpa.exe-->PsReferenceImpersonationToken, Type: EAT modification 0x8230F2EC-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->PsReferencePrimaryToken, Type: EAT modification 0x8230F2F0-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->PsReferenceProcessFilePointer, Type: EAT modification 0x8230F2F4-->8261F047 [acpi.sys]
ntkrnlpa.exe-->PsReleaseProcessExitSynchronization, Type: EAT modification 0x8230F2F8-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->PsRemoveCreateThreadNotifyRoutine, Type: EAT modification 0x8230F2FC-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->PsRemoveLoadImageNotifyRoutine, Type: EAT modification 0x8230F300-->826FF057 [pciide.sys]
ntkrnlpa.exe-->PsRestoreImpersonation, Type: EAT modification 0x8230F304-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->PsResumeProcess, Type: EAT modification 0x8230F308-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsReturnPoolQuota, Type: EAT modification 0x8230F30C-->8266F06F [pci.sys]
ntkrnlpa.exe-->PsReturnProcessNonPagedPoolQuota, Type: EAT modification 0x8230F310-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->PsReturnProcessPagedPoolQuota, Type: EAT modification 0x8230F314-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->PsRevertThreadToSelf, Type: EAT modification 0x8230F318-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->PsRevertToSelf, Type: EAT modification 0x8230F31C-->8266F061 [pci.sys]
ntkrnlpa.exe-->PsSetContextThread, Type: EAT modification 0x8230F320-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->PsSetCreateProcessNotifyRoutine, Type: EAT modification 0x8230F324-->826EF049 [volmgrx.sys]
ntkrnlpa.exe-->PsSetCreateProcessNotifyRoutineEx, Type: EAT modification 0x8230F328-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->PsSetCreateThreadNotifyRoutine, Type: EAT modification 0x8230F32C-->8266F072 [pci.sys]
ntkrnlpa.exe-->PsSetCurrentThreadPrefetching, Type: EAT modification 0x8230F330-->8263F061 [acpi.sys]
ntkrnlpa.exe-->PsSetJobUIRestrictionsClass, Type: EAT modification 0x8230F334-->825CF065 [unknown_code_page]
ntkrnlpa.exe-->PsSetLegoNotifyRoutine, Type: EAT modification 0x8230F338-->8264F041 [acpi.sys]
ntkrnlpa.exe-->PsSetLoadImageNotifyRoutine, Type: EAT modification 0x8230F33C-->824FF064 [unknown_code_page]
ntkrnlpa.exe-->PsSetProcessPriorityByClass, Type: EAT modification 0x8230F340-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->PsSetProcessPriorityClass, Type: EAT modification 0x8230F344-->8243F05C [unknown_code_page]
ntkrnlpa.exe-->PsSetProcessSecurityPort, Type: EAT modification 0x8230F348-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->PsSetProcessWin32Process, Type: EAT modification 0x8230F34C-->826FF074 [pciide.sys]
ntkrnlpa.exe-->PsSetProcessWindowStation, Type: EAT modification 0x8230F350-->8272F067 [ataport.SYS]
ntkrnlpa.exe-->PsSetThreadHardErrorsAreDisabled, Type: EAT modification 0x8230F354-->8270F061 [PCIIDEX.SYS]
ntkrnlpa.exe-->PsSetThreadWin32Thread, Type: EAT modification 0x8230F358-->8265F068 [msisadrv.sys]
ntkrnlpa.exe-->PsSuspendProcess, Type: EAT modification 0x8230F35C-->8233F072 [ntkrnlpa.exe]
ntkrnlpa.exe-->PsTerminateSystemThread, Type: EAT modification 0x8230F360-->8249F05F [unknown_code_page]
ntkrnlpa.exe-->PsThreadType, Type: EAT modification 0x8230F364-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->PsUILanguageComitted, Type: EAT modification 0x8230F368-->8261F074 [acpi.sys]
ntkrnlpa.exe-->PsWrapApcWow64Thread, Type: EAT modification 0x8230F36C-->8263F06E [acpi.sys]
ntkrnlpa.exe-->qsort, Type: EAT modification 0x8230FE34-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->rand, Type: EAT modification 0x8230FE38-->8261F047 [acpi.sys]
ntkrnlpa.exe-->READ_REGISTER_BUFFER_UCHAR, Type: EAT modification 0x8230F370-->8250F065 [unknown_code_page]
ntkrnlpa.exe-->READ_REGISTER_BUFFER_ULONG, Type: EAT modification 0x8230F374-->8249F04F [unknown_code_page]
ntkrnlpa.exe-->READ_REGISTER_BUFFER_USHORT, Type: EAT modification 0x8230F378-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->READ_REGISTER_UCHAR, Type: EAT modification 0x8230F37C-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->READ_REGISTER_ULONG, Type: EAT modification 0x8230F380-->8273F062 [ataport.SYS]
ntkrnlpa.exe-->READ_REGISTER_USHORT, Type: EAT modification 0x8230F384-->824CF05C [unknown_code_page]
ntkrnlpa.exe-->RtlAbsoluteToSelfRelativeSD, Type: EAT modification 0x8230F388-->8262F069 [acpi.sys]
ntkrnlpa.exe-->RtlAddAccessAllowedAce, Type: EAT modification 0x8230F38C-->8261F042 [acpi.sys]
ntkrnlpa.exe-->RtlAddAccessAllowedAceEx, Type: EAT modification 0x8230F390-->8262F062 [acpi.sys]
ntkrnlpa.exe-->RtlAddAce, Type: EAT modification 0x8230F394-->8265F06C [msisadrv.sys]
ntkrnlpa.exe-->RtlAddAtomToAtomTable, Type: EAT modification 0x8230F398-->8242F02D [unknown_code_page]
ntkrnlpa.exe-->RtlAddRange, Type: EAT modification 0x8230F39C-->8273F06F [ataport.SYS]
ntkrnlpa.exe-->RtlAllocateHeap, Type: EAT modification 0x8230F3A0-->822DF073 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlAnsiCharToUnicodeChar, Type: EAT modification 0x8230F3A4-->822EF033 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlAnsiStringToUnicodeSize, Type: EAT modification 0x8230F3A8-->825CF030 [unknown_code_page]
ntkrnlpa.exe-->RtlAnsiStringToUnicodeString, Type: EAT modification 0x8230F3AC-->8269F04C [BATTC.SYS]
ntkrnlpa.exe-->RtlAppendAsciizToString, Type: EAT modification 0x8230F3B0-->8242F062 [unknown_code_page]
ntkrnlpa.exe-->RtlAppendStringToString, Type: EAT modification 0x8230F3B4-->8262F061 [acpi.sys]
ntkrnlpa.exe-->RtlAppendUnicodeStringToString, Type: EAT modification 0x8230F3B8-->826CF062 [volmgrx.sys]
ntkrnlpa.exe-->RtlAppendUnicodeToString, Type: EAT modification 0x8230F3BC-->822DF065 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlAreAllAccessesGranted, Type: EAT modification 0x8230F3C0-->822EF033 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlAreAnyAccessesGranted, Type: EAT modification 0x8230F3C4-->822EF030 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlAreBitsClear, Type: EAT modification 0x8230F3C8-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->RtlAreBitsSet, Type: EAT modification 0x8230F3CC-->8200F061 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlAssert, Type: EAT modification 0x8230F3D0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlCaptureContext, Type: EAT modification 0x8230F3D4-->CFA85A5A [unknown_code_page]
ntkrnlpa.exe-->RtlCharToInteger, Type: EAT modification 0x8230F3DC-->823AF16D [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlCheckRegistryKey, Type: EAT modification 0x8230F3E0-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->RtlClearAllBits, Type: EAT modification 0x8230F3E4-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->RtlClearBit, Type: EAT modification 0x8230F3E8-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->RtlClearBits, Type: EAT modification 0x8230F3EC-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->RtlCmDecodeMemIoResource, Type: EAT modification 0x8230F3F0-->8262F075 [acpi.sys]
ntkrnlpa.exe-->RtlCmEncodeMemIoResource, Type: EAT modification 0x8230F3F4-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->RtlCompareAltitudes, Type: EAT modification 0x8230F3F8-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->RtlCompareMemory, Type: EAT modification 0x8230F3FC-->8261F047 [acpi.sys]
ntkrnlpa.exe-->RtlCompareMemoryUlong, Type: EAT modification 0x8230F400-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->RtlCompareString, Type: EAT modification 0x8230F404-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlCompareUnicodeString, Type: EAT modification 0x8230F408-->826FF057 [pciide.sys]
ntkrnlpa.exe-->RtlCompressBuffer, Type: EAT modification 0x8230F40C-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->RtlCompressChunks, Type: EAT modification 0x8230F410-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlComputeCrc32, Type: EAT modification 0x8230F414-->8266F06F [pci.sys]
ntkrnlpa.exe-->RtlConvertLongToLargeInteger, Type: EAT modification 0x8230F418-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->RtlConvertSidToUnicodeString, Type: EAT modification 0x8230F41C-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlConvertUlongToLargeInteger, Type: EAT modification 0x8230F420-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->RtlCopyLuid, Type: EAT modification 0x8230F424-->8266F061 [pci.sys]
ntkrnlpa.exe-->RtlCopyLuidAndAttributesArray, Type: EAT modification 0x8230F428-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlCopyRangeList, Type: EAT modification 0x8230F42C-->826EF049 [volmgrx.sys]
ntkrnlpa.exe-->RtlCopySid, Type: EAT modification 0x8230F430-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->RtlCopySidAndAttributesArray, Type: EAT modification 0x8230F434-->8266F072 [pci.sys]
ntkrnlpa.exe-->RtlCopyString, Type: EAT modification 0x8230F438-->8263F061 [acpi.sys]
ntkrnlpa.exe-->RtlCopyUnicodeString, Type: EAT modification 0x8230F43C-->825CF065 [unknown_code_page]
ntkrnlpa.exe-->RtlCreateAcl, Type: EAT modification 0x8230F440-->8264F041 [acpi.sys]
ntkrnlpa.exe-->RtlCreateAtomTable, Type: EAT modification 0x8230F444-->824FF064 [unknown_code_page]
ntkrnlpa.exe-->RtlCreateHeap, Type: EAT modification 0x8230F448-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->RtlCreateRegistryKey, Type: EAT modification 0x8230F44C-->8243F05C [unknown_code_page]
ntkrnlpa.exe-->RtlCreateSecurityDescriptor, Type: EAT modification 0x8230F450-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlCreateSystemVolumeInformationFolder, Type: EAT modification 0x8230F454-->826FF074 [pciide.sys]
ntkrnlpa.exe-->RtlCreateUnicodeString, Type: EAT modification 0x8230F458-->8272F067 [ataport.SYS]
ntkrnlpa.exe-->RtlCustomCPToUnicodeN, Type: EAT modification 0x8230F45C-->8270F061 [PCIIDEX.SYS]
ntkrnlpa.exe-->RtlDecompressBuffer, Type: EAT modification 0x8230F460-->8265F068 [msisadrv.sys]
ntkrnlpa.exe-->RtlDecompressChunks, Type: EAT modification 0x8230F464-->8233F072 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlDecompressFragment, Type: EAT modification 0x8230F468-->8249F05F [unknown_code_page]
ntkrnlpa.exe-->RtlDelete, Type: EAT modification 0x8230F46C-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->RtlDeleteAce, Type: EAT modification 0x8230F470-->8261F074 [acpi.sys]
ntkrnlpa.exe-->RtlDeleteAtomFromAtomTable, Type: EAT modification 0x8230F474-->8263F06E [acpi.sys]
ntkrnlpa.exe-->RtlDeleteElementGenericTable, Type: EAT modification 0x8230F478-->8250F065 [unknown_code_page]
ntkrnlpa.exe-->RtlDeleteElementGenericTableAvl, Type: EAT modification 0x8230F47C-->8249F04F [unknown_code_page]
ntkrnlpa.exe-->RtlDeleteNoSplay, Type: EAT modification 0x8230F480-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlDeleteOwnersRanges, Type: EAT modification 0x8230F484-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->RtlDeleteRange, Type: EAT modification 0x8230F488-->8273F062 [ataport.SYS]
ntkrnlpa.exe-->RtlDeleteRegistryValue, Type: EAT modification 0x8230F48C-->824CF05C [unknown_code_page]
ntkrnlpa.exe-->RtlDescribeChunk, Type: EAT modification 0x8230F490-->8262F069 [acpi.sys]
ntkrnlpa.exe-->RtlDestroyAtomTable, Type: EAT modification 0x8230F494-->8261F042 [acpi.sys]
ntkrnlpa.exe-->RtlDestroyHeap, Type: EAT modification 0x8230F498-->8262F062 [acpi.sys]
ntkrnlpa.exe-->RtlDowncaseUnicodeString, Type: EAT modification 0x8230F49C-->8265F06C [msisadrv.sys]
ntkrnlpa.exe-->RtlDuplicateUnicodeString, Type: EAT modification 0x8230F4A0-->8242F02D [unknown_code_page]
ntkrnlpa.exe-->RtlEmptyAtomTable, Type: EAT modification 0x8230F4A4-->8273F06F [ataport.SYS]
ntkrnlpa.exe-->RtlEnlargedIntegerMultiply, Type: EAT modification 0x8230F4A8-->822DF073 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlEnlargedUnsignedDivide, Type: EAT modification 0x8230F4AC-->822EF033 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlEnlargedUnsignedMultiply, Type: EAT modification 0x8230F4B0-->825CF030 [unknown_code_page]
ntkrnlpa.exe-->RtlEnumerateGenericTable, Type: EAT modification 0x8230F4B4-->8269F04C [BATTC.SYS]
ntkrnlpa.exe-->RtlEnumerateGenericTableAvl, Type: EAT modification 0x8230F4B8-->8253F062 [unknown_code_page]
ntkrnlpa.exe-->RtlEnumerateGenericTableLikeADirectory, Type: EAT modification 0x8230F4BC-->8275F074 [fltmgr.sys]
ntkrnlpa.exe-->RtlEnumerateGenericTableWithoutSplaying, Type: EAT modification 0x8230F4C0-->825CF062 [unknown_code_page]
ntkrnlpa.exe-->RtlEnumerateGenericTableWithoutSplayingAvl, Type: EAT modification 0x8230F4C4-->8269F04C [BATTC.SYS]
ntkrnlpa.exe-->RtlEqualLuid, Type: EAT modification 0x8230F4C8-->8253F062 [unknown_code_page]
ntkrnlpa.exe-->RtlEqualSid, Type: EAT modification 0x8230F4CC-->8275F074 [fltmgr.sys]
ntkrnlpa.exe-->RtlEqualString, Type: EAT modification 0x8230F4D0-->822EF062 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlEqualUnicodeString, Type: EAT modification 0x8230F4D4-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->RtlExtendedIntegerMultiply, Type: EAT modification 0x8230F4D8-->8200F061 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlExtendedLargeIntegerDivide, Type: EAT modification 0x8230F4DC-->CFA85A7B [unknown_code_page]
ntkrnlpa.exe-->RtlFillMemory, Type: EAT modification 0x8230F4E4-->823AF18E [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlFillMemoryUlong, Type: EAT modification 0x8230F4E8-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->RtlFindClearBits, Type: EAT modification 0x8230F4EC-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->RtlFindClearBitsAndSet, Type: EAT modification 0x8230F4F0-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->RtlFindClearRuns, Type: EAT modification 0x8230F4F4-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->RtlFindClosestEncodableLength, Type: EAT modification 0x8230F4F8-->8262F075 [acpi.sys]
ntkrnlpa.exe-->RtlFindFirstRunClear, Type: EAT modification 0x8230F4FC-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->RtlFindLastBackwardRunClear, Type: EAT modification 0x8230F500-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->RtlFindLeastSignificantBit, Type: EAT modification 0x8230F504-->8261F047 [acpi.sys]
ntkrnlpa.exe-->RtlFindLongestRunClear, Type: EAT modification 0x8230F508-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->RtlFindMessage, Type: EAT modification 0x8230F50C-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlFindMostSignificantBit, Type: EAT modification 0x8230F510-->826FF057 [pciide.sys]
ntkrnlpa.exe-->RtlFindNextForwardRunClear, Type: EAT modification 0x8230F514-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->RtlFindRange, Type: EAT modification 0x8230F518-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlFindSetBits, Type: EAT modification 0x8230F51C-->8266F06F [pci.sys]
ntkrnlpa.exe-->RtlFindSetBitsAndClear, Type: EAT modification 0x8230F520-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->RtlFindUnicodePrefix, Type: EAT modification 0x8230F524-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlFormatCurrentUserKeyPath, Type: EAT modification 0x8230F528-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->RtlFormatMessage, Type: EAT modification 0x8230F52C-->8266F061 [pci.sys]
ntkrnlpa.exe-->RtlFreeAnsiString, Type: EAT modification 0x8230F530-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlFreeHeap, Type: EAT modification 0x8230F534-->8270F055 [PCIIDEX.SYS]
ntkrnlpa.exe-->RtlFreeOemString, Type: EAT modification 0x8230F538-->8261F064 [acpi.sys]
ntkrnlpa.exe-->RtlFreeRangeList, Type: EAT modification 0x8230F53C-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->RtlFreeUnicodeString, Type: EAT modification 0x8230F540-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlGenerate8dot3Name, Type: EAT modification 0x8230F548-->822DF057 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetAce, Type: EAT modification 0x8230F54C-->822EF078 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetCallersAddress, Type: EAT modification 0x8230F550-->822EF078 [ntkrnlpa.exe]
dalitaj
November 6, 2010, 3:30 AM UTC
WorkSpaceSize, Type: EAT modification 0x8230F554-->822EF078 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetDaclSecurityDescriptor, Type: EAT modification 0x8230F558-->822DF078 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetDefaultCodePage, Type: EAT modification 0x8230F55C-->822EF034 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetElementGenericTable, Type: EAT modification 0x8230F560-->822EF030 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetElementGenericTableAvl, Type: EAT modification 0x8230F564-->822EF030 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetFirstRange, Type: EAT modification 0x8230F568-->8232F031 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetGroupSecurityDescriptor, Type: EAT modification 0x8230F56C-->8231F039 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetIntegerAtom, Type: EAT modification 0x8230F570-->822DF031 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetNextRange, Type: EAT modification 0x8230F574-->8270F055 [PCIIDEX.SYS]
ntkrnlpa.exe-->RtlGetNtGlobalFlags, Type: EAT modification 0x8230F578-->8261F064 [acpi.sys]
ntkrnlpa.exe-->RtlGetOwnerSecurityDescriptor, Type: EAT modification 0x8230F57C-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->RtlGetProductInfo, Type: EAT modification 0x8230F580-->822EF072 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlGetSaclSecurityDescriptor, Type: EAT modification 0x8230F584-->8270F061 [PCIIDEX.SYS]
ntkrnlpa.exe-->RtlGetSetBootStatusData, Type: EAT modification 0x8230F588-->825CF070 [unknown_code_page]
ntkrnlpa.exe-->RtlGetThreadLangIdByIndex, Type: EAT modification 0x8230F58C-->826FF043 [pciide.sys]
ntkrnlpa.exe-->RtlGetVersion, Type: EAT modification 0x8230F590-->8274F06E [fltmgr.sys]
ntkrnlpa.exe-->RtlGUIDFromString, Type: EAT modification 0x8230F544-->826FF057 [pciide.sys]
ntkrnlpa.exe-->RtlHashUnicodeString, Type: EAT modification 0x8230F594-->826EF065 [volmgrx.sys]
ntkrnlpa.exe-->RtlIdnToAscii, Type: EAT modification 0x8230F598-->8273F074 [ataport.SYS]
ntkrnlpa.exe-->RtlIdnToNameprepUnicode, Type: EAT modification 0x8230F59C-->8252F05C [unknown_code_page]
ntkrnlpa.exe-->RtlIdnToUnicode, Type: EAT modification 0x8230F5A0-->8273F065 [ataport.SYS]
ntkrnlpa.exe-->RtlImageDirectoryEntryToData, Type: EAT modification 0x8230F5A4-->8275F06F [fltmgr.sys]
ntkrnlpa.exe-->RtlImageNtHeader, Type: EAT modification 0x8230F5A8-->8263F072 [acpi.sys]
ntkrnlpa.exe-->RtlInitAnsiString, Type: EAT modification 0x8230F5AC-->8273F065 [ataport.SYS]
ntkrnlpa.exe-->RtlInitAnsiStringEx, Type: EAT modification 0x8230F5B0-->8249F05C [unknown_code_page]
ntkrnlpa.exe-->RtlInitCodePageTable, Type: EAT modification 0x8230F5B4-->8273F06E [ataport.SYS]
ntkrnlpa.exe-->RtlInitializeBitMap, Type: EAT modification 0x8230F5C4-->8261F04D [acpi.sys]
ntkrnlpa.exe-->RtlInitializeGenericTable, Type: EAT modification 0x8230F5C8-->826EF069 [volmgrx.sys]
ntkrnlpa.exe-->RtlInitializeGenericTableAvl, Type: EAT modification 0x8230F5CC-->8269F057 [BATTC.SYS]
ntkrnlpa.exe-->RtlInitializeRangeList, Type: EAT modification 0x8230F5D0-->8264F06E [acpi.sys]
ntkrnlpa.exe-->RtlInitializeSid, Type: EAT modification 0x8230F5D4-->8277F06F [fileinfo.sys]
ntkrnlpa.exe-->RtlInitializeUnicodePrefix, Type: EAT modification 0x8230F5D8-->826EF02E [volmgrx.sys]
ntkrnlpa.exe-->RtlInitString, Type: EAT modification 0x8230F5B8-->8261F074 [acpi.sys]
ntkrnlpa.exe-->RtlInitUnicodeString, Type: EAT modification 0x8230F5BC-->826CF06C [volmgrx.sys]
ntkrnlpa.exe-->RtlInitUnicodeStringEx, Type: EAT modification 0x8230F5C0-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->RtlInsertElementGenericTable, Type: EAT modification 0x8230F5DC-->8262F069 [acpi.sys]
ntkrnlpa.exe-->RtlInsertElementGenericTableAvl, Type: EAT modification 0x8230F5E0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlInsertElementGenericTableFull, Type: EAT modification 0x8230F5E4-->CFA85A98 [unknown_code_page]
ntkrnlpa.exe-->RtlInsertUnicodePrefix, Type: EAT modification 0x8230F5EC-->823AF1AF [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlInt64ToUnicodeString, Type: EAT modification 0x8230F5F0-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->RtlIntegerToChar, Type: EAT modification 0x8230F5F4-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->RtlIntegerToUnicode, Type: EAT modification 0x8230F5F8-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->RtlIntegerToUnicodeString, Type: EAT modification 0x8230F5FC-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->RtlInvertRangeList, Type: EAT modification 0x8230F600-->8262F075 [acpi.sys]
ntkrnlpa.exe-->RtlInvertRangeListEx, Type: EAT modification 0x8230F604-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->RtlIoDecodeMemIoResource, Type: EAT modification 0x8230F608-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->RtlIoEncodeMemIoResource, Type: EAT modification 0x8230F60C-->8261F047 [acpi.sys]
ntkrnlpa.exe-->RtlIpv4AddressToStringA, Type: EAT modification 0x8230F610-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->RtlIpv4AddressToStringExA, Type: EAT modification 0x8230F614-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlIpv4AddressToStringExW, Type: EAT modification 0x8230F618-->826FF057 [pciide.sys]
ntkrnlpa.exe-->RtlIpv4AddressToStringW, Type: EAT modification 0x8230F61C-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->RtlIpv4StringToAddressA, Type: EAT modification 0x8230F620-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlIpv4StringToAddressExA, Type: EAT modification 0x8230F624-->8266F06F [pci.sys]
ntkrnlpa.exe-->RtlIpv4StringToAddressExW, Type: EAT modification 0x8230F628-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->RtlIpv4StringToAddressW, Type: EAT modification 0x8230F62C-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlIpv6AddressToStringA, Type: EAT modification 0x8230F630-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->RtlIpv6AddressToStringExA, Type: EAT modification 0x8230F634-->8266F061 [pci.sys]
ntkrnlpa.exe-->RtlIpv6AddressToStringExW, Type: EAT modification 0x8230F638-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlIpv6AddressToStringW, Type: EAT modification 0x8230F63C-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->RtlIpv6StringToAddressA, Type: EAT modification 0x8230F640-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->RtlIpv6StringToAddressExA, Type: EAT modification 0x8230F644-->8263F041 [acpi.sys]
ntkrnlpa.exe-->RtlIpv6StringToAddressExW, Type: EAT modification 0x8230F648-->826FF063 [pciide.sys]
ntkrnlpa.exe-->RtlIpv6StringToAddressW, Type: EAT modification 0x8230F64C-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->RtlIsGenericTableEmpty, Type: EAT modification 0x8230F650-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlIsGenericTableEmptyAvl, Type: EAT modification 0x8230F654-->8250F041 [unknown_code_page]
ntkrnlpa.exe-->RtlIsNameLegalDOS8Dot3, Type: EAT modification 0x8230F658-->8243F04F [unknown_code_page]
ntkrnlpa.exe-->RtlIsNormalizedString, Type: EAT modification 0x8230F65C-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->RtlIsNtDdiVersionAvailable, Type: EAT modification 0x8230F660-->824BF052 [unknown_code_page]
ntkrnlpa.exe-->RtlIsRangeAvailable, Type: EAT modification 0x8230F664-->8255F053 [unknown_code_page]
ntkrnlpa.exe-->RtlIsServicePackVersionInstalled, Type: EAT modification 0x8230F668-->825CF04E [unknown_code_page]
ntkrnlpa.exe-->RtlIsValidOemCharacter, Type: EAT modification 0x8230F66C-->8268F053 [partmgr.sys]
ntkrnlpa.exe-->RtlLargeIntegerAdd, Type: EAT modification 0x8230F670-->8274F061 [fltmgr.sys]
ntkrnlpa.exe-->RtlLargeIntegerArithmeticShift, Type: EAT modification 0x8230F674-->8265F074 [msisadrv.sys]
ntkrnlpa.exe-->RtlLargeIntegerDivide, Type: EAT modification 0x8230F678-->8265F072 [msisadrv.sys]
ntkrnlpa.exe-->RtlLargeIntegerNegate, Type: EAT modification 0x8230F67C-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlLargeIntegerShiftLeft, Type: EAT modification 0x8230F680-->8261F048 [acpi.sys]
ntkrnlpa.exe-->RtlLargeIntegerShiftRight, Type: EAT modification 0x8230F684-->826CF06C [volmgrx.sys]
ntkrnlpa.exe-->RtlLargeIntegerSubtract, Type: EAT modification 0x8230F688-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlLengthRequiredSid, Type: EAT modification 0x8230F68C-->8265F046 [msisadrv.sys]
ntkrnlpa.exe-->RtlLengthSecurityDescriptor, Type: EAT modification 0x8230F690-->826FF06C [pciide.sys]
ntkrnlpa.exe-->RtlLengthSid, Type: EAT modification 0x8230F694-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->RtlLocalTimeToSystemTime, Type: EAT modification 0x8230F698-->8276F061 [fltmgr.sys]
ntkrnlpa.exe-->RtlLockBootStatusData, Type: EAT modification 0x8230F69C-->8264F065 [acpi.sys]
ntkrnlpa.exe-->RtlLookupAtomInAtomTable, Type: EAT modification 0x8230F6A0-->8261F056 [acpi.sys]
ntkrnlpa.exe-->RtlLookupElementGenericTable, Type: EAT modification 0x8230F6A4-->8269F072 [BATTC.SYS]
ntkrnlpa.exe-->RtlLookupElementGenericTableAvl, Type: EAT modification 0x8230F6A8-->8262F061 [acpi.sys]
ntkrnlpa.exe-->RtlLookupElementGenericTableFull, Type: EAT modification 0x8230F6AC-->8265F06C [msisadrv.sys]
ntkrnlpa.exe-->RtlLookupElementGenericTableFullAvl, Type: EAT modification 0x8230F6B0-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlLookupFirstMatchingElementGenericTableAvl, Type: EAT modification 0x8230F6B4-->826CF042 [volmgrx.sys]
ntkrnlpa.exe-->RtlMapGenericMask, Type: EAT modification 0x8230F6B8-->827AF069 [cdrom.sys]
ntkrnlpa.exe-->RtlMapSecurityErrorToNtStatus, Type: EAT modification 0x8230F6BC-->8261F07A [acpi.sys]
ntkrnlpa.exe-->RtlMergeRangeLists, Type: EAT modification 0x8230F6C0-->8264F072 [acpi.sys]
ntkrnlpa.exe-->RtlMoveMemory, Type: EAT modification 0x8230F6C4-->8254F05F [unknown_code_page]
ntkrnlpa.exe-->RtlMultiByteToUnicodeN, Type: EAT modification 0x8230F6C8-->826DF069 [volmgrx.sys]
ntkrnlpa.exe-->RtlMultiByteToUnicodeSize, Type: EAT modification 0x8230F6CC-->824DF065 [unknown_code_page]
ntkrnlpa.exe-->RtlNextUnicodePrefix, Type: EAT modification 0x8230F6D0-->826EF061 [volmgrx.sys]
ntkrnlpa.exe-->RtlNormalizeString, Type: EAT modification 0x8230F6D4-->8267F061 [pci.sys]
ntkrnlpa.exe-->RtlNtStatusToDosError, Type: EAT modification 0x8230F6D8-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->RtlNtStatusToDosErrorNoTeb, Type: EAT modification 0x8230F6DC-->826CF02E [volmgrx.sys]
ntkrnlpa.exe-->RtlNumberGenericTableElements, Type: EAT modification 0x8230F6E0-->8261F075 [acpi.sys]
ntkrnlpa.exe-->RtlNumberGenericTableElementsAvl, Type: EAT modification 0x8230F6E4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlNumberOfClearBits, Type: EAT modification 0x8230F6E8-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlNumberOfSetBits, Type: EAT modification 0x8230F6EC-->CFA85AB9 [unknown_code_page]
ntkrnlpa.exe-->RtlOemStringToCountedUnicodeString, Type: EAT modification 0x8230F6F4-->823AF1D0 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlOemStringToUnicodeSize, Type: EAT modification 0x8230F6F8-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->RtlOemStringToUnicodeString, Type: EAT modification 0x8230F6FC-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->RtlOemToUnicodeN, Type: EAT modification 0x8230F700-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->RtlPinAtomInAtomTable, Type: EAT modification 0x8230F704-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->RtlPrefetchMemoryNonTemporal, Type: EAT modification 0x8230E184-->8262F075 [acpi.sys]
ntkrnlpa.exe-->RtlPrefixString, Type: EAT modification 0x8230F708-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->RtlPrefixUnicodeString, Type: EAT modification 0x8230F70C-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->RtlQueryAtomInAtomTable, Type: EAT modification 0x8230F710-->8261F047 [acpi.sys]
ntkrnlpa.exe-->RtlQueryDynamicTimeZoneInformation, Type: EAT modification 0x8230F714-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->RtlQueryElevationFlags, Type: EAT modification 0x8230F718-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlQueryModuleInformation, Type: EAT modification 0x8230F71C-->826FF057 [pciide.sys]
ntkrnlpa.exe-->RtlQueryRegistryValues, Type: EAT modification 0x8230F720-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->RtlQueryTimeZoneInformation, Type: EAT modification 0x8230F724-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlRaiseException, Type: EAT modification 0x8230F728-->8266F06F [pci.sys]
ntkrnlpa.exe-->RtlRandom, Type: EAT modification 0x8230F72C-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->RtlRandomEx, Type: EAT modification 0x8230F730-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlRealPredecessor, Type: EAT modification 0x8230F734-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->RtlRealSuccessor, Type: EAT modification 0x8230F738-->8266F061 [pci.sys]
ntkrnlpa.exe-->RtlRemoveUnicodePrefix, Type: EAT modification 0x8230F73C-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlReserveChunk, Type: EAT modification 0x8230F740-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->RtlRunOnceBeginInitialize, Type: EAT modification 0x8230F744-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->RtlRunOnceComplete, Type: EAT modification 0x8230F748-->8263F041 [acpi.sys]
ntkrnlpa.exe-->RtlRunOnceExecuteOnce, Type: EAT modification 0x8230F74C-->826FF063 [pciide.sys]
ntkrnlpa.exe-->RtlRunOnceInitialize, Type: EAT modification 0x8230F750-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->RtlSecondsSince1970ToTime, Type: EAT modification 0x8230F754-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlSecondsSince1980ToTime, Type: EAT modification 0x8230F758-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->RtlSelfRelativeToAbsoluteSD, Type: EAT modification 0x8230F760-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->RtlSelfRelativeToAbsoluteSD2, Type: EAT modification 0x8230F75C-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->RtlSetAllBits, Type: EAT modification 0x8230F764-->824CF05C [unknown_code_page]
ntkrnlpa.exe-->RtlSetBit, Type: EAT modification 0x8230F768-->8267F069 [pci.sys]
ntkrnlpa.exe-->RtlSetBits, Type: EAT modification 0x8230F76C-->8274F068 [fltmgr.sys]
ntkrnlpa.exe-->RtlSetDaclSecurityDescriptor, Type: EAT modification 0x8230F770-->8272F062 [ataport.SYS]
ntkrnlpa.exe-->RtlSetDynamicTimeZoneInformation, Type: EAT modification 0x8230F774-->826EF069 [volmgrx.sys]
ntkrnlpa.exe-->RtlSetGroupSecurityDescriptor, Type: EAT modification 0x8230F778-->8265F067 [msisadrv.sys]
ntkrnlpa.exe-->RtlSetOwnerSecurityDescriptor, Type: EAT modification 0x8230F77C-->825CF072 [unknown_code_page]
ntkrnlpa.exe-->RtlSetSaclSecurityDescriptor, Type: EAT modification 0x8230F780-->8261F046 [acpi.sys]
ntkrnlpa.exe-->RtlSetTimeZoneInformation, Type: EAT modification 0x8230F784-->826EF069 [volmgrx.sys]
ntkrnlpa.exe-->RtlSidHashInitialize, Type: EAT modification 0x8230F788-->8274F074 [fltmgr.sys]
ntkrnlpa.exe-->RtlSidHashLookup, Type: EAT modification 0x8230F78C-->826DF073 [volmgrx.sys]
ntkrnlpa.exe-->RtlSizeHeap, Type: EAT modification 0x8230F790-->826CF069 [volmgrx.sys]
ntkrnlpa.exe-->RtlSplay, Type: EAT modification 0x8230F794-->825CF065 [unknown_code_page]
ntkrnlpa.exe-->RtlStringFromGUID, Type: EAT modification 0x8230F798-->8261F053 [acpi.sys]
ntkrnlpa.exe-->RtlSubAuthorityCountSid, Type: EAT modification 0x8230F79C-->8265F076 [msisadrv.sys]
ntkrnlpa.exe-->RtlSubAuthoritySid, Type: EAT modification 0x8230F7A0-->8256F064 [unknown_code_page]
ntkrnlpa.exe-->RtlSubtreePredecessor, Type: EAT modification 0x8230F7A4-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlSubtreeSuccessor, Type: EAT modification 0x8230F7A8-->8261F069 [acpi.sys]
ntkrnlpa.exe-->RtlSystemTimeToLocalTime, Type: EAT modification 0x8230F7AC-->826CF062 [volmgrx.sys]
ntkrnlpa.exe-->RtlTestBit, Type: EAT modification 0x8230F7B0-->8273F065 [ataport.SYS]
ntkrnlpa.exe-->RtlTimeFieldsToTime, Type: EAT modification 0x8230F7B4-->8242F05C [unknown_code_page]
ntkrnlpa.exe-->RtlTimeToElapsedTimeFields, Type: EAT modification 0x8230F7B8-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->RtlTimeToSecondsSince1970, Type: EAT modification 0x8230F7BC-->827AF07A [cdrom.sys]
ntkrnlpa.exe-->RtlTimeToSecondsSince1980, Type: EAT modification 0x8230F7C0-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlTimeToTimeFields, Type: EAT modification 0x8230F7C4-->825FF064 [unknown_code_page]
ntkrnlpa.exe-->RtlTraceDatabaseAdd, Type: EAT modification 0x8230F7C8-->8269F054 [BATTC.SYS]
ntkrnlpa.exe-->RtlTraceDatabaseCreate, Type: EAT modification 0x8230F7CC-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->RtlTraceDatabaseDestroy, Type: EAT modification 0x8230F7D0-->8261F04D [acpi.sys]
ntkrnlpa.exe-->RtlTraceDatabaseEnumerate, Type: EAT modification 0x8230F7D4-->8261F06E [acpi.sys]
ntkrnlpa.exe-->RtlTraceDatabaseFind, Type: EAT modification 0x8230F7D8-->8265F067 [msisadrv.sys]
ntkrnlpa.exe-->RtlTraceDatabaseLock, Type: EAT modification 0x8230F7DC-->822EF072 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlTraceDatabaseUnlock, Type: EAT modification 0x8230F7E0-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->RtlTraceDatabaseValidate, Type: EAT modification 0x8230F7E4-->822EF061 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlUlongByteSwap, Type: EAT modification 0x8230E188-->8261F062 [acpi.sys]
ntkrnlpa.exe-->RtlUlonglongByteSwap, Type: EAT modification 0x8230E18C-->8200F06B [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlUnicodeStringToAnsiSize, Type: EAT modification 0x8230F7E8-->CFA85ADE [unknown_code_page]
ntkrnlpa.exe-->RtlUnicodeStringToCountedOemString, Type: EAT modification 0x8230F7F0-->823AF1F1 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlUnicodeStringToInteger, Type: EAT modification 0x8230F7F4-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->RtlUnicodeStringToOemSize, Type: EAT modification 0x8230F7F8-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->RtlUnicodeStringToOemString, Type: EAT modification 0x8230F7FC-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->RtlUnicodeToCustomCPN, Type: EAT modification 0x8230F800-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->RtlUnicodeToMultiByteN, Type: EAT modification 0x8230F804-->8262F075 [acpi.sys]
ntkrnlpa.exe-->RtlUnicodeToMultiByteSize, Type: EAT modification 0x8230F808-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->RtlUnicodeToOemN, Type: EAT modification 0x8230F80C-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->RtlUnlockBootStatusData, Type: EAT modification 0x8230F810-->8261F047 [acpi.sys]
ntkrnlpa.exe-->RtlUnwind, Type: EAT modification 0x8230F814-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->RtlUpcaseUnicodeChar, Type: EAT modification 0x8230F818-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->RtlUpcaseUnicodeString, Type: EAT modification 0x8230F81C-->826FF057 [pciide.sys]
ntkrnlpa.exe-->RtlUpcaseUnicodeStringToAnsiString, Type: EAT modification 0x8230F820-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->RtlUpcaseUnicodeStringToCountedOemString, Type: EAT modification 0x8230F824-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->RtlUpcaseUnicodeStringToOemString, Type: EAT modification 0x8230F828-->8266F06F [pci.sys]
ntkrnlpa.exe-->RtlUpcaseUnicodeToCustomCPN, Type: EAT modification 0x8230F82C-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->RtlUpcaseUnicodeToMultiByteN, Type: EAT modification 0x8230F830-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->RtlUpcaseUnicodeToOemN, Type: EAT modification 0x8230F834-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->RtlUpperChar, Type: EAT modification 0x8230F838-->8266F061 [pci.sys]
ntkrnlpa.exe-->RtlUpperString, Type: EAT modification 0x8230F83C-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlUshortByteSwap, Type: EAT modification 0x8230E190-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->RtlValidateUnicodeString, Type: EAT modification 0x8230F84C-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->RtlValidRelativeSecurityDescriptor, Type: EAT modification 0x8230F840-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->RtlValidSecurityDescriptor, Type: EAT modification 0x8230F844-->8263F041 [acpi.sys]
ntkrnlpa.exe-->RtlValidSid, Type: EAT modification 0x8230F848-->826FF063 [pciide.sys]
ntkrnlpa.exe-->RtlVerifyVersionInfo, Type: EAT modification 0x8230F850-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->RtlVolumeDeviceToDosName, Type: EAT modification 0x8230F854-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->RtlWalkFrameChain, Type: EAT modification 0x8230F858-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->RtlWriteRegistryValue, Type: EAT modification 0x8230F85C-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->RtlxAnsiStringToUnicodeSize, Type: EAT modification 0x8230F868-->8274F068 [fltmgr.sys]
ntkrnlpa.exe-->RtlxOemStringToUnicodeSize, Type: EAT modification 0x8230F86C-->8272F062 [ataport.SYS]
ntkrnlpa.exe-->RtlxUnicodeStringToAnsiSize, Type: EAT modification 0x8230F870-->826EF069 [volmgrx.sys]
ntkrnlpa.exe-->RtlxUnicodeStringToOemSize, Type: EAT modification 0x8230F874-->8265F067 [msisadrv.sys]
ntkrnlpa.exe-->RtlZeroHeap, Type: EAT modification 0x8230F860-->824CF05C [unknown_code_page]
ntkrnlpa.exe-->RtlZeroMemory, Type: EAT modification 0x8230F864-->8267F069 [pci.sys]
ntkrnlpa.exe-->SeAccessCheck, Type: EAT modification 0x8230F878-->825CF072 [unknown_code_page]
ntkrnlpa.exe-->SeAccessCheckFromState, Type: EAT modification 0x8230F87C-->8279F053 [cdrom.sys]
ntkrnlpa.exe-->SeAppendPrivileges, Type: EAT modification 0x8230F880-->8261F061 [acpi.sys]
ntkrnlpa.exe-->SeAssignSecurity, Type: EAT modification 0x8230F884-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->SeAssignSecurityEx, Type: EAT modification 0x8230F888-->8276F061 [fltmgr.sys]
ntkrnlpa.exe-->SeAuditHardLinkCreation, Type: EAT modification 0x8230F88C-->8264F065 [acpi.sys]
ntkrnlpa.exe-->SeAuditHardLinkCreationWithTransaction, Type: EAT modification 0x8230F890-->8261F056 [acpi.sys]
ntkrnlpa.exe-->SeAuditingFileEvents, Type: EAT modification 0x8230F898-->8262F061 [acpi.sys]
ntkrnlpa.exe-->SeAuditingFileEventsWithContext, Type: EAT modification 0x8230F89C-->8265F06C [msisadrv.sys]
ntkrnlpa.exe-->SeAuditingFileOrGlobalEvents, Type: EAT modification 0x8230F8A0-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->SeAuditingHardLinkEvents, Type: EAT modification 0x8230F8A4-->826CF042 [volmgrx.sys]
ntkrnlpa.exe-->SeAuditingHardLinkEventsWithContext, Type: EAT modification 0x8230F8A8-->827AF069 [cdrom.sys]
ntkrnlpa.exe-->SeAuditTransactionStateChange, Type: EAT modification 0x8230F894-->8269F072 [BATTC.SYS]
ntkrnlpa.exe-->SeCaptureSecurityDescriptor, Type: EAT modification 0x8230F8AC-->8261F07A [acpi.sys]
ntkrnlpa.exe-->SeCaptureSubjectContext, Type: EAT modification 0x8230F8B0-->8264F072 [acpi.sys]
ntkrnlpa.exe-->SeCaptureSubjectContextEx, Type: EAT modification 0x8230F8B4-->8242F05F [unknown_code_page]
ntkrnlpa.exe-->SeCloseObjectAuditAlarm, Type: EAT modification 0x8230F8B8-->8274F061 [fltmgr.sys]
ntkrnlpa.exe-->SeCloseObjectAuditAlarmForNonObObject, Type: EAT modification 0x8230F8BC-->826CF074 [volmgrx.sys]
ntkrnlpa.exe-->SeComputeAutoInheritByObjectType, Type: EAT modification 0x8230F8C0-->8266F065 [pci.sys]
ntkrnlpa.exe-->SeCreateAccessState, Type: EAT modification 0x8230F8C4-->8265F069 [msisadrv.sys]
ntkrnlpa.exe-->SeCreateAccessStateEx, Type: EAT modification 0x8230F8C8-->8264F06C [acpi.sys]
ntkrnlpa.exe-->SeCreateClientSecurity, Type: EAT modification 0x8230F8CC-->8269F04D [BATTC.SYS]
ntkrnlpa.exe-->SeCreateClientSecurityFromSubjectContext, Type: EAT modification 0x8230F8D0-->8269F06E [BATTC.SYS]
ntkrnlpa.exe-->SeDeassignSecurity, Type: EAT modification 0x8230F8D4-->8261F06D [acpi.sys]
ntkrnlpa.exe-->SeDeleteAccessState, Type: EAT modification 0x8230F8D8-->822EF070 [ntkrnlpa.exe]
ntkrnlpa.exe-->SeDeleteObjectAuditAlarm, Type: EAT modification 0x8230F8DC-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->SeDeleteObjectAuditAlarmWithTransaction, Type: EAT modification 0x8230F8E0-->822EF061 [ntkrnlpa.exe]
ntkrnlpa.exe-->SeExamineSacl, Type: EAT modification 0x8230F8E4-->8261F062 [acpi.sys]
ntkrnlpa.exe-->SeExports, Type: EAT modification 0x8230F8E8-->8200F06B [ntkrnlpa.exe]
ntkrnlpa.exe-->SeFilterToken, Type: EAT modification 0x8230F8EC-->CFA85AFF [unknown_code_page]
ntkrnlpa.exe-->SeGetLinkedToken, Type: EAT modification 0x8230F8F4-->823AF212 [ntkrnlpa.exe]
ntkrnlpa.exe-->SeImpersonateClient, Type: EAT modification 0x8230F8F8-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->SeImpersonateClientEx, Type: EAT modification 0x8230F8FC-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->SeLocateProcessImageName, Type: EAT modification 0x8230F900-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->SeLockSubjectContext, Type: EAT modification 0x8230F904-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->SeMarkLogonSessionForTerminationNotification, Type: EAT modification 0x8230F908-->8262F075 [acpi.sys]
ntkrnlpa.exe-->SeOpenObjectAuditAlarm, Type: EAT modification 0x8230F90C-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->SeOpenObjectAuditAlarmForNonObObject, Type: EAT modification 0x8230F910-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->SeOpenObjectAuditAlarmWithTransaction, Type: EAT modification 0x8230F914-->8261F047 [acpi.sys]
ntkrnlpa.exe-->SeOpenObjectForDeleteAuditAlarm, Type: EAT modification 0x8230F918-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->SeOpenObjectForDeleteAuditAlarmWithTransaction, Type: EAT modification 0x8230F91C-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->SePrivilegeCheck, Type: EAT modification 0x8230F920-->826FF057 [pciide.sys]
ntkrnlpa.exe-->SePrivilegeObjectAuditAlarm, Type: EAT modification 0x8230F924-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->SePublicDefaultDacl, Type: EAT modification 0x8230F928-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->SeQueryAuthenticationIdToken, Type: EAT modification 0x8230F92C-->8266F06F [pci.sys]
ntkrnlpa.exe-->SeQueryInformationToken, Type: EAT modification 0x8230F930-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->SeQuerySecurityDescriptorInfo, Type: EAT modification 0x8230F934-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->SeQuerySessionIdToken, Type: EAT modification 0x8230F938-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->SeRegisterLogonSessionTerminatedRoutine, Type: EAT modification 0x8230F93C-->8266F061 [pci.sys]
ntkrnlpa.exe-->SeReleaseSecurityDescriptor, Type: EAT modification 0x8230F940-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->SeReleaseSubjectContext, Type: EAT modification 0x8230F944-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->SeReportSecurityEvent, Type: EAT modification 0x8230F948-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->SeReportSecurityEventWithSubCategory, Type: EAT modification 0x8230F94C-->8263F041 [acpi.sys]
ntkrnlpa.exe-->SeSetAccessStateGenericMapping, Type: EAT modification 0x8230F950-->826FF063 [pciide.sys]
ntkrnlpa.exe-->SeSetAuditParameter, Type: EAT modification 0x8230F954-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->SeSetAuthorizationCallbacks, Type: EAT modification 0x8230F958-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->SeSetSecurityDescriptorInfo, Type: EAT modification 0x8230F95C-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->SeSetSecurityDescriptorInfoEx, Type: EAT modification 0x8230F960-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->SeSinglePrivilegeCheck, Type: EAT modification 0x8230F964-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->SeSystemDefaultDacl, Type: EAT modification 0x8230F968-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->SeTokenImpersonationLevel, Type: EAT modification 0x8230F96C-->8261F068 [acpi.sys]
ntkrnlpa.exe-->SeTokenIsAdmin, Type: EAT modification 0x8230F970-->8274F074 [fltmgr.sys]
ntkrnlpa.exe-->SeTokenIsRestricted, Type: EAT modification 0x8230F974-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->SeTokenIsWriteRestricted, Type: EAT modification 0x8230F978-->8264F065 [acpi.sys]
ntkrnlpa.exe-->SeTokenObjectType, Type: EAT modification 0x8230F97C-->8248F020 [unknown_code_page]
ntkrnlpa.exe-->SeTokenType, Type: EAT modification 0x8230F980-->826CF061 [volmgrx.sys]
ntkrnlpa.exe-->SeUnlockSubjectContext, Type: EAT modification 0x8230F984-->8273F06C [ataport.SYS]
ntkrnlpa.exe-->SeUnregisterLogonSessionTerminatedRoutine, Type: EAT modification 0x8230F988-->8246F05C [unknown_code_page]
ntkrnlpa.exe-->SeValidSecurityDescriptor, Type: EAT modification 0x8230F98C-->826EF065 [volmgrx.sys]
ntkrnlpa.exe-->sprintf, Type: EAT modification 0x8230FE3C-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->srand, Type: EAT modification 0x8230FE40-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->strcat, Type: EAT modification 0x8230FE44-->826FF057 [pciide.sys]
ntkrnlpa.exe-->strchr, Type: EAT modification 0x8230FE48-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->strcmp, Type: EAT modification 0x8230FE4C-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->strcpy, Type: EAT modification 0x8230FE50-->8266F06F [pci.sys]
ntkrnlpa.exe-->strlen, Type: EAT modification 0x8230FE54-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->strncat, Type: EAT modification 0x8230FE58-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->strncmp, Type: EAT modification 0x8230FE5C-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->strncpy, Type: EAT modification 0x8230FE60-->8266F061 [pci.sys]
ntkrnlpa.exe-->strrchr, Type: EAT modification 0x8230FE64-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->strspn, Type: EAT modification 0x8230FE68-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->strstr, Type: EAT modification 0x8230FE6C-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->swprintf, Type: EAT modification 0x8230FE70-->8263F041 [acpi.sys]
ntkrnlpa.exe-->TmCancelPropagationRequest, Type: EAT modification 0x8230F990-->8261F072 [acpi.sys]
ntkrnlpa.exe-->TmCommitComplete, Type: EAT modification 0x8230F994-->826CF06C [volmgrx.sys]
ntkrnlpa.exe-->TmCommitEnlistment, Type: EAT modification 0x8230F998-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->TmCommitTransaction, Type: EAT modification 0x8230F99C-->8276F061 [fltmgr.sys]
ntkrnlpa.exe-->TmCreateEnlistment, Type: EAT modification 0x8230F9A0-->8264F065 [acpi.sys]
ntkrnlpa.exe-->TmCurrentTransaction, Type: EAT modification 0x8230F9A4-->8261F056 [acpi.sys]
ntkrnlpa.exe-->TmDereferenceEnlistmentKey, Type: EAT modification 0x8230F9A8-->8269F072 [BATTC.SYS]
ntkrnlpa.exe-->TmEnableCallbacks, Type: EAT modification 0x8230F9AC-->8262F061 [acpi.sys]
ntkrnlpa.exe-->TmEndPropagationRequest, Type: EAT modification 0x8230F9B0-->8265F06C [msisadrv.sys]
ntkrnlpa.exe-->TmEnlistmentObjectType, Type: EAT modification 0x8230F9B4-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->TmFreezeTransactions, Type: EAT modification 0x8230F9B8-->826CF042 [volmgrx.sys]
ntkrnlpa.exe-->TmGetTransactionId, Type: EAT modification 0x8230F9BC-->827AF069 [cdrom.sys]
ntkrnlpa.exe-->TmInitializeResourceManager, Type: EAT modification 0x8230F9C8-->8254F05F [unknown_code_page]
ntkrnlpa.exe-->TmInitializeTransaction, Type: EAT modification 0x8230F9CC-->826DF069 [volmgrx.sys]
ntkrnlpa.exe-->TmInitSystem, Type: EAT modification 0x8230F9C0-->8261F07A [acpi.sys]
ntkrnlpa.exe-->TmInitSystemPhase2, Type: EAT modification 0x8230F9C4-->8264F072 [acpi.sys]
ntkrnlpa.exe-->TmIsTransactionActive, Type: EAT modification 0x8230F9D0-->824DF065 [unknown_code_page]
ntkrnlpa.exe-->TmpIsKTMCommitCoordinator, Type: EAT modification 0x8230FA24-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->TmPrepareComplete, Type: EAT modification 0x8230F9DC-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->TmPrepareEnlistment, Type: EAT modification 0x8230F9E0-->826CF02E [volmgrx.sys]
ntkrnlpa.exe-->TmPrePrepareComplete, Type: EAT modification 0x8230F9D4-->826EF061 [volmgrx.sys]
ntkrnlpa.exe-->TmPrePrepareEnlistment, Type: EAT modification 0x8230F9D8-->8267F061 [pci.sys]
ntkrnlpa.exe-->TmPropagationComplete, Type: EAT modification 0x8230F9E4-->8261F075 [acpi.sys]
ntkrnlpa.exe-->TmPropagationFailed, Type: EAT modification 0x8230F9E8-->8262F02E [acpi.sys]
ntkrnlpa.exe-->TmReadOnlyEnlistment, Type: EAT modification 0x8230F9EC-->826BF061 [volmgrx.sys]
ntkrnlpa.exe-->TmRecoverEnlistment, Type: EAT modification 0x8230F9F0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->TmRecoverResourceManager, Type: EAT modification 0x8230F9F4-->CFA8651C [unknown_code_page]
ntkrnlpa.exe-->TmReferenceEnlistmentKey, Type: EAT modification 0x8230F9FC-->823AF233 [ntkrnlpa.exe]
ntkrnlpa.exe-->TmRequestOutcomeEnlistment, Type: EAT modification 0x8230FA00-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->TmResourceManagerObjectType, Type: EAT modification 0x8230FA04-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->TmRollbackComplete, Type: EAT modification 0x8230FA08-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->TmRollbackEnlistment, Type: EAT modification 0x8230FA0C-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->TmRollbackTransaction, Type: EAT modification 0x8230FA10-->8262F075 [acpi.sys]
ntkrnlpa.exe-->TmSetCurrentTransaction, Type: EAT modification 0x8230FA14-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->TmThawTransactions, Type: EAT modification 0x8230FA18-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->TmTransactionManagerObjectType, Type: EAT modification 0x8230FA1C-->8261F047 [acpi.sys]
ntkrnlpa.exe-->TmTransactionObjectType, Type: EAT modification 0x8230FA20-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->tolower, Type: EAT modification 0x8230FE74-->826FF063 [pciide.sys]
ntkrnlpa.exe-->toupper, Type: EAT modification 0x8230FE78-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->towlower, Type: EAT modification 0x8230FE7C-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->towupper, Type: EAT modification 0x8230FE80-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->vDbgPrintEx, Type: EAT modification 0x8230FE84-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->vDbgPrintExWithPrefix, Type: EAT modification 0x8230FE88-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->VerSetConditionMask, Type: EAT modification 0x8230FA28-->826FF057 [pciide.sys]
ntkrnlpa.exe-->VfFailDeviceNode, Type: EAT modification 0x8230FA2C-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->VfFailDriver, Type: EAT modification 0x8230FA30-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->VfFailSystemBIOS, Type: EAT modification 0x8230FA34-->8266F06F [pci.sys]
ntkrnlpa.exe-->VfIsVerificationEnabled, Type: EAT modification 0x8230FA38-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->vsprintf, Type: EAT modification 0x8230FE8C-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->wcscat, Type: EAT modification 0x8230FE90-->8261F068 [acpi.sys]
ntkrnlpa.exe-->wcschr, Type: EAT modification 0x8230FE94-->8274F074 [fltmgr.sys]
ntkrnlpa.exe-->wcscmp, Type: EAT modification 0x8230FE98-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->wcscpy, Type: EAT modification 0x8230FE9C-->8264F065 [acpi.sys]
ntkrnlpa.exe-->wcscspn, Type: EAT modification 0x8230FEA0-->8248F020 [unknown_code_page]
ntkrnlpa.exe-->wcslen, Type: EAT modification 0x8230FEA4-->826CF061 [volmgrx.sys]
ntkrnlpa.exe-->wcsncat, Type: EAT modification 0x8230FEA8-->8273F06C [ataport.SYS]
ntkrnlpa.exe-->wcsncmp, Type: EAT modification 0x8230FEAC-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->wcsncpy, Type: EAT modification 0x8230FEB0-->8275F069 [fltmgr.sys]
ntkrnlpa.exe-->wcsrchr, Type: EAT modification 0x8230FEB4-->8266F067 [pci.sys]
ntkrnlpa.exe-->wcsspn, Type: EAT modification 0x8230FEB8-->8262F077 [acpi.sys]
ntkrnlpa.exe-->wcsstr, Type: EAT modification 0x8230FEBC-->8275F063 [fltmgr.sys]
ntkrnlpa.exe-->wcstombs, Type: EAT modification 0x8230FEC0-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->wctomb, Type: EAT modification 0x8230FEC4-->8276F061 [fltmgr.sys]
ntkrnlpa.exe-->WheaAddErrorSource, Type: EAT modification 0x8230FA54-->8263F041 [acpi.sys]
ntkrnlpa.exe-->WheaGetErrorSource, Type: EAT modification 0x8230FA58-->826FF063 [pciide.sys]
ntkrnlpa.exe-->WheaRegisterErrSrcInitializer, Type: EAT modification 0x8230FA5C-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->WheaReportHwError, Type: EAT modification 0x8230FA60-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->WmiGetClock, Type: EAT modification 0x8230E194-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->WmiQueryTraceInformation, Type: EAT modification 0x8230FA64-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->WmiTraceMessage, Type: EAT modification 0x8230FA68-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->WmiTraceMessageVa, Type: EAT modification 0x8230FA6C-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->WRITE_REGISTER_BUFFER_UCHAR, Type: EAT modification 0x8230FA3C-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->WRITE_REGISTER_BUFFER_ULONG, Type: EAT modification 0x8230FA40-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->WRITE_REGISTER_BUFFER_USHORT, Type: EAT modification 0x8230FA44-->8266F061 [pci.sys]
ntkrnlpa.exe-->WRITE_REGISTER_UCHAR, Type: EAT modification 0x8230FA48-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->WRITE_REGISTER_ULONG, Type: EAT modification 0x8230FA4C-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->WRITE_REGISTER_USHORT, Type: EAT modification 0x8230FA50-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->XIPDispatch, Type: EAT modification 0x8230FA70-->8261F068 [acpi.sys]
ntkrnlpa.exe-->ZwAccessCheckAndAuditAlarm, Type: EAT modification 0x8230FA74-->8274F074 [fltmgr.sys]
ntkrnlpa.exe-->ZwAddBootEntry, Type: EAT modification 0x8230FA78-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->ZwAddDriverEntry, Type: EAT modification 0x8230FA7C-->8264F065 [acpi.sys]
ntkrnlpa.exe-->ZwAdjustPrivilegesToken, Type: EAT modification 0x8230FA80-->8248F020 [unknown_code_page]
ntkrnlpa.exe-->ZwAlertThread, Type: EAT modification 0x8230FA84-->826CF061 [volmgrx.sys]
ntkrnlpa.exe-->ZwAllocateLocallyUniqueId, Type: EAT modification 0x8230FA88-->8273F06C [ataport.SYS]
ntkrnlpa.exe-->ZwAllocateVirtualMemory, Type: EAT modification 0x8230FA8C-->824AF05C [unknown_code_page]
ntkrnlpa.exe-->ZwAlpcAcceptConnectPort, Type: EAT modification 0x8230FA90-->8263F073 [acpi.sys]
ntkrnlpa.exe-->ZwAlpcCancelMessage, Type: EAT modification 0x8230FA94-->826CF067 [volmgrx.sys]
ntkrnlpa.exe-->ZwAlpcConnectPort, Type: EAT modification 0x8230FA98-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->ZwAlpcCreatePort, Type: EAT modification 0x8230FA9C-->8276F061 [fltmgr.sys]
ntkrnlpa.exe-->ZwAlpcCreatePortSection, Type: EAT modification 0x8230FAA0-->8264F065 [acpi.sys]
ntkrnlpa.exe-->ZwAlpcCreateResourceReserve, Type: EAT modification 0x8230FAA4-->8261F056 [acpi.sys]
ntkrnlpa.exe-->ZwAlpcCreateSectionView, Type: EAT modification 0x8230FAA8-->8269F072 [BATTC.SYS]
ntkrnlpa.exe-->ZwAlpcCreateSecurityContext, Type: EAT modification 0x8230FAAC-->8262F061 [acpi.sys]
ntkrnlpa.exe-->ZwAlpcDeletePortSection, Type: EAT modification 0x8230FAB0-->8265F06C [msisadrv.sys]
ntkrnlpa.exe-->ZwAlpcDeleteResourceReserve, Type: EAT modification 0x8230FAB4-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->ZwAlpcDeleteSectionView, Type: EAT modification 0x8230FAB8-->826CF042 [volmgrx.sys]
ntkrnlpa.exe-->ZwAlpcDeleteSecurityContext, Type: EAT modification 0x8230FABC-->827AF069 [cdrom.sys]
ntkrnlpa.exe-->ZwAlpcDisconnectPort, Type: EAT modification 0x8230FAC0-->8261F07A [acpi.sys]
ntkrnlpa.exe-->ZwAlpcQueryInformation, Type: EAT modification 0x8230FAC4-->8264F072 [acpi.sys]
ntkrnlpa.exe-->ZwAlpcSendWaitReceivePort, Type: EAT modification 0x8230FAC8-->8254F05F [unknown_code_page]
ntkrnlpa.exe-->ZwAlpcSetInformation, Type: EAT modification 0x8230FACC-->826DF069 [volmgrx.sys]
ntkrnlpa.exe-->ZwAssignProcessToJobObject, Type: EAT modification 0x8230FAD0-->824DF065 [unknown_code_page]
ntkrnlpa.exe-->ZwCancelIoFile, Type: EAT modification 0x8230FAD4-->826EF061 [volmgrx.sys]
ntkrnlpa.exe-->ZwCancelTimer, Type: EAT modification 0x8230FAD8-->8267F061 [pci.sys]
ntkrnlpa.exe-->ZwClearEvent, Type: EAT modification 0x8230FADC-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->ZwClose, Type: EAT modification 0x8230FAE0-->826CF02E [volmgrx.sys]
ntkrnlpa.exe-->ZwCloseObjectAuditAlarm, Type: EAT modification 0x8230FAE4-->8261F075 [acpi.sys]
ntkrnlpa.exe-->ZwCommitEnlistment, Type: EAT modification 0x8230FAE8-->8262F02E [acpi.sys]
ntkrnlpa.exe-->ZwCommitTransaction, Type: EAT modification 0x8230FAEC-->826BF061 [volmgrx.sys]
ntkrnlpa.exe-->ZwConnectPort, Type: EAT modification 0x8230FAF0-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwCreateDirectoryObject, Type: EAT modification 0x8230FAF4-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwCreateEnlistment, Type: EAT modification 0x8230FAF8-->CFA8653D [unknown_code_page]
ntkrnlpa.exe-->ZwCreateFile, Type: EAT modification 0x8230FB00-->823AF254 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwCreateIoCompletion, Type: EAT modification 0x8230FB04-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->ZwCreateJobObject, Type: EAT modification 0x8230FB08-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->ZwCreateKey, Type: EAT modification 0x8230FB0C-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->ZwCreateKeyTransacted, Type: EAT modification 0x8230FB10-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->ZwCreateResourceManager, Type: EAT modification 0x8230FB14-->8262F075 [acpi.sys]
ntkrnlpa.exe-->ZwCreateSection, Type: EAT modification 0x8230FB18-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->ZwCreateSymbolicLinkObject, Type: EAT modification 0x8230FB1C-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->ZwCreateTimer, Type: EAT modification 0x8230FB20-->8261F047 [acpi.sys]
ntkrnlpa.exe-->ZwCreateTransaction, Type: EAT modification 0x8230FB24-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->ZwCreateTransactionManager, Type: EAT modification 0x8230FB28-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->ZwDeleteBootEntry, Type: EAT modification 0x8230FB2C-->826FF057 [pciide.sys]
ntkrnlpa.exe-->ZwDeleteDriverEntry, Type: EAT modification 0x8230FB30-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->ZwDeleteFile, Type: EAT modification 0x8230FB34-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwDeleteKey, Type: EAT modification 0x8230FB38-->8266F06F [pci.sys]
ntkrnlpa.exe-->ZwDeleteValueKey, Type: EAT modification 0x8230FB3C-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->ZwDeviceIoControlFile, Type: EAT modification 0x8230FB40-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->ZwDisplayString, Type: EAT modification 0x8230FB44-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->ZwDuplicateObject, Type: EAT modification 0x8230FB48-->8266F061 [pci.sys]
ntkrnlpa.exe-->ZwDuplicateToken, Type: EAT modification 0x8230FB4C-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->ZwEnumerateBootEntries, Type: EAT modification 0x8230FB50-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->ZwEnumerateDriverEntries, Type: EAT modification 0x8230FB54-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->ZwEnumerateKey, Type: EAT modification 0x8230FB58-->8263F041 [acpi.sys]
ntkrnlpa.exe-->ZwEnumerateTransactionObject, Type: EAT modification 0x8230FB5C-->826FF063 [pciide.sys]
ntkrnlpa.exe-->ZwEnumerateValueKey, Type: EAT modification 0x8230FB60-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->ZwFlushBuffersFile, Type: EAT modification 0x8230FB64-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->ZwFlushInstructionCache, Type: EAT modification 0x8230FB68-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->ZwFlushKey, Type: EAT modification 0x8230FB6C-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->ZwFlushVirtualMemory, Type: EAT modification 0x8230FB70-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->ZwFreeVirtualMemory, Type: EAT modification 0x8230FB74-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->ZwFsControlFile, Type: EAT modification 0x8230FB78-->8261F068 [acpi.sys]
ntkrnlpa.exe-->ZwGetNotificationResourceManager, Type: EAT modification 0x8230FB7C-->8274F074 [fltmgr.sys]
ntkrnlpa.exe-->ZwImpersonateAnonymousToken, Type: EAT modification 0x8230FB80-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->ZwInitiatePowerAction, Type: EAT modification 0x8230FB84-->8264F065 [acpi.sys]
ntkrnlpa.exe-->ZwIsProcessInJob, Type: EAT modification 0x8230FB88-->8248F020 [unknown_code_page]
ntkrnlpa.exe-->ZwLoadDriver, Type: EAT modification 0x8230FB8C-->826CF061 [volmgrx.sys]
ntkrnlpa.exe-->ZwLoadKey, Type: EAT modification 0x8230FB90-->8273F06C [ataport.SYS]
ntkrnlpa.exe-->ZwLoadKeyEx, Type: EAT modification 0x8230FB94-->824BF05C [unknown_code_page]
ntkrnlpa.exe-->ZwLockProductActivationKeys, Type: EAT modification 0x8230FB98-->8273F069 [ataport.SYS]
ntkrnlpa.exe-->ZwMakeTemporaryObject, Type: EAT modification 0x8230FB9C-->826DF073 [volmgrx.sys]
ntkrnlpa.exe-->ZwMapViewOfSection, Type: EAT modification 0x8230FBA0-->826FF079 [pciide.sys]
ntkrnlpa.exe-->ZwModifyBootEntry, Type: EAT modification 0x8230FBA4-->8270F06F [PCIIDEX.SYS]
ntkrnlpa.exe-->ZwModifyDriverEntry, Type: EAT modification 0x8230FBA8-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->ZwNotifyChangeKey, Type: EAT modification 0x8230FBAC-->8261F053 [acpi.sys]
ntkrnlpa.exe-->ZwOpenDirectoryObject, Type: EAT modification 0x8230FBB0-->8265F076 [msisadrv.sys]
ntkrnlpa.exe-->ZwOpenEnlistment, Type: EAT modification 0x8230FBB4-->8256F064 [unknown_code_page]
ntkrnlpa.exe-->ZwOpenEvent, Type: EAT modification 0x8230FBB8-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->ZwOpenFile, Type: EAT modification 0x8230FBBC-->8261F069 [acpi.sys]
ntkrnlpa.exe-->ZwOpenJobObject, Type: EAT modification 0x8230FBC0-->826CF062 [volmgrx.sys]
ntkrnlpa.exe-->ZwOpenKey, Type: EAT modification 0x8230FBC4-->8273F065 [ataport.SYS]
ntkrnlpa.exe-->ZwOpenKeyTransacted, Type: EAT modification 0x8230FBC8-->8242F05C [unknown_code_page]
ntkrnlpa.exe-->ZwOpenProcess, Type: EAT modification 0x8230FBCC-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->ZwOpenProcessToken, Type: EAT modification 0x8230FBD0-->827AF07A [cdrom.sys]
ntkrnlpa.exe-->ZwOpenProcessTokenEx, Type: EAT modification 0x8230FBD4-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->ZwOpenResourceManager, Type: EAT modification 0x8230FBD8-->825FF064 [unknown_code_page]
ntkrnlpa.exe-->ZwOpenSection, Type: EAT modification 0x8230FBDC-->8269F054 [BATTC.SYS]
ntkrnlpa.exe-->ZwOpenSymbolicLinkObject, Type: EAT modification 0x8230FBE0-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->ZwOpenThread, Type: EAT modification 0x8230FBE4-->8261F04D [acpi.sys]
ntkrnlpa.exe-->ZwOpenThreadToken, Type: EAT modification 0x8230FBE8-->8261F06E [acpi.sys]
ntkrnlpa.exe-->ZwOpenThreadTokenEx, Type: EAT modification 0x8230FBEC-->8265F067 [msisadrv.sys]
ntkrnlpa.exe-->ZwOpenTimer, Type: EAT modification 0x8230FBF0-->822EF072 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwOpenTransaction, Type: EAT modification 0x8230FBF4-->8275F06C [fltmgr.sys]
ntkrnlpa.exe-->ZwOpenTransactionManager, Type: EAT modification 0x8230FBF8-->8200F061 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwPowerInformation, Type: EAT modification 0x8230FBFC-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwPrepareEnlistment, Type: EAT modification 0x8230FC08-->823AF275 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwPrePrepareEnlistment, Type: EAT modification 0x8230FC00-->CFA86552 [unknown_code_page]
ntkrnlpa.exe-->ZwPulseEvent, Type: EAT modification 0x8230FC0C-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->ZwQueryBootEntryOrder, Type: EAT modification 0x8230FC10-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->ZwQueryBootOptions, Type: EAT modification 0x8230FC14-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->ZwQueryDefaultLocale, Type: EAT modification 0x8230FC18-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->ZwQueryDefaultUILanguage, Type: EAT modification 0x8230FC1C-->8262F075 [acpi.sys]
ntkrnlpa.exe-->ZwQueryDirectoryFile, Type: EAT modification 0x8230FC20-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->ZwQueryDirectoryObject, Type: EAT modification 0x8230FC24-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->ZwQueryDriverEntryOrder, Type: EAT modification 0x8230FC28-->8261F047 [acpi.sys]
ntkrnlpa.exe-->ZwQueryEaFile, Type: EAT modification 0x8230FC2C-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->ZwQueryFullAttributesFile, Type: EAT modification 0x8230FC30-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->ZwQueryInformationEnlistment, Type: EAT modification 0x8230FC34-->826FF057 [pciide.sys]
ntkrnlpa.exe-->ZwQueryInformationFile, Type: EAT modification 0x8230FC38-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->ZwQueryInformationJobObject, Type: EAT modification 0x8230FC3C-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwQueryInformationProcess, Type: EAT modification 0x8230FC40-->8266F06F [pci.sys]
ntkrnlpa.exe-->ZwQueryInformationResourceManager, Type: EAT modification 0x8230FC44-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->ZwQueryInformationThread, Type: EAT modification 0x8230FC48-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->ZwQueryInformationToken, Type: EAT modification 0x8230FC4C-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->ZwQueryInformationTransaction, Type: EAT modification 0x8230FC50-->8266F061 [pci.sys]
ntkrnlpa.exe-->ZwQueryInformationTransactionManager, Type: EAT modification 0x8230FC54-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->ZwQueryInstallUILanguage, Type: EAT modification 0x8230FC58-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->ZwQueryKey, Type: EAT modification 0x8230FC5C-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->ZwQueryLicenseValue, Type: EAT modification 0x8230FC60-->8263F041 [acpi.sys]
ntkrnlpa.exe-->ZwQueryObject, Type: EAT modification 0x8230FC64-->826FF063 [pciide.sys]
ntkrnlpa.exe-->ZwQuerySection, Type: EAT modification 0x8230FC68-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->ZwQuerySecurityObject, Type: EAT modification 0x8230FC6C-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->ZwQuerySymbolicLinkObject, Type: EAT modification 0x8230FC70-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->ZwQuerySystemInformation, Type: EAT modification 0x8230FC74-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->ZwQueryValueKey, Type: EAT modification 0x8230FC78-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->ZwQueryVirtualMemory, Type: EAT modification 0x8230FC7C-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->ZwQueryVolumeInformationFile, Type: EAT modification 0x8230FC80-->8261F068 [acpi.sys]
ntkrnlpa.exe-->ZwReadFile, Type: EAT modification 0x8230FC84-->8274F074 [fltmgr.sys]
ntkrnlpa.exe-->ZwRecoverEnlistment, Type: EAT modification 0x8230FC88-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->ZwRecoverResourceManager, Type: EAT modification 0x8230FC8C-->8264F065 [acpi.sys]
ntkrnlpa.exe-->ZwRecoverTransactionManager, Type: EAT modification 0x8230FC90-->8248F020 [unknown_code_page]
ntkrnlpa.exe-->ZwRemoveIoCompletion, Type: EAT modification 0x8230FC94-->826CF061 [volmgrx.sys]
ntkrnlpa.exe-->ZwRemoveIoCompletionEx, Type: EAT modification 0x8230FC98-->8273F06C [ataport.SYS]
ntkrnlpa.exe-->ZwReplaceKey, Type: EAT modification 0x8230FC9C-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->ZwRequestPort, Type: EAT modification 0x8230FCA0-->8279F061 [cdrom.sys]
ntkrnlpa.exe-->ZwRequestWaitReplyPort, Type: EAT modification 0x8230FCA4-->8261F061 [acpi.sys]
ntkrnlpa.exe-->ZwResetEvent, Type: EAT modification 0x8230FCA8-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->ZwRestoreKey, Type: EAT modification 0x8230FCAC-->8276F061 [fltmgr.sys]
ntkrnlpa.exe-->ZwRollbackEnlistment, Type: EAT modification 0x8230FCB0-->8264F065 [acpi.sys]
ntkrnlpa.exe-->ZwRollbackTransaction, Type: EAT modification 0x8230FCB4-->8261F056 [acpi.sys]
ntkrnlpa.exe-->ZwSaveKey, Type: EAT modification 0x8230FCB8-->8269F072 [BATTC.SYS]
ntkrnlpa.exe-->ZwSaveKeyEx, Type: EAT modification 0x8230FCBC-->8262F061 [acpi.sys]
ntkrnlpa.exe-->ZwSecureConnectPort, Type: EAT modification 0x8230FCC0-->8265F06C [msisadrv.sys]
ntkrnlpa.exe-->ZwSetBootEntryOrder, Type: EAT modification 0x8230FCC4-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->ZwSetBootOptions, Type: EAT modification 0x8230FCC8-->826CF042 [volmgrx.sys]
ntkrnlpa.exe-->ZwSetDefaultLocale, Type: EAT modification 0x8230FCCC-->827AF069 [cdrom.sys]
ntkrnlpa.exe-->ZwSetDefaultUILanguage, Type: EAT modification 0x8230FCD0-->8261F07A [acpi.sys]
ntkrnlpa.exe-->ZwSetDriverEntryOrder, Type: EAT modification 0x8230FCD4-->8264F072 [acpi.sys]
ntkrnlpa.exe-->ZwSetEaFile, Type: EAT modification 0x8230FCD8-->8254F05F [unknown_code_page]
ntkrnlpa.exe-->ZwSetEvent, Type: EAT modification 0x8230FCDC-->826DF069 [volmgrx.sys]
ntkrnlpa.exe-->ZwSetInformationEnlistment, Type: EAT modification 0x8230FCE0-->824DF065 [unknown_code_page]
ntkrnlpa.exe-->ZwSetInformationFile, Type: EAT modification 0x8230FCE4-->826EF061 [volmgrx.sys]
ntkrnlpa.exe-->ZwSetInformationJobObject, Type: EAT modification 0x8230FCE8-->8267F061 [pci.sys]
ntkrnlpa.exe-->ZwSetInformationObject, Type: EAT modification 0x8230FCEC-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->ZwSetInformationProcess, Type: EAT modification 0x8230FCF0-->826CF02E [volmgrx.sys]
ntkrnlpa.exe-->ZwSetInformationThread, Type: EAT modification 0x8230FCF4-->8261F075 [acpi.sys]
ntkrnlpa.exe-->ZwSetInformationTransaction, Type: EAT modification 0x8230FCF8-->8262F02E [acpi.sys]
ntkrnlpa.exe-->ZwSetSecurityObject, Type: EAT modification 0x8230FCFC-->826BF061 [volmgrx.sys]
ntkrnlpa.exe-->ZwSetSystemInformation, Type: EAT modification 0x8230FD00-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwSetSystemTime, Type: EAT modification 0x8230FD04-->8200F000 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwSetTimer, Type: EAT modification 0x8230FD08-->CFA86573 [unknown_code_page]
ntkrnlpa.exe-->ZwSetVolumeInformationFile, Type: EAT modification 0x8230FD10-->823AF296 [ntkrnlpa.exe]
ntkrnlpa.exe-->ZwTerminateJobObject, Type: EAT modification 0x8230FD14-->8255F05C [unknown_code_page]
ntkrnlpa.exe-->ZwTerminateProcess, Type: EAT modification 0x8230FD18-->8265F073 [msisadrv.sys]
ntkrnlpa.exe-->ZwTranslateFilePath, Type: EAT modification 0x8230FD1C-->8273F072 [ataport.SYS]
ntkrnlpa.exe-->ZwUnloadDriver, Type: EAT modification 0x8230FD20-->8250F05C [unknown_code_page]
ntkrnlpa.exe-->ZwUnloadKey, Type: EAT modification 0x8230FD24-->8262F075 [acpi.sys]
ntkrnlpa.exe-->ZwUnloadKeyEx, Type: EAT modification 0x8230FD28-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->ZwUnmapViewOfSection, Type: EAT modification 0x8230FD2C-->825CF063 [unknown_code_page]
ntkrnlpa.exe-->ZwWaitForMultipleObjects, Type: EAT modification 0x8230FD30-->8261F047 [acpi.sys]
ntkrnlpa.exe-->ZwWaitForSingleObject, Type: EAT modification 0x8230FD34-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->ZwWriteFile, Type: EAT modification 0x8230FD38-->825CF073 [unknown_code_page]
ntkrnlpa.exe-->ZwYieldExecution, Type: EAT modification 0x8230FD3C-->826FF057 [pciide.sys]
ntkrnlpa.exe-->_abnormal_termination, Type: EAT modification 0x8230FD4C-->8257F020 [unknown_code_page]
ntkrnlpa.exe-->_alldiv, Type: EAT modification 0x8230FD50-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->_alldvrm, Type: EAT modification 0x8230FD54-->8272F063 [ataport.SYS]
ntkrnlpa.exe-->_allmul, Type: EAT modification 0x8230FD58-->8266F061 [pci.sys]
ntkrnlpa.exe-->_alloca_probe, Type: EAT modification 0x8230FD5C-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->_alloca_probe_16, Type: EAT modification 0x8230FD60-->8254F057 [unknown_code_page]
ntkrnlpa.exe-->_alloca_probe_8, Type: EAT modification 0x8230FD64-->825CF046 [unknown_code_page]
ntkrnlpa.exe-->_allrem, Type: EAT modification 0x8230FD68-->8263F041 [acpi.sys]
ntkrnlpa.exe-->_allshl, Type: EAT modification 0x8230FD6C-->826FF063 [pciide.sys]
ntkrnlpa.exe-->_allshr, Type: EAT modification 0x8230FD70-->826EF075 [volmgrx.sys]
ntkrnlpa.exe-->_aulldiv, Type: EAT modification 0x8230FD74-->825CF074 [unknown_code_page]
ntkrnlpa.exe-->_aulldvrm, Type: EAT modification 0x8230FD78-->8241F044 [unknown_code_page]
ntkrnlpa.exe-->_aullrem, Type: EAT modification 0x8230FD7C-->8249F04C [unknown_code_page]
ntkrnlpa.exe-->_aullshr, Type: EAT modification 0x8230FD80-->8241F054 [unknown_code_page]
ntkrnlpa.exe-->_chkstk, Type: EAT modification 0x8230FD84-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->_CIcos, Type: EAT modification 0x8230FD40-->826CF072 [volmgrx.sys]
ntkrnlpa.exe-->_CIsin, Type: EAT modification 0x8230FD44-->8220F064 [ntkrnlpa.exe]
ntkrnlpa.exe-->_CIsqrt, Type: EAT modification 0x8230FD48-->8266F06F [pci.sys]
ntkrnlpa.exe-->_except_handler2, Type: EAT modification 0x8230FD88-->8261F068 [acpi.sys]
ntkrnlpa.exe-->_except_handler3, Type: EAT modification 0x8230FD8C-->8274F074 [fltmgr.sys]
ntkrnlpa.exe-->_global_unwind2, Type: EAT modification 0x8230FD90-->8272F065 [ataport.SYS]
ntkrnlpa.exe-->_itoa, Type: EAT modification 0x8230FD94-->8264F065 [acpi.sys]
ntkrnlpa.exe-->_itow, Type: EAT modification 0x8230FD98-->8248F020 [unknown_code_page]
ntkrnlpa.exe-->_local_unwind2, Type: EAT modification 0x8230FD9C-->826CF061 [volmgrx.sys]
ntkrnlpa.exe-->_purecall, Type: EAT modification 0x8230FDA0-->8273F06C [ataport.SYS]
ntkrnlpa.exe-->_snprintf, Type: EAT modification 0x8230FDA4-->8253F05C [unknown_code_page]
ntkrnlpa.exe-->_snwprintf, Type: EAT modification 0x8230FDA8-->82E0F068 [unknown_code_page]
ntkrnlpa.exe-->_stricmp, Type: EAT modification 0x8230FDAC-->82F3F064 [unknown_code_page]
ntkrnlpa.exe-->_strlwr, Type: EAT modification 0x8230FDB0-->825CF077 [unknown_code_page]
ntkrnlpa.exe-->_strnicmp, Type: EAT modification 0x8230FDB4-->8261F053 [acpi.sys]
ntkrnlpa.exe-->_strnset, Type: EAT modification 0x8230FDB8-->8265F076 [msisadrv.sys]
ntkrnlpa.exe-->_strrev, Type: EAT modification 0x8230FDBC-->8256F064 [unknown_code_page]
ntkrnlpa.exe-->_strset, Type: EAT modification 0x8230FDC0-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->_strtoui64, Type: EAT modification 0x8230FDC4-->8261F069 [acpi.sys]
ntkrnlpa.exe-->_strupr, Type: EAT modification 0x8230FDC8-->826CF062 [volmgrx.sys]
ntkrnlpa.exe-->_swprintf, Type: EAT modification 0x8230FDCC-->8273F065 [ataport.SYS]
ntkrnlpa.exe-->_vsnprintf, Type: EAT modification 0x8230FDD0-->8242F05C [unknown_code_page]
ntkrnlpa.exe-->_vsnwprintf, Type: EAT modification 0x8230FDD4-->8269F06C [BATTC.SYS]
ntkrnlpa.exe-->_vswprintf, Type: EAT modification 0x8230FDD8-->827AF07A [cdrom.sys]
ntkrnlpa.exe-->_wcsicmp, Type: EAT modification 0x8230FDDC-->8272F061 [ataport.SYS]
ntkrnlpa.exe-->_wcslwr, Type: EAT modification 0x8230FDE0-->825FF064 [unknown_code_page]
ntkrnlpa.exe-->_wcsnicmp, Type: EAT modification 0x8230FDE4-->8269F054 [BATTC.SYS]
ntkrnlpa.exe-->_wcsnset, Type: EAT modification 0x8230FDE8-->8265F06D [msisadrv.sys]
ntkrnlpa.exe-->_wcsrev, Type: EAT modification 0x8230FDEC-->8261F04D [acpi.sys]
ntkrnlpa.exe-->_wcsupr, Type: EAT modification 0x8230FDF0-->8261F06E [acpi.sys]
[3372]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77B61170-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77B6111C-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77B61110-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->gdi32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77B61174-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x004110C4-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->kernel32.dll-->LoadLibraryExA, Type: IAT modification 0x004110BC-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x768E1414-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x768E14E0-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x768E1284-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x768E1448-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->AnimateWindow, Type: IAT modification 0x768E1AC4-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->DefWindowProcW, Type: IAT modification 0x768E1A50-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->GetSysColor, Type: IAT modification 0x768E19F0-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->TrackPopupMenu, Type: IAT modification 0x768E1914-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->shell32.dll-->user32.dll-->TrackPopupMenuEx, Type: IAT modification 0x768E1714-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->user32.dll-->DefWindowProcA, Type: IAT modification 0x00411488-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->user32.dll-->GetSysColor, Type: IAT modification 0x00411454-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D51300-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->LoadLibraryA, Type: IAT modification 0x77D51250-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->LoadLibraryExW, Type: IAT modification 0x77D5115C-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->user32.dll-->kernel32.dll-->LoadLibraryW, Type: IAT modification 0x77D512FC-->00000000 [YbSkin2.dll]
[3372]Ymsgr_tray.exe-->user32.dll-->TrackPopupMenu, Type: IAT modification 0x004113D8-->00000000 [YbSkin2.dll]
Cypher Admin/Teacher
November 6, 2010, 10:32 AM UTC
Hi dalitajn.
How is your PC performing are you having any problems?


Java SE Runtime Environment (JRE).

Please download from HERE
  • Find Java SE Runtime Environment (JRE) 6 Update 22.
  • Click the Download JRE button to the right.
  • Choose the correct Platform and Multi-language. Next, check the box that says I agree to the Java SE Runtime Environment 6 License Agreement.
  • Click the Continue button.
  • Click on the filename under Windows Offline Installation and save it to your desktop.
  • Close all active windows.
  • Install the program.


Next.

Update Adobe Reader

  • You should Download and Install the newest version of Adobe Reader for reading pdf files.
  • Due to the vulnerabilities in earlier versions all versions numbered lower than 9.3.4 are vulnerable.
  • Go Here to download the installer for Adobe Reader and save AdbeRdrUpd934_all_incr.msp to a convenient location.
  • Double-click AdbeRdrUpd934_all_incr.msp and follow the prompts to install Adobe Reader 9.3.4


Next.

Please download ATF Cleaner to your desktop.

  • Right-click ATF-Cleaner.exe And select " Run as administrator " to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Next.

Disable Microsoft Security Essentials

  • Open MSE and go to Settings > Real Time Protection.
  • Then uncheck "Turn on real time protection".
  • Exit MSE when done.
  • Note: Don't forget to Re-enable it after the below scan.


Next.

Kaspersky Online Scan

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Hold down Control then click on the following link to open a new window to Kaspersky Online Scan
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
  • Click on My Computer under Scan. * This will take a while. Please be patient *.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.


This online tutorial will help explain how to use the aforementioned online scan.


Logs/Information to Post in your Next Reply

  • Kaspersky log.
  • Please give me an update on your computers performance.

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.