forked from volatilityfoundation/volatility
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path_log.log
130 lines (129 loc) · 10 KB
/
_log.log
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
Suspected PID: 108 contains C:\Program Files\Google\Chrome\Application\55.0.2883.75\chrome.dll of size 41111552 based 0x5b9a0000
0x5c9f562d 85 c0 0f 44 ca 89 0e b9 88 6f ae 5d e8 b1 6d 0b ...D.....o.]..m.
0x5c9f563d 00 8b 4e 04 89 46 04 85 c9 74 07 51 e8 5b 6f 0b ..N..F...t.Q.[o.
0x5c9f564d 00 59 8b 46 04 83 ec 10 c7 40 4c 71 57 9f 5c 89 .Y.F.....@LqW.\.
0x5c9f565d 58 50 8b 46 04 68 c4 56 9f 5c 8b 80 84 00 00 00 XP.F.h.V.\......
0x5c9f566d c7 40 28 43 57 9f 5c 89 58 2c 8b 46 04 89 b8 90 .@(CW.\.X,.F....
0x5c9f567d 00 00 00 89 98 b8 00 00 00 8b 46 04 09 b8 60 01 ..........F...`.
0x5c9f568d 00 00 8b 46 04 c7 40 34 01 03 00 00 8b 46 04 c7 [email protected]..
0x5c9f569d 40 3c b8 57 9f 5c 8b 46 04 83 88 60 01 00 00 10 @<.W.\.F...`....
0x5c9f56ad 8b 4e 04 83 c1 68 e8 b2 e5 0b 00 83 c4 14 8b c6 .N...h..........
0x5c9f56bd 5f 5e 5b 8b e5 5d c3 55 8b ec 83 e4 f8 51 51 83 _^[..].U.....QQ.
0x5c9f56cd 64 24 04 00 e8 57 39 00 00 8b 4d 08 81 c1 9c 00 d$...W9...M.....
0x5c9f56dd 00 00 8b 10 e8 6c e1 0c 00 ff 75 18 8b c8 ff 75 .....l....u....u
0x5c9f56ed 14 ff 75 10 e8 eb 35 00 00 8b e5 5d c3 55 8b ec ..u...5....].U..
0x5c9f56fd 83 e4 f8 ff 75 10 e8 be 43 0a ff 59 8b e5 5d c3 ....u...C..Y..].
0x5c9f570d 55 8b ec 83 e4 f8 51 51 83 64 24 04 00 e8 0e 39 U.....QQ.d$....9
0x5c9f571d 00 00 8b 4d 08 81 c1 9c 00 00 00 8b 10 e8 23 e1 ...M..........#.
0x5c9f572d 0c 00 ff 75 18 8b c8 ff 75 14 ff 75 10 e8 80 36 ...u....u..u...6
0x5c9f573d 00 00 8b e5 5d c3 55 8b ec 83 e4 f8 51 83 24 24 ....].U.....Q.$$
0x5c9f574d 00 56 e8 d9 38 00 00 8b 75 08 8b 10 8d 8e 9c 00 .V..8...u.......
0x5c9f575d 00 00 e8 ee e0 0c 00 56 8b c8 e8 3f 2a 00 00 5e .......V...?*..^
0x5c9f576d 8b e5 5d c3 55 8b ec 83 e4 f8 51 51 83 64 24 04 ..].U.....QQ.d$.
0x5c9f577d 00 33 d2 56 57 8b 7d 08 8d 4f 7c e8 c5 e0 0c 00 .3.VW.}..O|.....
0x5c9f578d 8b f0 e8 99 38 00 00 8d 8e 9c 00 00 00 8b 10 e8 ....8...........
0x5c9f579d b1 e0 0c 00 85 c0 75 05 a2 00 00 00 00 57 8b c8 ......u......W..
0x5c9f57ad e8 2f 2f 00 00 5f 5e 8b e5 5d c3 55 8b ec 83 e4 .//.._^..].U....
0x5c9f57bd f8 51 83 24 24 00 56 e8 64 38 00 00 8b 4d 08 81 .Q.$$.V.d8...M..
0x5c9f57cd c1 9c 00 00 00 8b 10 e8 79 e0 0c 00 8b 4d 0c 8b ........y....M..
0x5c9f57dd f0 8b 86 b0 01 00 00 89 8e b0 01 00 00 85 c0 74 ...............t
0x5c9f57ed 07 50 e8 13 b9 0b 00 59 8b ce e8 e9 30 00 00 33 .P.....Y....0..3
0x5c9f57fd c0 40 5e 8b e5 5d c3 55 8b ec 83 e4 f8 51 56 33 .@^..].U.....QV3
0x5c9f580d f6 89 74 24 04 e8 4e fd ff ff 8b 4d 08 81 c1 9c ..t$..N....M....
0x5c9f581d 00 00 00 8b 10 e8 2b e0 0c 00 8b 88 80 01 00 00 ......+.........
0x5c9f582d 8b 01 ff 10 2b c6 74 0c 83 e8 01 75 0a be 98 01 ....+.t....u....
0x5c9f583d 00 00 eb 03 6a 06 5e 8b c6 5e 8b e5 5d c3 55 8b ....j.^..^..].U.
0x5c9f584d ec 83 e4 f8 51 51 83 64 24 04 00 e8 08 fd ff ff ....QQ.d$.......
0x5c9f585d 8b 4d 08 81 c1 9c 00 00 00 8b 10 e8 e5 df 0c 00 .M..............
0x5c9f586d 8b 88 80 01 00 00 8b 01 ff 50 08 8b e5 5d c3 55 .........P...].U
0x5c9f587d 8b ec 83 e4 f8 51 51 83 64 24 04 00 e8 d7 fc ff .....QQ.d$......
0x5c9f588d ff 8b 4d 08 81 c1 9c 00 00 00 8b 10 e8 b4 df 0c ..M.............
0x5c9f589d 00 ff 75 20 8b c8 ff 75 1c ff 75 18 83 ec 0c e8 ..u....u..u.....
0x5c9f58ad 63 31 00 00 8b e5 5d c3 55 8b ec 83 e4 f8 51 51 c1....].U.....QQ
0x5c9f58bd 83 64 24 04 00 e8 9e fc ff ff 8b 4d 08 81 c1 9c .d$........M....
0x5c9f58cd 00 00 00 8b 10 e8 7b df 0c 00 ff 75 14 8b c8 ff ......{....u....
0x5c9f58dd 75 10 ff 75 0c e8 d7 32 00 00 8b e5 5d c3 55 8b u..u...2....].U.
0x5c9f58ed ec 83 e4 f8 83 ec 20 a1 84 70 e1 5d 33 c4 89 44 .........p.]3..D
0x5c9f58fd 24 1c 8b 45 0c 8d 4c 24 04 50 e8 44 f2 09 ff e8 $..E..L$.P.D....
0x5c9f590d 54 fc ff ff 8d 4c 24 04 51 8b 48 08 e8 bc be 04 T....L$.Q.H.....
0x5c9f591d 00 6a 00 6a 01 8d 4c 24 0c e8 3b 04 0a ff 8b 4c .j.j..L$..;....L
0x5c9f592d 24 1c 33 cc e8 32 c8 e3 00 8b e5 5d c3 55 8b ec $.3..2.....].U..
0x5c9f593d 56 8b f1 8b 4d 08 85 c9 74 07 e8 00 6a 0b 00 eb V...M...t...j...
0x5c9f594d 02 33 c0 8b 0e 89 06 5e 85 c9 74 0a ba 12 c0 aa .3.....^..t.....
0x5c9f595d 5c e8 fb b0 0b 00 5d c2 04 00 55 8b ec 83 ec 38 \.....]...U....8
0x5c9f596d a1 84 70 e1 5d 33 c5 89 45 f8 53 8b d9 33 c9 89 ..p.]3..E.S..3..
0x5c9f597d 4d d0 56 57 8b 03 8b 7d 08 89 4d d4 89 4d d8 89 M.VW...}..M..M..
0x5c9f598d 4d dc 85 c0 75 04 8b c1 eb 02 8b 00 50 8d 4d d4 M...u.......P.M.
0x5c9f599d e8 32 f0 7a ff 33 f6 8b 0b 85 c9 75 04 33 c0 eb .2.z.3.....u.3..
0x5c9f59ad 02 8b 01 3b f0 73 78 8b d6 e8 5e b0 0b 00 6a 00 ...;.sx...^...j.
0x5c9f59bd 50 89 45 d0 e8 34 66 0b 00 59 59 85 c0 78 5b 83 P.E..4f..YY..x[.
0x5c9f59cd 65 f0 00 8d 50 01 8d 4d e0 c7 45 f4 0f 00 00 00 e...P..M..E.....
0x5c9f59dd c6 45 e0 00 e8 3a 8a c0 ff 89 45 c8 8d 45 c8 50 .E...:....E..E.P
0x5c9f59ed ff 75 d0 e8 05 66 0b 00 59 59 85 c0 78 1b 8d 45 .u...f..YY..x..E
0x5c9f59fd e0 50 8d 4d d4 e8 1b 5c 18 ff 6a 00 6a 01 8d 4d .P.M...\..j.j..M
0x5c9f5a0d e0 e8 53 03 0a ff 46 eb 8e 83 27 00 8d 4d e0 6a ..S...F...'..M.j
0x5c9f5a1d 00 6a 01 e8 41 03 0a ff eb 44 83 27 00 eb 3f 83 .j..A....D.'..?.
0x5c9f5a2d 65 ec 00 83 65 f0 00 83 65 f4 00 8b 75 d4 eb 17 e...e...e...u...
0x5c9f5a3d 56 8d 4d cc e8 77 f8 0f ff 8b c1 8d 4d ec 50 e8 V.M..w......M.P.
0x5c9f5a4d 0f 60 c1 ff 83 c6 18 3b 75 d8 75 e4 8d 55 ec 8b .`.....;u.u..U..
0x5c9f5a5d cf e8 d9 5c f8 ff 8d 4d ec e8 0e 3a 0b ff 8d 4d ...\...M...:...M
0x5c9f5a6d d4 e8 6d 02 10 ff 8b 4d f8 8b c7 5f 5e 33 cd 5b ..m....M..._^3.[
0x5c9f5a7d e8 e6 c6 e3 00 8b e5 5d c2 04 00 55 8b ec 83 e4 .......]...U....
0x5c9f5a8d f8 83 ec 0c 53 56 57 8b f9 33 db 53 89 7c 24 14 ....SVW..3.S.|$.
0x5c9f5a9d 89 5c 24 18 66 89 5f 04 8d 4f 14 c7 07 7c 00 ab .\$.f._..O...|..
0x5c9f5aad 5d 66 89 5f 08 89 5f 0c 89 5f 10 e8 33 b0 bf ff ]f._.._.._..3...
0x5c9f5abd 53 8d 4f 18 e8 2a b0 bf ff 53 8d 4f 1c e8 21 b0 S.O..*...S.O..!.
0x5c9f5acd bf ff 89 5f 20 33 f6 89 5f 28 46 89 77 30 89 5f ..._.3.._(F.w0._
0x5c9f5add 34 89 5f 38 89 5f 3c 89 5f 40 6a 04 89 5f 44 89 4._8._<._@j.._D.
0x5c9f5aed 5f 48 e8 85 c6 e3 00 59 8d 4f 54 89 18 89 47 4c _H.....Y.OT...GL
0x5c9f5afd 89 5f 50 e8 62 32 fb ff 89 9f 8c 00 00 00 33 c9 ._P.b2........3.
0x5c9f5b0d c7 87 90 00 00 00 0f 00 00 00 88 5f 7c 66 89 9f ..........._|f..
0x5c9f5b1d 94 00 00 00 89 9f 98 00 00 00 89 9f 9c 00 00 00 ................
0x5c9f5b2d 89 9f a0 00 00 00 89 9f a4 00 00 00 89 9f a8 00 ................
0x5c9f5b3d 00 00 89 9f ac 00 00 00 8b 5d 14 51 8b 03 89 87 .........].Q....
0x5c9f5b4d b0 00 00 00 89 8f b4 00 00 00 89 8f b8 00 00 00 ................
0x5c9f5b5d 89 8f bc 00 00 00 89 8f c0 00 00 00 89 8f c4 00 ................
0x5c9f5b6d 00 00 89 8f c8 00 00 00 88 8f cc 00 00 00 89 b7 ................
0x5c9f5b7d d0 00 00 00 8d b7 e8 00 00 00 89 8f d4 00 00 00 ................
0x5c9f5b8d 8b 43 0c 89 87 d8 00 00 00 8b 43 04 88 8f e0 00 .C........C.....
0x5c9f5b9d 00 00 8b ce 89 87 dc 00 00 00 c7 87 e4 00 00 00 ................
0x5c9f5bad 02 00 00 00 e8 78 37 00 00 8b 45 08 33 c9 c7 06 .....x7...E.3...
0x5c9f5bbd 78 00 ab 5d 8b 75 0c 89 8f 00 01 00 00 89 8f 04 x..].u..........
0x5c9f5bcd 01 00 00 89 4d 08 89 87 08 01 00 00 56 8d 8f 0c ....M.......V...
0x5c9f5bdd 01 00 00 e8 d1 ef 09 ff 66 8b 46 18 8b f7 ff 75 ........f.F....u
0x5c9f5bed 10 66 89 87 24 01 00 00 8d 8e 28 01 00 00 e8 40 .f..$.....(....@
0x5c9f5bfd 97 fa ff 8d 43 14 50 8d 8e 84 01 00 00 e8 a7 ef ....C.P.........
0x5c9f5c0d 09 ff 33 c0 8d 8e b8 01 00 00 89 86 9c 01 00 00 ..3.............
0x5c9f5c1d 88 86 a0 01 00 00 89 86 a4 01 00 00 89 86 a8 01 ................
0x5c9f5c2d 00 00 88 86 ac 01 00 00 89 86 b0 01 00 00 66 89 ..............f.
0x5c9f5c3d 86 b4 01 00 00 e8 9a af f8 ff c7 86 d8 01 00 00 ................
0x5c9f5c4d 01 00 00 00 33 c9 89 8e dc 01 00 00 89 8e e0 01 ....3...........
0x5c9f5c5d 00 00 89 8e e4 01 00 00 8b 43 08 89 86 e8 01 00 .........C......
0x5c9f5c6d 00 8b 43 10 33 db 89 86 ec 01 00 00 c7 86 04 02 ..C.3...........
0x5c9f5c7d 00 00 0f 00 00 00 89 9e 00 02 00 00 88 9e f0 01 ................
0x5c9f5c8d 00 00 8b 86 08 01 00 00 88 9e 08 02 00 00 8b 48 ...............H
0x5c9f5c9d 0c 8b 01 ff 50 2c 8d be 0c 02 00 00 8b f0 a5 a5 ....P,..........
0x5c9f5cad a5 a5 8b 74 24 10 89 9e 1c 02 00 00 89 b6 20 02 ...t$...........
0x5c9f5cbd 00 00 39 9e b0 00 00 00 75 06 88 1d 00 00 00 00 ..9.....u.......
0x5c9f5ccd 39 9e e8 01 00 00 75 06 88 1d 00 00 00 00 39 9e 9.....u.......9.
0x5c9f5cdd d8 00 00 00 75 06 88 1d 00 00 00 00 39 9e ec 01 ....u.......9...
0x5c9f5ced 00 00 75 06 88 1d 00 00 00 00 8b 7d 08 85 ff 74 ..u........}...t
0x5c9f5cfd 0e 8b cf e8 b8 91 fa ff 57 e8 a9 dc 0b 00 59 5f ........W.....Y_
0x5c9f5d0d 8b c6 5e 5b 8b e5 5d c2 10 00 55 8b ec 56 8b f1 ..^[..]...U..V..
0x5c9f5d1d e8 14 00 00 00 f6 45 08 01 74 07 56 e8 86 dc 0b ......E..t.V....
0x5c9f5d2d 00 59 8b c6 5e 5d c2 04 00 53 56 8b f1 57 c7 06 .Y..^]...SV..W..
0x5c9f5d3d 7c 00 ab 5d e8 46 04 00 00 8d 8e 1c 02 00 00 33 |..].F.........3
0x5c9f5d4d db 89 59 04 e8 5a 71 c3 ff 33 ff c7 86 18 02 00 ..Y..Zq..3......
0x5c9f5d5d 00 ef be ad de 53 47 8d 8e f0 01 00 00 57 e8 f6 .....SG......W..
0x5c9f5d6d ff 09 ff 8d 8e dc 01 00 00 e8 1b 1f 0a ff 8d 8e ................
0x5c9f5d7d b8 01 00 00 e8 7f ae f8 ff 8b 86 b0 01 00 00 85 ................
0x5c9f5d8d c0 74 07 50 e8 71 b3 0b 00 59 8d 8e a8 01 00 00 .t.P.q...Y......
0x5c9f5d9d e8 45 bc f8 ff 53 57 8d 8e 84 01 00 00 e8 b7 ff .E...SW.........
0x5c9f5dad 09 ff 8d 8e 28 01 00 00 e8 d3 96 fa ff 53 57 8d ....(........SW.
0x5c9f5dbd 8e 0c 01 00 00 e8 9f ff 09 ff 8d 8e 08 01 00 00 ................
0x5c9f5dcd e8 da 3f a2 ff 8d 8e e8 00 00 00 c7 01 78 00 ab ..?..........x..
0x5c9f5ddd 5d e8 e1 32 00 00 8d 8e c0 00 00 00 e8 c2 5e 10 ]..2..........^.
0x5c9f5ded ff 8b 8e b4 00 00 00 85 c9 74 05 8b 01 57 ff 10 .........t...W..
0x5c9f5dfd 8d 8e a4 00 00 00 e8 1c 38 0b ff 8d 8e 98 00 00 ........8.......
0x5c9f5e0d 00 e8 cd fe 0f ff 53 57 8d 4e 7c e8 49 ff 09 ff ......SW.N|.I...
0x5c9f5e1d 8d 4e 54 e8 d4 2f fb ff 8b 4e 50 85 c9 74 05 e8 .NT../...NP..t..