howinthewhat
Topic Starter
Hopefully I don't make any waves . Satchfan is currently assisting me in the removal of infections under the name krptd-or krptd_na_cnce ; My request is to pin this reply to that previous post, if at all possible please and thank you.
I didnt know how else to go about it- I was not able to message directly or reply to the previous posts nor was I able to log in with credentials. Error message was must log in to post-incorrect username or password that user name does not match current members and when I tried to register it said that name was already in use.
Here is RogueKiller log you requested…in 2 parts
[00:00:0016] ***** Global Init *****
[00:00:0016] Has crashed before : 1
[00:00:0016] Create mutex : RogueKiller
[00:30:0047] Mutex Created : 0x22c
[00:30:0047] Fill lists
[00:30:0125] OS Language : English
[00:30:0125] Take Privileges
[00:30:0125] Modify Token
[00:30:0125] Set priority to HIGH
[00:30:0125] Getting Operating System
[00:30:0125] Os Getted : Windows XP (5.1.2600 Service Pack 3) 32 bits version
[00:30:0125] ***** Global Init OK *****
[00:30:0125] ***** GUI Init *****
[00:30:0375] ***** GUI Init OK *****
[00:30:0375] Get build number
[00:30:0375] build number : RogueKiller™ v8.6.7 [Aug 28 2013] (x64 : 0)
[00:30:0375] ***** PreScan *****
[00:30:0391] Clear ListViews
[00:30:0391] [Check Window] TF_FloatingLangBar_WndTitle
[00:30:0391] [Check Window] CiceroUIWndFrame
[00:30:0391] [Check Window] Start Menu
[00:30:0391] [Check Window] Connections Tray
[00:30:0391] [Check Window] MCI command handling window
[00:30:0391] [Check Window] MCI command handling window
[00:30:0391] [Check Window] HiddenFaxWindow
[00:30:0391] [Check Window] UPnP Notification Monitor
[00:30:0391] [Check Window] Power Meter
[00:30:0391] [Check Window] MS_WebcheckMonitor
[00:30:0391] [Check Window] AvgTrayMainWnd
[00:30:0391] [Check Window] DccMan
[00:30:0391] [Check Window] RAPIMgr
[00:30:0391] [Check Window] ATI video bios poller client
[00:30:0391] [Check Window] ATI video bios poller
[00:30:0391] [Check Window] GDI+ Window
[00:30:0391] [Check Window] RogueKiller™ v8.6.7
[00:30:0391] [Check Window] Program Manager
[00:30:0391] [Check Window] M
[00:30:0391] [Check Window] Default IME
[00:30:0391] [Check Window] M
[00:30:0391] [Check Window] Default IME
[00:30:0391] [Check Window] M
[00:30:0391] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] M
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] M
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] Default IME
[00:30:0406] [Check Window] M
[00:30:0438] [Check Processes] Service PID : 1024
[00:32:0625] [Check Processes] [0][_0] [System Process] :
[00:32:0625] [CHECK] WhiteDLL
[00:32:0625] [CHECK] Whitelist
[00:32:0625] [CHECK] WellKnown
[00:32:0625] [Check Processes] [4][_0] System :
[00:32:0625] [CHECK] WhiteDLL
[00:32:0625] [CHECK] Whitelist
[00:32:0625] [CHECK] WellKnown
[00:32:0688] [Check Processes] [668][_4] smss.exe : C:\WINDOWS\System32\smss.exe
[00:32:0688] [CHECK] WhiteDLL
[00:32:0688] [CHECK] Whitelist
[00:32:0688] [CHECK] WellKnown
[00:32:0734] [Check Processes] [720][_704] avgrsx.exe : C:\Program Files\AVG\AVG2013\avgrsx.exe
[00:32:0734] [CHECK] WhiteDLL
[00:32:0734] [CHECK] Whitelist
[00:32:0734] [CHECK] WellKnown
[00:32:0734] [CHECK] WhitelistPath
[00:32:0734] [CHECK] HijackName
[00:32:0734] [CHECK] Signature
[00:32:0750] [PE] Mapping
[00:32:0750] [PE] Parsing
[00:32:0750] [PE] Dos header -> 0x1e50000
[00:32:0750] [PE] Nt header (offset : 0xf8) file size 0xba830
[00:32:0750] [PE] pNtHeadersx86 -> 0x1e500f8
[00:32:0750] [PE] Chars -> 0x102
[00:32:0750] [PE] Optional header
[00:32:0750] [PE] Sections : 5
[00:32:0750] [PE] Section : 0 - .text
[00:32:0750] [PE] Section : 1 - .rdata
[00:32:0750] [PE] Section : 2 - .data
[00:32:0750] [PE] Section : 3 - .rsrc
[00:32:0750] [PE] Section : 4 - .reloc
[00:32:0750] [PE] File open : 1
[00:32:0750] [PE] Search sigs
[00:32:0750] [PE] Section[0/4] : 0x1e50400
[00:32:0750] [PE] Init AhoCorasick
[00:32:0750] [PE] Start AhoCorasick
[00:32:0766] [PE] Looking results : 0
[00:32:0766] [PE] Section[1/4] : 0x1edf600
[00:32:0766] [PE] Init AhoCorasick
[00:32:0766] [PE] Start AhoCorasick
[00:32:0766] [PE] Looking results : 0
[00:32:0766] [PE] Section[2/4] : 0x1ef8400
[00:32:0766] [PE] Init AhoCorasick
[00:32:0766] [PE] Start AhoCorasick
[00:32:0766] [PE] Looking results : 0
[00:32:0766] [PE] Section[3/4] : 0x1efa200
[00:32:0766] [PE] Init AhoCorasick
[00:32:0766] [PE] Start AhoCorasick
[00:32:0766] [PE] Looking results : 0
[00:32:0766] [PE] Section[4/4] : 0x1efaa00
[00:32:0766] [PE] Init AhoCorasick
[00:32:0766] [PE] Start AhoCorasick
[00:32:0766] [PE] Looking results : 0
[00:32:0766] [CHECK] Blacklist
[00:32:0766] [CHECK] BlacklistPath
[00:32:0766] [CHECK] BlacklistMD5
[00:32:0766] [CHECK] MadeNumbers
[00:32:0766] [CHECK] HasUnicode
[00:32:0766] [CHECK] SuspPath
[00:32:0766] [CHECK] ProcessResidue
[00:32:0766] [CHECK] Not found!
[00:32:0797] [Check Processes] [952][_668] csrss.exe : C:\WINDOWS\system32\csrss.exe
[00:32:0797] [CHECK] WhiteDLL
[00:32:0813] [CHECK] Whitelist
[00:32:0813] [CHECK] WellKnown
[00:32:0844] [Check Processes] [980][_668] winlogon.exe : C:\WINDOWS\system32\winlogon.exe
[00:32:0844] [CHECK] WhiteDLL
[00:32:0844] [CHECK] Whitelist
[00:32:0844] [CHECK] WellKnown
[00:32:0875] [Check Processes] [1024][_980] services.exe : C:\WINDOWS\system32\services.exe
[00:32:0875] [CHECK] WhiteDLL
[00:32:0875] [CHECK] Whitelist
[00:32:0875] [CHECK] WellKnown
[00:32:0906] [Check Processes] [1036][_980] lsass.exe : C:\WINDOWS\system32\lsass.exe
[00:32:0906] [CHECK] WhiteDLL
[00:32:0906] [CHECK] Whitelist
[00:32:0906] [CHECK] WellKnown
[00:32:0953] [Check Processes] [1188][_1024] ati2evxx.exe : C:\WINDOWS\system32\ati2evxx.exe
[00:32:0953] [CHECK] WhiteDLL
[00:32:0953] [CHECK] Whitelist
[00:32:0953] [CHECK] WellKnown
[00:32:0953] [CHECK] WhitelistPath
[00:32:0953] [CHECK] HijackName
[00:32:0953] [CHECK] Signature
[00:32:0953] [PE] Mapping
[00:32:0953] [PE] Parsing
[00:32:0953] [PE] Dos header -> 0x1e50000
[00:32:0953] [PE] Nt header (offset : 0xe0) file size 0x68000
[00:32:0953] [PE] pNtHeadersx86 -> 0x1e500e0
[00:32:0953] [PE] Chars -> 0x10f
[00:32:0953] [PE] Optional header
[00:32:0953] [PE] Sections : 4
[00:32:0953] [PE] Section : 0 - .text
[00:32:0953] [PE] Section : 1 - .rdata
[00:32:0953] [PE] Section : 2 - .data
[00:32:0953] [PE] Section : 3 - .rsrc
[00:32:0953] [PE] File open : 1
[00:32:0969] [PE] Search sigs
[00:32:0969] [PE] Section[0/3] : 0x1e51000
[00:32:0969] [PE] Init AhoCorasick
[00:32:0969] [PE] Start AhoCorasick
[00:32:0969] [PE] Looking results : 0
[00:32:0969] [PE] Section[1/3] : 0x1e97000
[00:32:0969] [PE] Init AhoCorasick
[00:32:0969] [PE] Start AhoCorasick
[00:32:0969] [PE] Looking results : 0
[00:32:0969] [PE] Section[2/3] : 0x1eb6000
[00:32:0969] [PE] Init AhoCorasick
[00:32:0969] [PE] Start AhoCorasick
[00:32:0969] [PE] Looking results : 0
[00:32:0969] [PE] Section[3/3] : 0x1eb7000
[00:32:0969] [PE] Init AhoCorasick
[00:32:0969] [PE] Start AhoCorasick
[00:32:0969] [PE] Looking results : 0
[00:32:0969] [CHECK] Blacklist
[00:32:0969] [CHECK] BlacklistPath
[00:32:0969] [CHECK] BlacklistMD5
[00:32:0969] [CHECK] MadeNumbers
[00:32:0969] [CHECK] HasUnicode
[00:32:0969] [CHECK] SuspPath
[00:32:0969] [CHECK] ProcessResidue
[00:32:0969] [CHECK] Not found!
[00:32:0969] [Check Processes] [1208][_1024] svchost.exe : C:\WINDOWS\system32\svchost.exe
[00:32:0984] [CHECK] WhiteDLL
[00:32:0984] [CHECK] Whitelist
[00:32:0984] [CHECK] WellKnown
[00:32:0984] [Check Processes] [1276][_1024] svchost.exe : C:\WINDOWS\system32\svchost.exe
[00:32:0984] [CHECK] WhiteDLL
[00:32:0984] [CHECK] Whitelist
[00:32:0984] [CHECK] WellKnown
[00:32:0984] [Check Processes] [1316][_1024] svchost.exe : C:\WINDOWS\system32\svchost.exe
[00:32:0984] [CHECK] WhiteDLL
[00:32:0984] [CHECK] Whitelist
[00:32:0984] [CHECK] WellKnown
[00:32:0984] [Check Processes] [1356][_1024] svchost.exe : C:\WINDOWS\system32\svchost.exe
[00:32:0984] [CHECK] WhiteDLL
[00:32:0984] [CHECK] Whitelist
[00:32:0984] [CHECK] WellKnown
[00:32:0984] [Check Processes] [1460][_1024] svchost.exe : C:\WINDOWS\system32\svchost.exe
[00:32:0984] [CHECK] WhiteDLL
[00:32:0984] [CHECK] Whitelist
[00:32:0984] [CHECK] WellKnown
[00:32:0984] [Check Processes] [1684][_980] ati2evxx.exe : C:\WINDOWS\system32\ati2evxx.exe
[00:32:0984] [CHECK] WhiteDLL
[00:32:0984] [CHECK] Whitelist
[00:32:0984] [CHECK] WellKnown
[00:32:0984] [CHECK] WhitelistPath
[00:32:0984] [CHECK] HijackName
[00:32:0984] [CHECK] Signature
[00:33:0000] [PE] Mapping
[00:33:0000] [PE] Parsing
[00:33:0000] [PE] Dos header -> 0x1e50000
[00:33:0000] [PE] Nt header (offset : 0xe0) file size 0x68000
[00:33:0000] [PE] pNtHeadersx86 -> 0x1e500e0
[00:33:0000] [PE] Chars -> 0x10f
[00:33:0000] [PE] Optional header
[00:33:0000] [PE] Sections : 4
[00:33:0000] [PE] Section : 0 - .text
[00:33:0000] [PE] Section : 1 - .rdata
[00:33:0000] [PE] Section : 2 - .data
[00:33:0000] [PE] Section : 3 - .rsrc
[00:33:0000] [PE] File open : 1
[00:33:0000] [PE] Search sigs
[00:33:0000] [PE] Section[0/3] : 0x1e51000
[00:33:0000] [PE] Init AhoCorasick
[00:33:0000] [PE] Start AhoCorasick
[00:33:0016] [PE] Looking results : 0
[00:33:0016] [PE] Section[1/3] : 0x1e97000
[00:33:0016] [PE] Init AhoCorasick
[00:33:0016] [PE] Start AhoCorasick
[00:33:0016] [PE] Looking results : 0
[00:33:0016] [PE] Section[2/3] : 0x1eb6000
[00:33:0016] [PE] Init AhoCorasick
[00:33:0016] [PE] Start AhoCorasick
[00:33:0016] [PE] Looking results : 0
[00:33:0016] [PE] Section[3/3] : 0x1eb7000
[00:33:0016] [PE] Init AhoCorasick
[00:33:0016] [PE] Start AhoCorasick
[00:33:0016] [PE] Looking results : 0
[00:33:0016] [CHECK] Blacklist
[00:33:0016] [CHECK] BlacklistPath
[00:33:0016] [CHECK] BlacklistMD5
[00:33:0016] [CHECK] MadeNumbers
[00:33:0016] [CHECK] HasUnicode
[00:33:0016] [CHECK] SuspPath
[00:33:0016] [CHECK] ProcessResidue
[00:33:0016] [CHECK] Not found!
[00:33:0063] [Check Processes] [1780][_1024] spoolsv.exe : C:\WINDOWS\system32\spoolsv.exe
[00:33:0063] [CHECK] WhiteDLL
[00:33:0063] [CHECK] Whitelist
[00:33:0063] [CHECK] WellKnown
[00:33:0125] [Check Processes] [1868][_1024] AppleMobileDeviceService.exe : C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
[00:33:0125] [CHECK] WhiteDLL
[00:33:0125] [CHECK] Whitelist
[00:33:0125] [CHECK] WellKnown
[00:33:0125] [CHECK] WhitelistPath
[00:33:0125] [CHECK] HijackName
[00:33:0125] [CHECK] Signature
[00:33:0125] [PE] Mapping
[00:33:0125] [PE] Parsing
[00:33:0125] [PE] Dos header -> 0x1e50000
[00:33:0125] [PE] Nt header (offset : 0xf0) file size 0x23330
[00:33:0125] [PE] pNtHeadersx86 -> 0x1e500f0
[00:33:0125] [PE] Chars -> 0x102
[00:33:0125] [PE] Optional header
[00:33:0125] [PE] Sections : 5
[00:33:0125] [PE] Section : 0 - .text
[00:33:0125] [PE] Section : 1 - .rdata
[00:33:0125] [PE] Section : 2 - .data
[00:33:0125] [PE] Section : 3 - .rsrc
[00:33:0125] [PE] Section : 4 - .reloc
[00:33:0125] [PE] File open : 1
[00:33:0125] [PE] Search sigs
[00:33:0125] [PE] Section[0/4] : 0x1e51000
[00:33:0125] [PE] Init AhoCorasick
[00:33:0125] [PE] Start AhoCorasick
[00:33:0141] [PE] Looking results : 0
[00:33:0141] [PE] Section[1/4] : 0x1e65000
[00:33:0141] [PE] Init AhoCorasick
[00:33:0141] [PE] Start AhoCorasick
[00:33:0141] [PE] Looking results : 0
[00:33:0141] [PE] Section[2/4] : 0x1e68000
[00:33:0141] [PE] Init AhoCorasick
[00:33:0141] [PE] Start AhoCorasick
[00:33:0141] [PE] Looking results : 0
[00:33:0141] [PE] Section[3/4] : 0x1e6f000
[00:33:0141] [PE] Init AhoCorasick
[00:33:0141] [PE] Start AhoCorasick
[00:33:0141] [PE] Looking results : 0
[00:33:0141] [PE] Section[4/4] : 0x1e70000
[00:33:0141] [PE] Init AhoCorasick
[00:33:0141] [PE] Start AhoCorasick
[00:33:0141] [PE] Looking results : 0
[00:33:0141] [CHECK] Blacklist
[00:33:0141] [CHECK] BlacklistPath
[00:33:0141] [CHECK] BlacklistMD5
[00:33:0141] [CHECK] MadeNumbers
[00:33:0141] [CHECK] HasUnicode
[00:33:0141] [CHECK] SuspPath
[00:33:0141] [CHECK] ProcessResidue
[00:33:0141] [CHECK] Not found!
[00:33:0172] [Check Processes] [216][_1024] avgwdsvc.exe : C:\Program Files\AVG\AVG2013\avgwdsvc.exe
[00:33:0172] [CHECK] WhiteDLL
[00:33:0172] [CHECK] Whitelist
[00:33:0172] [CHECK] WellKnown
[00:33:0172] [CHECK] WhitelistPath
[00:33:0172] [CHECK] HijackName
[00:33:0172] [CHECK] Signature
[00:33:0172] [PE] Mapping
[00:33:0188] [PE] Parsing
[00:33:0188] [PE] Dos header -> 0x1e50000
[00:33:0188] [PE] Nt header (offset : 0x100) file size 0x45200
[00:33:0188] [PE] pNtHeadersx86 -> 0x1e50100
[00:33:0188] [PE] Chars -> 0x102
[00:33:0188] [PE] Optional header
[00:33:0188] [PE] Sections : 5
[00:33:0188] [PE] Section : 0 - .text
[00:33:0188] [PE] Section : 1 - .rdata
[00:33:0188] [PE] Section : 2 - .data
[00:33:0188] [PE] Section : 3 - .rsrc
[00:33:0188] [PE] Section : 4 - .reloc
[00:33:0188] [PE] File open : 1
[00:33:0188] [PE] Search sigs
[00:33:0188] [PE] Section[0/4] : 0x1e50400
[00:33:0188] [PE] Init AhoCorasick
[00:33:0188] [PE] Start AhoCorasick
[00:33:0188] [PE] Looking results : 0
[00:33:0188] [PE] Section[1/4] : 0x1e70000
[00:33:0188] [PE] Init AhoCorasick
[00:33:0188] [PE] Start AhoCorasick
[00:33:0188] [PE] Looking results : 0
[00:33:0188] [PE] Section[2/4] : 0x1e79600
[00:33:0188] [PE] Init AhoCorasick
[00:33:0188] [PE] Start AhoCorasick
[00:33:0188] [PE] Looking results : 0
[00:33:0188] [PE] Section[3/4] : 0x1e79800
[00:33:0188] [PE] Init AhoCorasick
[00:33:0188] [PE] Start AhoCorasick
[00:33:0188] [PE] Looking results : 0
[00:33:0188] [PE] Section[4/4] : 0x1e8f200
[00:33:0188] [PE] Init AhoCorasick
[00:33:0188] [PE] Start AhoCorasick
[00:33:0188] [PE] Looking results : 0
[00:33:0188] [CHECK] Blacklist
[00:33:0188] [CHECK] BlacklistPath
[00:33:0188] [CHECK] BlacklistMD5
[00:33:0188] [CHECK] MadeNumbers
[00:33:0188] [CHECK] HasUnicode
[00:33:0188] [CHECK] SuspPath
[00:33:0188] [CHECK] ProcessResidue
[00:33:0188] [CHECK] Not found!
[00:33:0281] [Check Processes] [384][_1024] jqs.exe : C:\Program Files\Java\jre7\bin\jqs.exe
[00:33:0281] [CHECK] WhiteDLL
[00:33:0281] [CHECK] Whitelist
[00:33:0281] [CHECK] WellKnown
[00:33:0281] [CHECK] WhitelistPath
[00:33:0297] [CHECK] HijackName
[00:33:0297] [CHECK] Signature
[00:33:0297] [PE] Mapping
[00:33:0297] [PE] Parsing
[00:33:0297] [PE] Dos header -> 0x1e50000
[00:33:0297] [PE] Nt header (offset : 0xf0) file size 0x2c7a8
[00:33:0297] [PE] pNtHeadersx86 -> 0x1e500f0
[00:33:0297] [PE] Chars -> 0x102
[00:33:0297] [PE] Optional header
[00:33:0297] [PE] Sections : 5
[00:33:0297] [PE] Section : 0 - .text
[00:33:0297] [PE] Section : 1 - .rdata
[00:33:0297] [PE] Section : 2 - .data
[00:33:0297] [PE] Section : 3 - .rsrc
[00:33:0297] [PE] Section : 4 - .reloc
[00:33:0297] [PE] File open : 1
[00:33:0297] [PE] Search sigs
[00:33:0297] [PE] Section[0/4] : 0x1e50400
[00:33:0297] [PE] Init AhoCorasick
[00:33:0297] [PE] Start AhoCorasick
[00:33:0297] [PE] Looking results : 0
[00:33:0297] [PE] Section[1/4] : 0x1e6a600
[00:33:0297] [PE] Init AhoCorasick
[00:33:0297] [PE] Start AhoCorasick
[00:33:0297] [PE] Looking results : 0
[00:33:0297] [PE] Section[2/4] : 0x1e76a00
[00:33:0297] [PE] Init AhoCorasick
[00:33:0297] [PE] Start AhoCorasick
[00:33:0297] [PE] Looking results : 0
[00:33:0297] [PE] Section[3/4] : 0x1e77c00
[00:33:0297] [PE] Init AhoCorasick
[00:33:0297] [PE] Start AhoCorasick
[00:33:0297] [PE] Looking results : 0
[00:33:0297] [PE] Section[4/4] : 0x1e78400
[00:33:0297] [PE] Init AhoCorasick
[00:33:0297] [PE] Start AhoCorasick
[00:33:0297] [PE] Looking results : 0
[00:33:0297] [CHECK] Blacklist
[00:33:0297] [CHECK] BlacklistPath
[00:33:0297] [CHECK] BlacklistMD5
[00:33:0297] [CHECK] MadeNumbers
[00:33:0297] [CHECK] HasUnicode
[00:33:0313] [CHECK] SuspPath
[00:33:0313] [CHECK] ProcessResidue
[00:33:0313] [CHECK] Not found!
[00:33:0328] [Check Processes] [400][_292] GoogleUpdate.exe : C:\Program Files\Google\Update\GoogleUpdate.exe
[00:33:0328] [CHECK] WhiteDLL
[00:33:0328] [CHECK] Whitelist
[00:33:0328] [CHECK] WellKnown
[00:33:0328] [CHECK] WhitelistPath
[00:33:0328] [CHECK] HijackName
[00:33:0328] [CHECK] Signature
[00:33:0328] [PE] Mapping
[00:33:0344] [PE] Parsing
[00:33:0344] [PE] Dos header -> 0x1e50000
[00:33:0344] [PE] Nt header (offset : 0xe8) file size 0x207f0
[00:33:0344] [PE] pNtHeadersx86 -> 0x1e500e8
[00:33:0344] [PE] Chars -> 0x103
[00:33:0344] [PE] Optional header
[00:33:0344] [PE] Sections : 3
[00:33:0344] [PE] Section : 0 - .text
[00:33:0344] [PE] Section : 1 - .data
[00:33:0344] [PE] Section : 2 - .rsrc
[00:33:0344] [PE] File open : 1
[00:33:0344] [PE] Search sigs
[00:33:0344] [PE] Section[0/2] : 0x1e50400
[00:33:0344] [PE] Init AhoCorasick
[00:33:0344] [PE] Start AhoCorasick
[00:33:0344] [PE] Looking results : 0
[00:33:0344] [PE] Section[1/2] : 0x1e60800
[00:33:0344] [PE] Init AhoCorasick
[00:33:0344] [PE] Start AhoCorasick
[00:33:0344] [PE] Looking results : 0
[00:33:0344] [PE] Section[2/2] : 0x1e61a00
[00:33:0344] [PE] Init AhoCorasick
[00:33:0344] [PE] Start AhoCorasick
[00:33:0344] [PE] Looking results : 0
[00:33:0344] [CHECK] Blacklist
[00:33:0344] [CHECK] BlacklistPath
[00:33:0344] [CHECK] BlacklistMD5
[00:33:0344] [CHECK] MadeNumbers
[00:33:0344] [CHECK] HasUnicode
[00:33:0344] [CHECK] SuspPath
[00:33:0344] [CHECK] ProcessResidue
[00:33:0344] [CHECK] Not found!
[00:33:0375] [Check Processes] [532][_1024] sqlwriter.exe : c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
[00:33:0375] [CHECK] WhiteDLL
[00:33:0375] [CHECK] Whitelist
[00:33:0375] [CHECK] WellKnown
[00:33:0375] [CHECK] WhitelistPath
[00:33:0375] [CHECK] HijackName
[00:33:0375] [CHECK] Signature
[00:33:0391] [PE] Mapping
[00:33:0391] [PE] Parsing
[00:33:0391] [PE] Dos header -> 0x1e50000
[00:33:0391] [PE] Nt header (offset : 0x110) file size 0x15760
[00:33:0391] [PE] pNtHeadersx86 -> 0x1e50110
[00:33:0391] [PE] Chars -> 0x103
[00:33:0391] [PE] Optional header
[00:33:0391] [PE] Sections : 3
[00:33:0391] [PE] Section : 0 - .text
[00:33:0391] [PE] Section : 1 - .data
[00:33:0391] [PE] Section : 2 - .rsrc
[00:33:0391] [PE] File open : 1
[00:33:0391] [PE] Search sigs
[00:33:0391] [PE] Section[0/2] : 0x1e50400
[00:33:0391] [PE] Init AhoCorasick
[00:33:0391] [PE] Start AhoCorasick
[00:33:0391] [PE] Looking results : 0
[00:33:0391] [PE] Section[1/2] : 0x1e63000
[00:33:0391] [PE] Init AhoCorasick
[00:33:0391] [PE] Start AhoCorasick
[00:33:0391] [PE] Looking results : 0
[00:33:0391] [PE] Section[2/2] : 0x1e63200
[00:33:0391] [PE] Init AhoCorasick
[00:33:0391] [PE] Start AhoCorasick
[00:33:0391] [PE] Looking results : 0
[00:33:0391] [CHECK] Blacklist
[00:33:0391] [CHECK] BlacklistPath
[00:33:0391] [CHECK] BlacklistMD5
[00:33:0391] [CHECK] MadeNumbers
[00:33:0391] [CHECK] HasUnicode
[00:33:0391] [CHECK] SuspPath
[00:33:0391] [CHECK] ProcessResidue
[00:33:0391] [CHECK] Not found!
[00:33:0391] [Check Processes] [660][_1024] svchost.exe : C:\WINDOWS\system32\svchost.exe
[00:33:0391] [CHECK] WhiteDLL
[00:33:0391] [CHECK] Whitelist
[00:33:0391] [CHECK] WellKnown
[00:33:0484] [Check Processes] [1516][_1024] WLIDSVC.EXE : C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
[00:33:0484] [CHECK] WhiteDLL
[00:33:0484] [CHECK] Whitelist
[00:33:0484] [CHECK] WellKnown
[00:33:0484] [CHECK] WhitelistPath
[00:33:0484] [CHECK] HijackName
[00:33:0484] [CHECK] Signature
[00:33:0500] [PE] Mapping
[00:33:0500] [PE] Parsing
[00:33:0500] [PE] Dos header -> 0x2150000
[00:33:0500] [PE] Nt header (offset : 0xf0) file size 0x175780
[00:33:0500] [PE] pNtHeadersx86 -> 0x21500f0
[00:33:0500] [PE] Chars -> 0x102
[00:33:0500] [PE] Optional header
[00:33:0500] [PE] Sections : 4
[00:33:0500] [PE] Section : 0 - .text
[00:33:0500] [PE] Section : 1 - .data
[00:33:0516] [PE] Section : 2 - .rsrc
[00:33:0516] [PE] Section : 3 - .reloc
[00:33:0516] [PE] File open : 1
[00:33:0516] [PE] Search sigs
[00:33:0516] [PE] Section[0/3] : 0x2150400
[00:33:0516] [PE] Init AhoCorasick
[00:33:0516] [PE] Start AhoCorasick
[00:33:0531] [PE] Looking results : 0
[00:33:0531] [PE] Section[1/3] : 0x22adc00
[00:33:0531] [PE] Init AhoCorasick
[00:33:0531] [PE] Start AhoCorasick
[00:33:0531] [PE] Looking results : 0
[00:33:0531] [PE] Section[2/3] : 0x22b0600
[00:33:0531] [PE] Init AhoCorasick
[00:33:0531] [PE] Start AhoCorasick
[00:33:0547] [PE] Looking results : 0
[00:33:0547] [PE] Section[3/3] : 0x22b1800
[00:33:0547] [PE] Init AhoCorasick
[00:33:0547] [PE] Start AhoCorasick
[00:33:0547] [PE] Looking results : 0
[00:33:0547] [CHECK] Blacklist
[00:33:0547] [CHECK] BlacklistPath
[00:33:0547] [CHECK] BlacklistMD5
[00:33:0547] [CHECK] MadeNumbers
[00:33:0547] [CHECK] HasUnicode
[00:33:0547] [CHECK] SuspPath
[00:33:0547] [CHECK] ProcessResidue
[00:33:0547] [CHECK] Not found!
[00:33:0578] [Check Processes] [1680][_1024] YahooAUService.exe : C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
[00:33:0578] [CHECK] WhiteDLL
[00:33:0578] [CHECK] Whitelist
[00:33:0578] [CHECK] WellKnown
[00:33:0578] [CHECK] WhitelistPath
[00:33:0578] [CHECK] HijackName
[00:33:0578] [CHECK] Signature
[00:33:0594] [PE] Mapping
[00:33:0594] [PE] Parsing
[00:33:0594] [PE] Dos header -> 0x1e50000
[00:33:0594] [PE] Nt header (offset : 0xe8) file size 0x93118
[00:33:0594] [PE] pNtHeadersx86 -> 0x1e500e8
[00:33:0594] [PE] Chars -> 0x103
[00:33:0594] [PE] Optional header
[00:33:0594] [PE] Sections : 4
[00:33:0594] [PE] Section : 0 - .text
[00:33:0594] [PE] Section : 1 - .rdata
[00:33:0594] [PE] Section : 2 - .data
[00:33:0594] [PE] Section : 3 - .rsrc
[00:33:0594] [PE] File open : 1
[00:33:0594] [PE] Search sigs
[00:33:0594] [PE] Section[0/3] : 0x1e50400
[00:33:0594] [PE] Init AhoCorasick
[00:33:0594] [PE] Start AhoCorasick
[00:33:0609] [PE] Looking results : 0
[00:33:0609] [PE] Section[1/3] : 0x1eb5e00
[00:33:0609] [PE] Init AhoCorasick
[00:33:0609] [PE] Start AhoCorasick
[00:33:0609] [PE] Looking results : 0
[00:33:0609] [PE] Section[2/3] : 0x1ed7800
[00:33:0609] [PE] Init AhoCorasick
[00:33:0609] [PE] Start AhoCorasick
[00:33:0609] [PE] Looking results : 0
[00:33:0609] [PE] Section[3/3] : 0x1edd000
[00:33:0609] [PE] Init AhoCorasick
[00:33:0609] [PE] Start AhoCorasick
[00:33:0609] [PE] Looking results : 0
[00:33:0609] [CHECK] Blacklist
[00:33:0609] [CHECK] BlacklistPath
[00:33:0609] [CHECK] BlacklistMD5
[00:33:0609] [CHECK] MadeNumbers
[00:33:0609] [CHECK] HasUnicode
[00:33:0609] [CHECK] SuspPath
[00:33:0609] [CHECK] ProcessResidue
[00:33:0609] [CHECK] Not found!
[00:33:0641] [Check Processes] [1932][_216] avgnsx.exe : C:\Program Files\AVG\AVG2013\avgnsx.exe
[00:33:0641] [CHECK] WhiteDLL
[00:33:0641] [CHECK] Whitelist
[00:33:0641] [CHECK] WellKnown
[00:33:0641] [CHECK] WhitelistPath
[00:33:0641] [CHECK] HijackName
[00:33:0641] [CHECK] Signature
[00:33:0672] [PE] Mapping
[00:33:0672] [PE] Parsing
[00:33:0672] [PE] Dos header -> 0x2150000
[00:33:0672] [PE] Nt header (offset : 0x100) file size 0x110e30
[00:33:0672] [PE] pNtHeadersx86 -> 0x2150100
[00:33:0672] [PE] Chars -> 0x102
[00:33:0672] [PE] Optional header
[00:33:0672] [PE] Sections : 6
[00:33:0672] [PE] Section : 0 - .text
[00:33:0672] [PE] Section : 1 - .rdata
[00:33:0672] [PE] Section : 2 - .data
[00:33:0672] [PE] Section : 3 - .tls
[00:33:0672] [PE] Section : 4 - .rsrc
[00:33:0672] [PE] Section : 5 - .reloc
[00:33:0672] [PE] File open : 1
[00:33:0672] [PE] Search sigs
[00:33:0672] [PE] Section[0/5] : 0x2150400
[00:33:0672] [PE] Init AhoCorasick
[00:33:0672] [PE] Start AhoCorasick
[00:33:0688] [PE] Looking results : 0
[00:33:0688] [PE] Section[1/5] : 0x2227600
[00:33:0688] [PE] Init AhoCorasick
[00:33:0688] [PE] Start AhoCorasick
[00:33:0688] [PE] Looking results : 0
[00:33:0688] [PE] Section[2/5] : 0x224bc00
[00:33:0688] [PE] Init AhoCorasick
[00:33:0688] [PE] Start AhoCorasick
[00:33:0688] [PE] Looking results : 0
[00:33:0688] [PE] Section[3/5] : 0x224cc00
[00:33:0688] [PE] Init AhoCorasick
[00:33:0703] [PE] Start AhoCorasick
[00:33:0703] [PE] Looking results : 0
[00:33:0703] [PE] Section[4/5] : 0x224ce00
[00:33:0703] [PE] Init AhoCorasick
[00:33:0703] [PE] Start AhoCorasick
[00:33:0703] [PE] Looking results : 0
[00:33:0703] [PE] Section[5/5] : 0x224d600
[00:33:0703] [PE] Init AhoCorasick
[00:33:0703] [PE] Start AhoCorasick
[00:33:0703] [PE] Looking results : 0
[00:33:0703] [CHECK] Blacklist
[00:33:0703] [CHECK] BlacklistPath
[00:33:0703] [CHECK] BlacklistMD5
[00:33:0703] [CHECK] MadeNumbers
[00:33:0703] [CHECK] HasUnicode
[00:33:0703] [CHECK] SuspPath
[00:33:0703] [CHECK] ProcessResidue
[00:33:0703] [CHECK] Not found!
[00:33:0719] [Check Processes] [1944][_216] avgemcx.exe : C:\Program Files\AVG\AVG2013\avgemcx.exe
[00:33:0719] [CHECK] WhiteDLL
[00:33:0719] [CHECK] Whitelist
[00:33:0719] [CHECK] WellKnown
[00:33:0719] [CHECK] WhitelistPath
[00:33:0719] [CHECK] HijackName
[00:33:0719] [CHECK] Signature
[00:33:0734] [PE] Mapping
[00:33:0734] [PE] Parsing
[00:33:0734] [PE] Dos header -> 0x1e50000
[00:33:0734] [PE] Nt header (offset : 0x100) file size 0xc3230
[00:33:0734] [PE] pNtHeadersx86 -> 0x1e50100
[00:33:0734] [PE] Chars -> 0x102
[00:33:0734] [PE] Optional header
[00:33:0734] [PE] Sections : 5
[00:33:0734] [PE] Section : 0 - .text
[00:33:0734] [PE] Section : 1 - .rdata
[00:33:0734] [PE] Section : 2 - .data
[00:33:0734] [PE] Section : 3 - .rsrc
[00:33:0734] [PE] Section : 4 - .reloc
[00:33:0734] [PE] File open : 1
[00:33:0734] [PE] Search sigs
[00:33:0734] [PE] Section[0/4] : 0x1e50400
[00:33:0734] [PE] Init AhoCorasick
[00:33:0734] [PE] Start AhoCorasick
[00:33:0750] [PE] Looking results : 0
[00:33:0750] [PE] Section[1/4] : 0x1ecd400
[00:33:0750] [PE] Init AhoCorasick
[00:33:0750] [PE] Start AhoCorasick
[00:33:0750] [PE] Looking results : 0
[00:33:0750] [PE] Section[2/4] : 0x1eeda00
[00:33:0750] [PE] Init AhoCorasick
[00:33:0750] [PE] Start AhoCorasick
[00:33:0750] [PE] Looking results : 0
[00:33:0750] [PE] Section[3/4] : 0x1eede00
[00:33:0750] [PE] Init AhoCorasick
[00:33:0750] [PE] Start AhoCorasick
[00:33:0750] [PE] Looking results : 0
[00:33:0750] [PE] Section[4/4] : 0x1f03800
[00:33:0750] [PE] Init AhoCorasick
[00:33:0750] [PE] Start AhoCorasick
[00:33:0766] [PE] Looking results : 0
[00:33:0766] [CHECK] Blacklist
[00:33:0766] [CHECK] BlacklistPath
[00:33:0766] [CHECK] BlacklistMD5
[00:33:0766] [CHECK] MadeNumbers
[00:33:0766] [CHECK] HasUnicode
[00:33:0766] [CHECK] SuspPath
[00:33:0766] [CHECK] ProcessResidue
[00:33:0766] [CHECK] Not found!
[00:33:0813] [Check Processes] [2416][_1516] WLIDSVCM.EXE : C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
[00:33:0813] [CHECK] WhiteDLL
[00:33:0813] [CHECK] Whitelist
[00:33:0813] [CHECK] WellKnown
[00:33:0813] [CHECK] WhitelistPath
[00:33:0813] [CHECK] HijackName
[00:33:0813] [CHECK] Signature
[00:33:0813] [PE] Mapping
[00:33:0813] [PE] Parsing
[00:33:0813] [PE] Dos header -> 0x1e50000
[00:33:0813] [PE] Nt header (offset : 0xe8) file size 0x2cb70
[00:33:0813] [PE] pNtHeadersx86 -> 0x1e500e8
[00:33:0813] [PE] Chars -> 0x102
[00:33:0813] [PE] Optional header
[00:33:0813] [PE] Sections : 4
[00:33:0813] [PE] Section : 0 - .text
[00:33:0813] [PE] Section : 1 - .data
[00:33:0813] [PE] Section : 2 - .rsrc
[00:33:0813] [PE] Section : 3 - .reloc
[00:33:0813] [PE] File open : 1
[00:33:0813] [PE] Search sigs
[00:33:0813] [PE] Section[0/3] : 0x1e50400
[00:33:0813] [PE] Init AhoCorasick
[00:33:0813] [PE] Start AhoCorasick
[00:33:0828] [PE] Looking results : 0
[00:33:0828] [PE] Section[1/3] : 0x1e6da00
[00:33:0828] [PE] Init AhoCorasick
[00:33:0828] [PE] Start AhoCorasick
[00:33:0828] [PE] Looking results : 0
[00:33:0828] [PE] Section[2/3] : 0x1e6f200
[00:33:0828] [PE] Init AhoCorasick
[00:33:0828] [PE] Start AhoCorasick
[00:33:0828] [PE] Looking results : 0
[00:33:0828] [PE] Section[3/3] : 0x1e76e00
[00:33:0828] [PE] Init AhoCorasick
[00:33:0828] [PE] Start AhoCorasick
[00:33:0828] [PE] Looking results : 0
[00:33:0828] [CHECK] Blacklist
[00:33:0828] [CHECK] BlacklistPath
[00:33:0828] [CHECK] BlacklistMD5
[00:33:0828] [CHECK] MadeNumbers
[00:33:0828] [CHECK] HasUnicode
[00:33:0828] [CHECK] SuspPath
[00:33:0828] [CHECK] ProcessResidue
[00:33:0828] [CHECK] Not found!
[00:33:0875] [Check Processes] [3140][_1024] alg.exe : C:\WINDOWS\system32\alg.exe
[00:33:0875] [CHECK] WhiteDLL
[00:33:0875] [CHECK] Whitelist
[00:33:0875] [CHECK] WellKnown
[00:33:0906] [Check Processes] [3548][_2700] jusched.exe : C:\Program Files\Common Files\Java\Java Update\jusched.exe
[00:33:0906] [CHECK] WhiteDLL
[00:33:0906] [CHECK] Whitelist
[00:33:0953] [Check Processes] [3668][_2700] ctfmon.exe : C:\WINDOWS\system32\ctfmon.exe
[00:33:0953] [CHECK] WhiteDLL
[00:33:0953] [CHECK] Whitelist
[00:33:0953] [CHECK] WellKnown
[00:34:0000] [Check Processes] [3716][_2700] wcescomm.exe : C:\Program Files\Microsoft ActiveSync\wcescomm.exe
[00:34:0000] [CHECK] WhiteDLL
[00:34:0000] [CHECK] Whitelist
[00:34:0000] [CHECK] WellKnown
[00:34:0000] [CHECK] WhitelistPath
[00:34:0000] [CHECK] HijackName
[00:34:0000] [CHECK] Signature
[00:34:0031] [PE] Mapping
[00:34:0031] [PE] Parsing
[00:34:0031] [PE] Dos header -> 0x2150000
[00:34:0031] [PE] Nt header (offset : 0x100) file size 0x13ab28
[00:34:0031] [PE] pNtHeadersx86 -> 0x2150100
[00:34:0031] [PE] Chars -> 0x123
[00:34:0031] [PE] Optional header
[00:34:0031] [PE] Sections : 3
[00:34:0031] [PE] Section : 0 - .text
[00:34:0031] [PE] Section : 1 - .data
[00:34:0031] [PE] Section : 2 - .rsrc
[00:34:0031] [PE] File open : 1
[00:34:0031] [PE] Search sigs
[00:34:0031] [PE] Section[0/2] : 0x2151000
[00:34:0031] [PE] Init AhoCorasick
[00:34:0031] [PE] Start AhoCorasick
[00:34:0031] [PE] Looking results : 0
[00:34:0031] [PE] Section[1/2] : 0x2180000
[00:34:0031] [PE] Init AhoCorasick
[00:34:0031] [PE] Start AhoCorasick
[00:34:0031] [PE] Looking results : 0
[00:34:0031] [PE] Section[2/2] : 0x2181000
[00:34:0031] [PE] Init AhoCorasick
[00:34:0031] [PE] Start AhoCorasick
[00:34:0047] [PE] Looking results : 0
[00:34:0047] [CHECK] Blacklist
[00:34:0047] [CHECK] BlacklistPath
[00:34:0047] [CHECK] BlacklistMD5
[00:34:0047] [CHECK] MadeNumbers
[00:34:0047] [CHECK] HasUnicode
[00:34:0047] [CHECK] SuspPath
[00:34:0047] [CHECK] ProcessResidue
[00:34:0047] [CHECK] Not found!
[00:34:0047] [Check Processes] [3764][_1024] svchost.exe : C:\WINDOWS\system32\svchost.exe
[00:34:0047] [CHECK] WhiteDLL
[00:34:0063] [CHECK] Whitelist
[00:34:0063] [CHECK] WellKnown
[00:34:0094] [Check Processes] [3856][_1208] rapimgr.exe : C:\Program Files\Microsoft ActiveSync\rapimgr.exe
[00:34:0094] [CHECK] WhiteDLL
[00:34:0094] [CHECK] Whitelist
[00:34:0094] [CHECK] WellKnown
[00:34:0094] [CHECK] WhitelistPath
[00:34:0094] [CHECK] HijackName
[00:34:0094] [CHECK] Signature
[00:34:0109] [PE] Mapping
[00:34:0109] [PE] Parsing
[00:34:0109] [PE] Dos header -> 0x1e50000
[00:34:0109] [PE] Nt header (offset : 0x100) file size 0x30b28
[00:34:0109] [PE] pNtHeadersx86 -> 0x1e50100
[00:34:0109] [PE] Chars -> 0x123
[00:34:0109] [PE] Optional header
[00:34:0109] [PE] Sections : 3
[00:34:0109] [PE] Section : 0 - .text
[00:34:0109] [PE] Section : 1 - .data
[00:34:0109] [PE] Section : 2 - .rsrc
[00:34:0109] [PE] File open : 1
[00:34:0109] [PE] Search sigs
[00:34:0109] [PE] Section[0/2] : 0x1e51000
[00:34:0109] [PE] Init AhoCorasick
[00:34:0109] [PE] Start AhoCorasick
[00:34:0109] [PE] Looking results : 0
[00:34:0109] [PE] Section[1/2] : 0x1e76000
[00:34:0109] [PE] Init AhoCorasick
[00:34:0109] [PE] Start AhoCorasick
[00:34:0109] [PE] Looking results : 0
[00:34:0109] [PE] Section[2/2] : 0x1e77000
[00:34:0109] [PE] Init AhoCorasick
[00:34:0109] [PE] Start AhoCorasick
[00:34:0109] [PE] Looking results : 0
[00:34:0109] [CHECK] Blacklist
[00:34:0109] [CHECK] BlacklistPath
[00:34:0109] [CHECK] BlacklistMD5
[00:34:0109] [CHECK] MadeNumbers
[00:34:0109] [CHECK] HasUnicode
[00:34:0109] [CHECK] SuspPath
[00:34:0109] [CHECK] ProcessResidue
[00:34:0109] [CHECK] Not found!
[00:35:0219] [Check Processes] [3012][_2700] avgui.exe : C:\Program Files\AVG\AVG2013\avgui.exe
[00:35:0219] [CHECK] WhiteDLL
[00:35:0219] [CHECK] Whitelist
[00:35:0219] [CHECK] WellKnown
[00:35:0219] [CHECK] WhitelistPath
[00:35:0219] [CHECK] HijackName
[00:35:0219] [CHECK] Signature
[00:35:0297] [PE] Mapping
[00:35:0297] [PE] Parsing
[00:35:0297] [PE] Dos header -> 0x2150000
[00:35:0297] [PE] Nt header (offset : 0x118) file size 0x435030
[00:35:0297] [PE] pNtHeadersx86 -> 0x2150118
[00:35:0297] [PE] Chars -> 0x102
[00:35:0297] [PE] Optional header
[00:35:0297] [PE] Sections : 5
[00:35:0297] [PE] Section : 0 - .text
[00:35:0297] [PE] Section : 1 - .rdata
[00:35:0297] [PE] Section : 2 - .data
[00:35:0297] [PE] Section : 3 - .rsrc
[00:35:0297] [PE] Section : 4 - .reloc
[00:35:0297] [PE] File open : 1
[00:35:0297] [PE] Search sigs
[00:35:0297] [PE] Section[0/4] : 0x2150400
[00:35:0297] [PE] Init AhoCorasick
[00:35:0297] [PE] Start AhoCorasick
[00:35:0375] [PE] Looking results : 0
[00:35:0375] [PE] Section[1/4] : 0x2459800
[00:35:0375] [PE] Init AhoCorasick
[00:35:0375] [PE] Start AhoCorasick
[00:35:0375] [PE] Looking results : 0
[00:35:0375] [PE] Section[2/4] : 0x2502600
[00:35:0375] [PE] Init AhoCorasick
[00:35:0391] [PE] Start AhoCorasick
[00:35:0391] [PE] Looking results : 0
[00:35:0391] [PE] Section[3/4] : 0x2520c00
[00:35:0391] [PE] Init AhoCorasick
[00:35:0391] [PE] Start AhoCorasick
[00:35:0391] [PE] Looking results : 0
[00:35:0391] [PE] Section[4/4] : 0x2543e00
[00:35:0391] [PE] Init AhoCorasick
[00:35:0391] [PE] Start AhoCorasick
[00:35:0391] [PE] Looking results : 0
[00:35:0391] [CHECK] Blacklist
[00:35:0391] [CHECK] BlacklistPath
[00:35:0391] [CHECK] BlacklistMD5
[00:35:0391] [CHECK] MadeNumbers
[00:35:0391] [CHECK] HasUnicode
[00:35:0391] [CHECK] SuspPath
[00:35:0391] [CHECK] ProcessResidue
[00:35:0391] [CHECK] Not found!
[00:35:0594] [Check Processes] [1636][_944] explorer.exe : C:\WINDOWS\explorer.exe
[00:35:0609] [Check DLLs] explorer.exe : C:\WINDOWS\explorer.exe
[00:35:0609] [Check DLLs] ntdll.dll : C:\WINDOWS\system32\ntdll.dll
[00:35:0609] [CHECK] WhiteDLL
[00:35:0609] [Check DLLs] kernel32.dll : C:\WINDOWS\system32\kernel32.dll
[00:35:0609] [CHECK] WhiteDLL
[00:35:0609] [Check DLLs] ADVAPI32.dll : C:\WINDOWS\system32\ADVAPI32.dll
[00:35:0609] [CHECK] WhiteDLL
[00:35:0609] [Check DLLs] RPCRT4.dll : C:\WINDOWS\system32\RPCRT4.dll
[00:35:0609] [CHECK] WhiteDLL
[00:35:0609] [CHECK] Whitelist
[00:35:0609] [CHECK] WellKnown
[00:35:0609] [CHECK] WhitelistPath
[00:35:0609] [CHECK] HijackName
[00:35:0609] [CHECK] Signature
[00:35:0641] [PE] Mapping
[00:35:0641] [PE] Parsing
[00:35:0641] [PE] Dos header -> 0x1e50000
[00:35:0641] [PE] Nt header (offset : 0xe8) file size 0x90400
[00:35:0641] [PE] pNtHeadersx86 -> 0x1e500e8
[00:35:0641] [PE] Chars -> 0x210e
[00:35:0641] [PE] Optional header
[00:35:0641] [PE] Sections : 5
[00:35:0641] [PE] Section : 0 - .text
[00:35:0641] [PE] Section : 1 - .orpc
[00:35:0641] [PE] Section : 2 - .data
[00:35:0641] [PE] Section : 3 - .rsrc
[00:35:0641] [PE] Section : 4 - .reloc
[00:35:0641] [PE] File open : 1
[00:35:0641] [PE] Search sigs
[00:35:0641] [PE] Section[0/4] : 0x1e50400
[00:35:0641] [PE] Init AhoCorasick
[00:35:0641] [PE] Start AhoCorasick
[00:35:0656] [PE] Looking results : 0
[00:35:0656] [PE] Section[1/4] : 0x1ed4200
[00:35:0656] [PE] Init AhoCorasick
[00:35:0656] [PE] Start AhoCorasick
[00:35:0656] [PE] Looking results : 0
[00:35:0656] [PE] Section[2/4] : 0x1edac00
[00:35:0656] [PE] Init AhoCorasick
[00:35:0656] [PE] Start AhoCorasick
[00:35:0656] [PE] Looking results : 0
[00:35:0656] [PE] Section[3/4] : 0x1edb800
[00:35:0656] [PE] Init AhoCorasick
[00:35:0656] [PE] Start AhoCorasick
[00:35:0656] [PE] Looking results : 0
[00:35:0656] [PE] Section[4/4] : 0x1edbe00
[00:35:0656] [PE] Init AhoCorasick
[00:35:0656] [PE] Start AhoCorasick
[00:35:0656] [PE] Looking results : 0
[00:35:0656] [CHECK] Blacklist
[00:35:0656] [CHECK] BlacklistPath
[00:35:0656] [CHECK] BlacklistMD5
[00:35:0656] [CHECK] MadeNumbers
[00:35:0656] [CHECK] HasUnicode
[00:35:0656] [CHECK] SuspPath
[00:35:0656] [CHECK] ProcessResidue
[00:35:0656] [CHECK] Not found!
[00:35:0672] [Check DLLs] Secur32.dll : C:\WINDOWS\system32\Secur32.dll
[00:35:0672] [CHECK] WhiteDLL
[00:35:0672] [CHECK] Whitelist
[00:35:0672] [CHECK] WellKnown
[00:35:0672] [CHECK] WhitelistPath
[00:35:0672] [CHECK] HijackName
[00:35:0672] [CHECK] Signature
[00:35:0672] [PE] Mapping
[00:35:0672] [PE] Parsing
[00:35:0672] [PE] Dos header -> 0x1e50000
[00:35:0672] [PE] Nt header (offset : 0xe0) file size 0xde00
[00:35:0672] [PE] pNtHeadersx86 -> 0x1e500e0
[00:35:0672] [PE] Chars -> 0x210e
[00:35:0672] [PE] Optional header
[00:35:0672] [PE] Sections : 4
[00:35:0672] [PE] Section : 0 - .text
[00:35:0672] [PE] Section : 1 - .data
[00:35:0672] [PE] Section : 2 - .rsrc
[00:35:0672] [PE] Section : 3 - .reloc
[00:35:0672] [PE] File open : 1
[00:35:0672] [PE] Search sigs
[00:35:0672] [PE] Section[0/3] : 0x1e50400
[00:35:0672] [PE] Init AhoCorasick
[00:35:0672] [PE] Start AhoCorasick
[00:35:0672] [PE] Looking results : 0
[00:35:0672] [PE] Section[1/3] : 0x1e5c800
[00:35:0672] [PE] Init AhoCorasick
[00:35:0672] [PE] Start AhoCorasick
[00:35:0672] [PE] Looking results : 0
[00:35:0672] [PE] Section[2/3] : 0x1e5ce00
[00:35:0672] [PE] Init AhoCorasick
[00:35:0672] [PE] Start AhoCorasick
[00:35:0672] [PE] Looking results : 0
[00:35:0672] [PE] Section[3/3] : 0x1e5d400
[00:35:0672] [PE] Init AhoCorasick
[00:35:0672] [PE] Start AhoCorasick
[00:35:0672] [PE] Looking results : 0
[00:35:0672] [CHECK] Blacklist
[00:35:0672] [CHECK] BlacklistPath
[00:35:0688] [CHECK] BlacklistMD5
[00:35:0688] [CHECK] MadeNumbers
[00:35:0688] [CHECK] HasUnicode
[00:35:0688] [CHECK] SuspPath
[00:35:0688] [CHECK] ProcessResidue
[00:35:0688] [CHECK] Not found!
[00:35:0688] [Check DLLs] BROWSEUI.dll : C:\WINDOWS\system32\BROWSEUI.dll
[00:35:0688] [CHECK] WhiteDLL
[00:35:0688] [CHECK] Whitelist
[00:35:0688] [CHECK] WellKnown
[00:35:0688] [CHECK] WhitelistPath
[00:35:0688] [CHECK] HijackName
[00:35:0688] [CHECK] Signature
[00:35:0719] [PE] Mapping
[00:35:0719] [PE] Parsing
[00:35:0719] [PE] Dos header -> 0x1e50000
[00:35:0719] [PE] Nt header (offset : 0xf0) file size 0xfa400
[00:35:0719] [PE] pNtHeadersx86 -> 0x1e500f0
[00:35:0719] [PE] Chars -> 0x210e
[00:35:0719] [PE] Optional header
[00:35:0719] [PE] Sections : 4
[00:35:0719] [PE] Section : 0 - .text
[00:35:0719] [PE] Section : 1 - .data
[00:35:0719] [PE] Section : 2 - .rsrc
[00:35:0719] [PE] Section : 3 - .reloc
[00:35:0719] [PE] File open : 1
[00:35:0719] [PE] Search sigs
[00:35:0719] [PE] Section[0/3] : 0x1e50400
[00:35:0719] [PE] Init AhoCorasick
[00:35:0719] [PE] Start AhoCorasick
[00:35:0734] [PE] Looking results : 0
[00:35:0734] [PE] Section[1/3] : 0x1ed6200
[00:35:0734] [PE] Init AhoCorasick
[00:35:0734] [PE] Start AhoCorasick
[00:35:0734] [PE] Looking results : 0
[00:35:0734] [PE] Section[2/3] : 0x1ed7000
[00:35:0734] [PE] Init AhoCorasick
[00:35:0734] [PE] Start AhoCorasick
[00:35:0734] [PE] Looking results : 0
[00:35:0734] [PE] Section[3/3] : 0x1f42a00
[00:35:0734] [PE] Init AhoCorasick
[00:35:0750] [PE] Start AhoCorasick
[00:35:0750] [PE] Looking results : 0
[00:35:0750] [CHECK] Blacklist
[00:35:0750] [CHECK] BlacklistPath
[00:35:0750] [CHECK] BlacklistMD5
[00:35:0750] [CHECK] MadeNumbers
[00:35:0750] [CHECK] HasUnicode
[00:35:0750] [CHECK] SuspPath
[00:35:0750] [CHECK] ProcessResidue
[00:35:0750] [CHECK] Not found!
[00:35:0750] [Check DLLs] GDI32.dll : C:\WINDOWS\system32\GDI32.dll
[00:35:0750] [CHECK] WhiteDLL
[00:35:0750] [CHECK] Whitelist
[00:35:0750] [CHECK] WellKnown
[00:35:0750] [CHECK] WhitelistPath
[00:35:0750] [CHECK] HijackName
[00:35:0750] [CHECK] Signature
[00:35:0766] [PE] Mapping
[00:35:0766] [PE] Parsing
[00:35:0766] [PE] Dos header -> 0x1e50000
[00:35:0766] [PE] Nt header (offset : 0xe0) file size 0x46000
[00:35:0766] [PE] pNtHeadersx86 -> 0x1e500e0
[00:35:0766] [PE] Chars -> 0x210e
[00:35:0766] [PE] Optional header
[00:35:0766] [PE] Sections : 4
[00:35:0766] [PE] Section : 0 - .text
[00:35:0766] [PE] Section : 1 - .data
[00:35:0766] [PE] Section : 2 - .rsrc
[00:35:0766] [PE] Section : 3 - .reloc
[00:35:0766] [PE] File open : 1
[00:35:0766] [PE] Search sigs
[00:35:0766] [PE] Section[0/3] : 0x1e50400
[00:35:0766] [PE] Init AhoCorasick
[00:35:0766] [PE] Start AhoCorasick
[00:35:0766] [PE] Looking results : 0
[00:35:0766] [PE] Section[1/3] : 0x1e93000
[00:35:0766] [PE] Init AhoCorasick
[00:35:0766] [PE] Start AhoCorasick
[00:35:0766] [PE] Looking results : 0
[00:35:0766] [PE] Section[2/3] : 0x1e94200
[00:35:0766] [PE] Init AhoCorasick
[00:35:0766] [PE] Start AhoCorasick
[00:35:0766] [PE] Looking results : 0
[00:35:0766] [PE] Section[3/3] : 0x1e94600
[00:35:0781] [PE] Init AhoCorasick
[00:35:0781] [PE] Start AhoCorasick
[00:35:0781] [PE] Looking results : 0
[00:35:0781] [CHECK] Blacklist
[00:35:0781] [CHECK] BlacklistPath
[00:35:0781] [CHECK] BlacklistMD5
[00:35:0781] [CHECK] MadeNumbers
[00:35:0781] [CHECK] HasUnicode
[00:35:0781] [CHECK] SuspPath
[00:35:0781] [CHECK] ProcessResidue
[00:35:0781] [CHECK] Not found!
[00:35:0781] [Check DLLs] USER32.dll : C:\WINDOWS\system32\USER32.dll
[00:35:0781] [CHECK] WhiteDLL
[00:35:0781] [Check DLLs] msvcrt.dll : C:\WINDOWS\system32\msvcrt.dll
[00:35:0781] [CHECK] WhiteDLL
[00:35:0781] [CHECK] Whitelist
[00:35:0781] [CHECK] WellKnown
[00:35:0781] [CHECK] WhitelistPath
[00:35:0781] [CHECK] HijackName
[00:35:0781] [CHECK] Signature
[00:35:0797] [PE] Mapping
[00:35:0797] [PE] Parsing
[00:35:0797] [PE] Dos header -> 0x1e50000
[00:35:0797] [PE] Nt header (offset : 0xe8) file size 0x53c00
[00:35:0797] [PE] pNtHeadersx86 -> 0x1e500e8
[00:35:0797] [PE] Chars -> 0x210e
[00:35:0797] [PE] Optional header
[00:35:0797] [PE] Sections : 4
[00:35:0797] [PE] Section : 0 - .text
[00:35:0797] [PE] Section : 1 - .data
[00:35:0797] [PE] Section : 2 - .rsrc
[00:35:0797] [PE] Section : 3 - .reloc
[00:35:0797] [PE] File open : 1
[00:35:0797] [PE] Search sigs
[00:35:0797] [PE] Section[0/3] : 0x1e50400
[00:35:0797] [PE] Init AhoCorasick
[00:35:0797] [PE] Start AhoCorasick
[00:35:0797] [PE] Looking results : 0
[00:35:0797] [PE] Section[1/3] : 0x1e9c200
[00:35:0797] [PE] Init AhoCorasick
[00:35:0797] [PE] Start AhoCorasick
[00:35:0797] [PE] Looking results : 0
[00:35:0797] [PE] Section[2/3] : 0x1ea0a00
[00:35:0797] [PE] Init AhoCorasick
[00:35:0797] [PE] Start AhoCorasick
[00:35:0797] [PE] Looking results : 0
[00:35:0797] [PE] Section[3/3] : 0x1ea0e00
[00:35:0797] [PE] Init AhoCorasick
[00:35:0797] [PE] Start AhoCorasick
[00:35:0797] [PE] Looking results : 0
[00:35:0797] [CHECK] Blacklist
[00:35:0797] [CHECK] BlacklistPath
[00:35:0797] [CHECK] BlacklistMD5
[00:35:0797] [CHECK] MadeNumbers
[00:35:0797] [CHECK] HasUnicode
[00:35:0797] [CHECK] SuspPath
[00:35:0813] [CHECK] ProcessResidue
[00:35:0813] [CHECK] Not found!
[00:35:0813] [Check DLLs] ole32.dll : C:\WINDOWS\system32\ole32.dll
[00:35:0813] [CHECK] WhiteDLL
[00:35:0813] [CHECK] Whitelist
[00:35:0813] [CHECK] WellKnown
[00:35:0813] [CHECK] WhitelistPath
[00:35:0813] [CHECK] HijackName
[00:35:0813] [CHECK] Signature
[00:35:0844] [PE] Mapping
[00:35:0844] [PE] Parsing
[00:35:0844] [PE] Dos header -> 0x2350000
[00:35:0844] [PE] Nt header (offset : 0xe8) file size 0x13a800
[00:35:0844] [PE] pNtHeadersx86 -> 0x23500e8
[00:35:0844] [PE] Chars -> 0x210e
[00:35:0859] [PE] Optional header
[00:35:0859] [PE] Sections : 5
[00:35:0859] [PE] Section : 0 - .text
[00:35:0859] [PE] Section : 1 - .orpc
[00:35:0859] [PE] Section : 2 - .data
[00:35:0859] [PE] Section : 3 - .rsrc
[00:35:0859] [PE] Section : 4 - .reloc
[00:35:0859] [PE] File open : 1
[00:35:0859] [PE] Search sigs
[00:35:0859] [PE] Section[0/4] : 0x2350400
[00:35:0859] [PE] Init AhoCorasick
[00:35:0859] [PE] Start AhoCorasick
[00:35:0875] [PE] Looking results : 0
[00:35:0875] [PE] Section[1/4] : 0x246f600
[00:35:0875] [PE] Init AhoCorasick
[00:35:0875] [PE] Start AhoCorasick
[00:35:0875] [PE] Looking results : 0
[00:35:0875] [PE] Section[2/4] : 0x2475600
[00:35:0875] [PE] Init AhoCorasick
[00:35:0875] [PE] Start AhoCorasick
[00:35:0875] [PE] Looking results : 0
[00:35:0875] [PE] Section[3/4] : 0x247bc00
[00:35:0875] [PE] Init AhoCorasick
[00:35:0875] [PE] Start AhoCorasick
[00:35:0875] [PE] Looking results : 0
[00:35:0891] [PE] Section[4/4] : 0x247d600
[00:35:0891] [PE] Init AhoCorasick
[00:35:0891] [PE] Start AhoCorasick
[00:35:0891] [PE] Looking results : 0
[00:35:0891] [CHECK] Blacklist
[00:35:0891] [CHECK] BlacklistPath
[00:35:0891] [CHECK] BlacklistMD5
[00:35:0891] [CHECK] MadeNumbers
[00:35:0891] [CHECK] HasUnicode
[00:35:0891] [CHECK] SuspPath
[00:35:0891] [CHECK] ProcessResidue
[00:35:0891] [CHECK] Not found!
[00:35:0891] [Check DLLs] SHLWAPI.dll : C:\WINDOWS\system32\SHLWAPI.dll
[00:35:0891] [CHECK] WhiteDLL
[00:35:0891] [CHECK] Whitelist
[00:35:0891] [CHECK] WellKnown
[00:35:0891] [CHECK] WhitelistPath
[00:35:0891] [CHECK] HijackName
[00:35:0891] [CHECK] Signature
[00:35:0906] [PE] Mapping
[00:35:0906] [PE] Parsing
[00:35:0906] [PE] Dos header -> 0x1e50000
[00:35:0906] [PE] Nt header (offset : 0xf8) file size 0x73c00
[00:35:0906] [PE] pNtHeadersx86 -> 0x1e500f8
[00:35:0906] [PE] Chars -> 0x210e
[00:35:0906] [PE] Optional header
[00:35:0906] [PE] Sections : 4
[00:35:0906] [PE] Section : 0 - .text
[00:35:0906] [PE] Section : 1 - .data
[00:35:0906] [PE] Section : 2 - .rsrc
[00:35:0906] [PE] Section : 3 - .reloc
[00:35:0906] [PE] File open : 1
[00:35:0906] [PE] Search sigs
[00:35:0906] [PE] Section[0/3] : 0x1e50400
[00:35:0906] [PE] Init AhoCorasick
[00:35:0906] [PE] Start AhoCorasick
[00:35:0922] [PE] Looking results : 0
[00:35:0922] [PE] Section[1/3] : 0x1ebc000
[00:35:0922] [PE] Init AhoCorasick
[00:35:0922] [PE] Start AhoCorasick
[00:35:0922] [PE] Looking results : 0
[00:35:0922] [PE] Section[2/3] : 0x1ebcc00
[00:35:0922] [PE] Init AhoCorasick
[00:35:0922] [PE] Start AhoCorasick
[00:35:0922] [PE] Looking results : 0
[00:35:0922] [PE] Section[3/3] : 0x1ebe200
[00:35:0922] [PE] Init AhoCorasick
[00:35:0922] [PE] Start AhoCorasick
[00:35:0922] [PE] Looking results : 0
[00:35:0922] [CHECK] Blacklist
[00:35:0922] [CHECK] BlacklistPath
[00:35:0922] [CHECK] BlacklistMD5
[00:35:0922] [CHECK] MadeNumbers
[00:35:0922] [CHECK] HasUnicode
[00:35:0922] [CHECK] SuspPath
[00:35:0922] [CHECK] ProcessResidue
[00:35:0922] [CHECK] Not found!
[00:35:0922] [Check DLLs] OLEAUT32.dll : C:\WINDOWS\system32\OLEAUT32.dll
[00:35:0922] [CHECK] WhiteDLL
[00:35:0922] [CHECK] Whitelist
[00:35:0922] [CHECK] WellKnown
[00:35:0922] [CHECK] WhitelistPath
[00:35:0922] [CHECK] HijackName
[00:35:0922] [CHECK] Signature
[00:36:0000] [PE] Mapping
[00:36:0000] [PE] Parsing
[00:36:0000] [PE] Dos header -> 0x1e50000
[00:36:0000] [PE] Nt header (offset : 0xe8) file size 0x86c00
[00:36:0000] [PE] pNtHeadersx86 -> 0x1e500e8
[00:36:0000] [PE] Chars -> 0x210e
[00:36:0000] [PE] Optional header
[00:36:0000] [PE] Sections : 5
[00:36:0000] [PE] Section : 0 - .text
[00:36:0000] [PE] Section : 1 - .orpc
[00:36:0000] [PE] Section : 2 - .data
[00:36:0000] [PE] Section : 3 - .rsrc
[00:36:0000] [PE] Section : 4 - .reloc
[00:36:0000] [PE] File open : 1
[00:36:0000] [PE] Search sigs
[00:36:0000] [PE] Section[0/4] : 0x1e50400
[00:36:0000] [PE] Init AhoCorasick
[00:36:0000] [PE] Start AhoCorasick
[00:36:0016] [PE] Looking results : 0
[00:36:0016] [PE] Section[1/4] : 0x1ecee00
[00:36:0016] [PE] Init AhoCorasick
[00:36:0016] [PE] Start AhoCorasick
[00:36:0016] [PE] Looking results : 0
[00:36:0016] [PE] Section[2/4] : 0x1ecf200
[00:36:0016] [PE] Init AhoCorasick
[00:36:0016] [PE] Start AhoCorasick
[00:36:0016] [PE] Looking results : 0
[00:36:0016] [PE] Section[3/4] : 0x1ed1200
[00:36:0016] [PE] Init AhoCorasick
[00:36:0016] [PE] Start AhoCorasick
[00:36:0016] [PE] Looking results : 0
[00:36:0016] [PE] Section[4/4] : 0x1ed1600
[00:36:0016] [PE] Init AhoCorasick
[00:36:0016] [PE] Start AhoCorasick
[00:36:0016] [PE] Looking results : 0
[00:36:0016] [CHECK] Blacklist
[00:36:0016] [CHECK] BlacklistPath
[00:36:0016] [CHECK] BlacklistMD5
[00:36:0016] [CHECK] MadeNumbers
[00:36:0016] [CHECK] HasUnicode
[00:36:0016] [CHECK] SuspPath
[00:36:0016] [CHECK] ProcessResidue
[00:36:0016] [CHECK] Not found!
[00:36:0016] [Check DLLs] SHDOCVW.dll : C:\WINDOWS\system32\SHDOCVW.dll
[00:36:0016] [CHECK] WhiteDLL
[00:36:0016] [CHECK] Whitelist
[00:36:0016] [CHECK] WellKnown
[00:36:0016] [CHECK] WhitelistPath
[00:36:0016] [CHECK] HijackName
[00:36:0016] [CHECK] Signature
[00:36:0094] [PE] Mapping
[00:36:0094] [PE] Parsing
[00:36:0094] [PE] Dos header -> 0x2350000
[00:36:0094] [PE] Nt header (offset : 0xf0) file size 0x16e000
[00:36:0094] [PE] pNtHeadersx86 -> 0x23500f0
[00:36:0094] [PE] Chars -> 0x210e
[00:36:0094] [PE] Optional header
[00:36:0094] [PE] Sections : 4
[00:36:0094] [PE] Section : 0 - .text
[00:36:0094] [PE] Section : 1 - .data
[00:36:0094] [PE] Section : 2 - .rsrc
[00:36:0094] [PE] Section : 3 - .reloc
[00:36:0094] [PE] File open : 1
[00:36:0094] [PE] Search sigs
[00:36:0094] [PE] Section[0/3] : 0x2350400
[00:36:0094] [PE] Init AhoCorasick
[00:36:0094] [PE] Start AhoCorasick
[00:36:0125] [PE] Looking results : 0
[00:36:0125] [PE] Section[1/3] : 0x2428a00
[00:36:0125] [PE] Init AhoCorasick
[00:36:0125] [PE] Start AhoCorasick
[00:36:0125] [PE] Looking results : 0
[00:36:0125] [PE] Section[2/3] : 0x242a200
[00:36:0125] [PE] Init AhoCorasick
[00:36:0125] [PE] Start AhoCorasick
[00:36:0125] [PE] Looking results : 0
[00:36:0125] [PE] Section[3/3] : 0x24b2e00
[00:36:0125] [PE] Init AhoCorasick
[00:36:0125] [PE] Start AhoCorasick
[00:36:0125] [PE] Looking results : 0
[00:36:0125] [CHECK] Blacklist
[00:36:0141] [CHECK] BlacklistPath
[00:36:0141] [CHECK] BlacklistMD5
[00:36:0141] [CHECK] MadeNumbers
[00:36:0141] [CHECK] HasUnicode
[00:36:0141] [CHECK] SuspPath
[00:36:0141] [CHECK] ProcessResidue
[00:36:0141] [CHECK] Not found!
[00:36:0141] [Check DLLs] CRYPT32.dll : C:\WINDOWS\system32\CRYPT32.dll
[00:36:0141] [CHECK] WhiteDLL
[00:36:0141] [CHECK] Whitelist
[00:36:0141] [CHECK] WellKnown
[00:36:0141] [CHECK] WhitelistPath
[00:36:0141] [CHECK] HijackName
[00:36:0141] [CHECK] Signature
[00:36:0188] [PE] Mapping
[00:36:0188] [PE] Parsing
[00:36:0188] [PE] Dos header -> 0x1e50000
[00:36:0188] [PE] Nt header (offset : 0xf0) file size 0x92400
[00:36:0188] [PE] pNtHeadersx86 -> 0x1e500f0
[00:36:0188] [PE] Chars -> 0x210e
[00:36:0188] [PE] Optional header
[00:36:0188] [PE] Sections : 4
[00:36:0188] [PE] Section : 0 - .text
[00:36:0188] [PE] Section : 1 - .data
[00:36:0188] [PE] Section : 2 - .rsrc
[00:36:0188] [PE] Section : 3 - .reloc
[00:36:0188] [PE] File open : 1
[00:36:0188] [PE] Search sigs
[00:36:0188] [PE] Section[0/3] : 0x1e50400
[00:36:0188] [PE] Init AhoCorasick
[00:36:0188] [PE] Start AhoCorasick
[00:36:0188] [PE] Looking results : 0
[00:36:0203] [PE] Section[1/3] : 0x1ed4800
[00:36:0203] [PE] Init AhoCorasick
[00:36:0203] [PE] Start AhoCorasick
[00:36:0203] [PE] Looking results : 0
[00:36:0203] [PE] Section[2/3] : 0x1ed6c00
[00:36:0203] [PE] Init AhoCorasick
[00:36:0203] [PE] Start AhoCorasick
[00:36:0203] [PE] Looking results : 0
[00:36:0203] [PE] Section[3/3] : 0x1edd400
[00:36:0203] [PE] Init AhoCorasick
[00:36:0203] [PE] Start AhoCorasick
[00:36:0203] [PE] Looking results : 0
[00:36:0203] [CHECK] Blacklist
[00:36:0203] [CHECK] BlacklistPath
[00:36:0203] [CHECK] BlacklistMD5
[00:36:0203] [CHECK] MadeNumbers
[00:36:0203] [CHECK] HasUnicode
[00:36:0203] [CHECK] SuspPath
[00:36:0203] [CHECK] ProcessResidue
[00:36:0203] [CHECK] Not found!
[00:36:0203] [Check DLLs] MSASN1.dll : C:\WINDOWS\system32\MSASN1.dll
[00:36:0203] [CHECK] WhiteDLL
[00:36:0203] [CHECK] Whitelist
[00:36:0203] [CHECK] WellKnown
[00:36:0203] [CHECK] WhitelistPath
[00:36:0203] [CHECK] HijackName
[00:36:0203] [CHECK] Signature
[00:36:0203] [PE] Mapping
[00:36:0203] [PE] Parsing
[00:36:0203] [PE] Dos header -> 0x1e50000
[00:36:0203] [PE] Nt header (offset : 0xd8) file size 0xe600
[00:36:0203] [PE] pNtHeadersx86 -> 0x1e500d8
[00:36:0203] [PE] Chars -> 0x210e
[00:36:0203] [PE] Optional header
[00:36:0203] [PE] Sections : 4
[00:36:0203] [PE] Section : 0 - .text
[00:36:0203] [PE] Section : 1 - .data
[00:36:0203] [PE] Section : 2 - .rsrc
[00:36:0203] [PE] Section : 3 - .reloc
[00:36:0203] [PE] File open : 1
[00:36:0203] [PE] Search sigs
[00:36:0203] [PE] Section[0/3] : 0x1e50400
[00:36:0203] [PE] Init AhoCorasick
[00:36:0203] [PE] Start AhoCorasick
[00:36:0203] [PE] Looking results : 0
[00:36:0203] [PE] Section[1/3] : 0x1e5dc00
[00:36:0219] [PE] Init AhoCorasick
[00:36:0219] [PE] Start AhoCorasick
[00:36:0219] [PE] Looking results : 0
[00:36:0219] [PE] Section[2/3] : 0x1e5de00
[00:36:0219] [PE] Init AhoCorasick
[00:36:0219] [PE] Start AhoCorasick
[00:36:0219] [PE] Looking results : 0
[00:36:0219] [PE] Section[3/3] : 0x1e5e200
[00:36:0219] [PE] Init AhoCorasick
[00:36:0219] [PE] Start AhoCorasick
[00:36:0219] [PE] Looking results : 0
[00:36:0219] [CHECK] Blacklist
[00:36:0219] [CHECK] BlacklistPath
[00:36:0219] [CHECK] BlacklistMD5
[00:36:0219] [CHECK] MadeNumbers
[00:36:0219] [CHECK] HasUnicode
[00:36:0219] [CHECK] SuspPath
[00:36:0219] [CHECK] ProcessResidue
[00:36:0219] [CHECK] Not found!
[00:36:0219] [Check DLLs] CRYPTUI.dll : C:\WINDOWS\system32\CRYPTUI.dll
[00:36:0219] [CHECK] WhiteDLL
[00:36:0219] [CHECK] Whitelist
[00:36:0219] [CHECK] WellKnown
[00:36:0219] [CHECK] WhitelistPath
[00:36:0219] [CHECK] HijackName
[00:36:0219] [CHECK] Signature
[00:36:0266] [PE] Mapping
[00:36:0266] [PE] Parsing
[00:36:0266] [PE] Dos header -> 0x1e50000
[00:36:0266] [PE] Nt header (offset : 0xe8) file size 0x7d200
[00:36:0266] [PE] pNtHeadersx86 -> 0x1e500e8
[00:36:0266] [PE] Chars -> 0x210e
[00:36:0266] [PE] Optional header
[00:36:0266] [PE] Sections : 4
[00:36:0266] [PE] Section : 0 - .text
[00:36:0266] [PE] Section : 1 - .data
[00:36:0266] [PE] Section : 2 - .rsrc
[00:36:0266] [PE] Section : 3 - .reloc
[00:36:0266] [PE] File open : 1
[00:36:0266] [PE] Search sigs
[00:36:0266] [PE] Section[0/3] : 0x1e50400
[00:36:0266] [PE] Init AhoCorasick
[00:36:0266] [PE] Start AhoCorasick
[00:36:0266] [PE] Looking results : 0
[00:36:0281] [PE] Section[1/3] : 0x1e97800
[00:36:0281] [PE] Init AhoCorasick
[00:36:0281] [PE] Start AhoCorasick
[00:36:0281] [PE] Looking results : 0
[00:36:0281] [PE] Section[2/3] : 0x1e97c00
[00:36:0281] [PE] Init AhoCorasick
[00:36:0281] [PE] Start AhoCorasick
[00:36:0281] [PE] Looking results : 0
[00:36:0281] [PE] Section[3/3] : 0x1eca600
[00:36:0281] [PE] Init AhoCorasick
[00:36:0281] [PE] Start AhoCorasick
[00:36:0281] [PE] Looking results : 0
[00:36:0281] [CHECK] Blacklist
[00:36:0281] [CHECK] BlacklistPath
[00:36:0281] [CHECK] BlacklistMD5
[00:36:0281] [CHECK] MadeNumbers
[00:36:0281] [CHECK] HasUnicode
[00:36:0281] [CHECK] SuspPath
[00:36:0281] [CHECK] ProcessResidue
[00:36:0281] [CHECK] Not found!
[00:36:0281] [Check DLLs] NETAPI32.dll : C:\WINDOWS\system32\NETAPI32.dll
[00:36:0281] [CHECK] WhiteDLL
[00:36:0281] [CHECK] Whitelist
[00:36:0281] [CHECK] WellKnown
[00:36:0281] [CHECK] WhitelistPath
[00:36:0281] [CHECK] HijackName
[00:36:0281] [CHECK] Signature
[00:36:0328] [PE] Mapping
[00:36:0328] [PE] Parsing
[00:36:0328] [PE] Dos header -> 0x1e50000
[00:36:0328] [PE] Nt header (offset : 0xe0) file size 0x52600
[00:36:0328] [PE] pNtHeadersx86 -> 0x1e500e0
[00:36:0328] [PE] Chars -> 0x210e
[00:36:0328] [PE] Optional header
[00:36:0328] [PE] Sections : 4
[00:36:0328] [PE] Section : 0 - .text
[00:36:0328] [PE] Section : 1 - .data
[00:36:0328] [PE] Section : 2 - .rsrc
[00:36:0328] [PE] Section : 3 - .reloc
[00:36:0328] [PE] File open : 1
[00:36:0328] [PE] Search sigs
[00:36:0328] [PE] Section[0/3] : 0x1e50400
[00:36:0328] [PE] Init AhoCorasick
[00:36:0328] [PE] Start AhoCorasick
[00:36:0344] [PE] Looking results : 0
[00:36:0344] [PE] Section[1/3] : 0x1e9d000
[00:36:0344] [PE] Init AhoCorasick
[00:36:0344] [PE] Start AhoCorasick
[00:36:0344] [PE] Looking results : 0
[00:36:0344] [PE] Section[2/3] : 0x1e9f800
[00:36:0344] [PE] Init AhoCorasick
[00:36:0344] [PE] Start AhoCorasick
[00:36:0344] [PE] Looking results : 0
[00:36:0344] [PE] Section[3/3] : 0x1e9fc00
[00:36:0344] [PE] Init AhoCorasick
[00:36:0344] [PE] Start AhoCorasick
[00:36:0344] [PE] Looking results : 0
[00:36:0344] [CHECK] Blacklist
[00:36:0344] [CHECK] BlacklistPath
[00:36:0344] [CHECK] BlacklistMD5
[00:36:0344] [CHECK] MadeNumbers
[00:36:0344] [CHECK] HasUnicode
[00:36:0344] [CHECK] SuspPath
[00:36:0344] [CHECK] ProcessResidue
[00:36:0344] [CHECK] Not found!
[00:36:0344] [Check DLLs] VERSION.dll : C:\WINDOWS\system32\VERSION.dll
[00:36:0344] [CHECK] WhiteDLL
[00:36:0344] [CHECK] Whitelist
[00:36:0344] [CHECK] WellKnown
[00:36:0344] [CHECK] WhitelistPath
[00:36:0344] [CHECK] HijackName
[00:36:0344] [CHECK] Signature
[00:36:0359] [PE] Mapping
[00:36:0359] [PE] Parsing
[00:36:0359] [PE] Dos header -> 0x1e50000
[00:36:0359] [PE] Nt header (offset : 0xd8) file size 0x4a00
[00:36:0359] [PE] pNtHeadersx86 -> 0x1e500d8
[00:36:0359] [PE] Chars -> 0x210e
[00:36:0359] [PE] Optional header
[00:36:0359] [PE] Sections : 4
[00:36:0359] [PE] Section : 0 - .text
[00:36:0359] [PE] Section : 1 - .data
[00:36:0359] [PE] Section : 2 - .rsrc
[00:36:0359] [PE] Section : 3 - .reloc
[00:36:0359] [PE] File open : 1
[00:36:0359] [PE] Search sigs
[00:36:0359] [PE] Section[0/3] : 0x1e50400
[00:36:0359] [PE] Init AhoCorasick
[00:36:0359] [PE] Start AhoCorasick
[00:36:0359] [PE] Looking results : 0
[00:36:0359] [PE] Section[1/3] : 0x1e53e00
[00:36:0359] [PE] Init AhoCorasick
[00:36:0359] [PE] Start AhoCorasick
[00:36:0359] [PE] Looking results : 0
[00:36:0359] [PE] Section[2/3] : 0x1e54000
[00:36:0359] [PE] Init AhoCorasick
[00:36:0359] [PE] Start AhoCorasick
[00:36:0359] [PE] Looking results : 0
[00:36:0359] [PE] Section[3/3] : 0x1e54600
[00:36:0359] [PE] Init AhoCorasick
[00:36:0359] [PE] Start AhoCorasick
[00:36:0359] [PE] Looking results : 0
[00:36:0359] [CHECK] Blacklist
[00:36:0359] [CHECK] BlacklistPath
[00:36:0359] [CHECK] BlacklistMD5
[00:36:0359] [CHECK] MadeNumbers
[00:36:0359] [CHECK] HasUnicode
[00:36:0359] [CHECK] SuspPath
[00:36:0359] [CHECK] ProcessResidue
[00:36:0359] [CHECK] Not found!
[00:36:0359] [Check DLLs] WININET.dll : C:\WINDOWS\system32\WININET.dll
[00:36:0359] [CHECK] WhiteDLL
[00:36:0359] [CHECK] Whitelist
[00:36:0359] [CHECK] WellKnown
[00:36:0359] [CHECK] WhitelistPath
[00:36:0359] [CHECK] HijackName
[00:36:0359] [CHECK] Signature
[00:36:0391] [PE] Mapping
[00:36:0391] [PE] Parsing
[00:36:0391] [PE] Dos header -> 0x1e50000
[00:36:0391] [PE] Nt header (offset : 0xf8) file size 0xdfc00
[00:36:0391] [PE] pNtHeadersx86 -> 0x1e500f8
[00:36:0391] [PE] Chars -> 0x2102
[00:36:0391] [PE] Optional header
[00:36:0391] [PE] Sections : 4
[00:36:0391] [PE] Section : 0 - .text
[00:36:0391] [PE] Section : 1 - .data
[00:36:0391] [PE] Section : 2 - .rsrc
[00:36:0391] [PE] Section : 3 - .reloc
[00:36:0391] [PE] File open : 1
[00:36:0391] [PE] Search sigs
[00:36:0391] [PE] Section[0/3] : 0x1e50400
[00:36:0391] [PE] Init AhoCorasick
[00:36:0391] [PE] Start AhoCorasick
[00:36:0406] [PE] Looking results : 0
[00:36:0406] [PE] Section[1/3] : 0x1effe00
[00:36:0406] [PE] Init AhoCorasick
[00:36:0406] [PE] Start AhoCorasick
[00:36:0406] [PE] Looking results : 0
[00:36:0406] [PE] Section[2/3] : 0x1f03200
[00:36:0406] [PE] Init AhoCorasick
[00:36:0406] [PE] Start AhoCorasick
[00:36:0422] [PE] Looking results : 0
[00:36:0422] [PE] Section[3/3] : 0x1f29400
[00:36:0422] [PE] Init AhoCorasick
[00:36:0422] [PE] Start AhoCorasick
[00:36:0422] [PE] Looking results : 0
[00:36:0422] [CHECK] Blacklist
[00:36:0422] [CHECK] BlacklistPath
[00:36:0422] [CHECK] BlacklistMD5
[00:36:0422] [CHECK] MadeNumbers
[00:36:0422] [CHECK] HasUnicode
[00:36:0422] [CHECK] SuspPath
[00:36:0422] [CHECK] ProcessResidue
[00:36:0422] [CHECK] Not found!
[00:36:0422] [Check DLLs] Normaliz.dll : C:\WINDOWS\system32\Normaliz.dll
[00:36:0422] [CHECK] WhiteDLL
[00:36:0422] [CHECK] Whitelist
[00:36:0422] [CHECK] WellKnown
[00:36:0422] [CHECK] WhitelistPath
[00:36:0422] [CHECK] HijackName
[00:36:0422] [CHECK] Signature
[00:36:0422] [PE] Mapping
[00:36:0422] [PE] Parsing
[00:36:0422] [PE] Dos header -> 0x1e50000
[00:36:0422] [PE] Nt header (offset : 0xe8) file size 0x5c00
[00:36:0422] [PE] pNtHeadersx86 -> 0x1e500e8
[00:36:0422] [PE] Chars -> 0x2102
[00:36:0422] [PE] Optional header
[00:36:0422] [PE] Sections : 4
[00:36:0422] [PE] Section : 0 - .text
[00:36:0422] [PE] Section : 1 - .data
[00:36:0422] [PE] Section : 2 - .rsrc
[00:36:0422] [PE] Section : 3 - .reloc
[00:36:0422] [PE] File open : 1
[00:36:0422] [PE] Search sigs
[00:36:0422] [PE] Section[0/3] : 0x1e50400
[00:36:0422] [PE] Init AhoCorasick
[00:36:0422] [PE] Start AhoCorasick
[00:36:0422] [PE] Looking results : 0
[00:36:0422] [PE] Section[1/3] : 0x1e54e00
[00:36:0422] [PE] Init AhoCorasick
[00:36:0422] [PE] Start AhoCorasick
[00:36:0422] [PE] Looking results : 0
[00:36:0422] [PE] Section[2/3] : 0x1e55200
[00:36:0422] [PE] Init AhoCorasick
[00:36:0422] [PE] Start AhoCorasick
[00:36:0422] [PE] Looking results : 0
[00:36:0422] [PE] Section[3/3] : 0x1e55600
[00:36:0422] [PE] Init AhoCorasick
[00:36:0422] [PE] Start AhoCorasick
[00:36:0422] [PE] Looking results : 0
[00:36:0422] [CHECK] Blacklist
[00:36:0422] [CHECK] BlacklistPath
[00:36:0422] [CHECK] BlacklistMD5
[00:36:0422] [CHECK] MadeNumbers
[00:36:0422] [CHECK] HasUnicode
[00:36:0438] [CHECK] SuspPath
[00:36:0438] [CHECK] ProcessResidue
[00:36:0438] [CHECK] Not found!
[00:36:0438] [Check DLLs] urlmon.dll : C:\WINDOWS\system32\urlmon.dll
[00:36:0438] [CHECK] WhiteDLL
[00:36:0438] [CHECK] Whitelist
[00:36:0438] [CHECK] WellKnown
[00:36:0438] [CHECK] WhitelistPath
[00:36:0438] [CHECK] HijackName
[00:36:0438] [CHECK] Signature
[00:36:0484] [PE] Mapping
[00:36:0484] [PE] Parsing
[00:36:0484] [PE] Dos header -> 0x2350000
[00:36:0484] [PE] Nt header (offset : 0xe8) file size 0x127a00
[00:36:0484] [PE] pNtHeadersx86 -> 0x23500e8
[00:36:0484] [PE] Chars -> 0x2102
[00:36:0484] [PE] Optional header
[00:36:0484] [PE] Sections : 5
[00:36:0484] [PE] Section : 0 - .text
[00:36:0484] [PE] Section : 1 - .orpc
[00:36:0484] [PE] Section : 2 - .data
[00:36:0484] [PE] Section : 3 - .rsrc
[00:36:0484] [PE] Section : 4 - .reloc
[00:36:0484] [PE] File open : 1
[00:36:0484] [PE] Search sigs
[00:36:0484] [PE] Section[0/4] : 0x2350400
[00:36:0484] [PE] Init AhoCorasick
[00:36:0484] [PE] Start AhoCorasick
[00:36:0500] [PE] Looking results : 0
[00:36:0500] [PE] Section[1/4] : 0x2416800
[00:36:0500] [PE] Init AhoCorasick
[00:36:0500] [PE] Start AhoCorasick
[00:36:0500] [PE] Looking results : 0
[00:36:0500] [PE] Section[2/4] : 0x2417a00
[00:36:0500] [PE] Init AhoCorasick
[00:36:0500] [PE] Start AhoCorasick
[00:36:0500] [PE] Looking results : 0
[00:36:0500] [PE] Section[3/4] : 0x241b600
[00:36:0500] [PE] Init AhoCorasick
[00:36:0500] [PE] Start AhoCorasick
[00:36:0516] [PE] Looking results : 0
[00:36:0516] [PE] Section[4/4] : 0x2470200
[00:36:0516] [PE] Init AhoCorasick
[00:36:0516] [PE] Start AhoCorasick
[00:36:0516] [PE] Looking results : 0
[00:36:0516] [CHECK] Blacklist
[00:36:0516] [CHECK] BlacklistPath
[00:36:0516] [CHECK] BlacklistMD5
[00:36:0516] [CHECK] MadeNumbers
[00:36:0516] [CHECK] HasUnicode
[00:36:0516] [CHECK] SuspPath
[00:36:0516] [CHECK] ProcessResidue
[00:36:0516] [CHECK] Not found!
[00:36:0516] [Check DLLs] iertutil.dll : C:\WINDOWS\system32\iertutil.dll
[00:36:0516] [CHECK] WhiteDLL
[00:36:0516] [CHECK] Whitelist
[00:36:0516] [CHECK] WellKnown
[00:36:0516] [CHECK] WhitelistPath
[00:36:0516] [CHECK] HijackName
[00:36:0516] [CHECK] Signature
[00:36:0578] [PE] Mapping
[00:36:0578] [PE] Parsing
[00:36:0578] [PE] Dos header -> 0x2350000
[00:36:0578] [PE] Nt header (offset : 0xe8) file size 0x1e6400
[00:36:0578] [PE] pNtHeadersx86 -> 0x23500e8
[00:36:0578] [PE] Chars -> 0x2102
[00:36:0578] [PE] Optional header
[00:36:0578] [PE] Sections : 4
[00:36:0578] [PE] Section : 0 - .text
[00:36:0578] [PE] Section : 1 - .data
[00:36:0578] [PE] Section : 2 - .rsrc
[00:36:0578] [PE] Section : 3 - .reloc
[00:36:0578] [PE] File open : 1
[00:36:0578] [PE] Search sigs
[00:36:0578] [PE] Section[0/3] : 0x2350400
[00:36:0578] [PE] Init AhoCorasick
[00:36:0578] [PE] Start AhoCorasick
[00:36:0609] [PE] Looking results : 0
[00:36:0609] [PE] Section[1/3] : 0x251ae00
[00:36:0609] [PE] Init AhoCorasick
[00:36:0609] [PE] Start AhoCorasick
[00:36:0609] [PE] Looking results : 0
[00:36:0609] [PE] Section[2/3] : 0x251f000
[00:36:0609] [PE] Init AhoCorasick
[00:36:0609] [PE] Start AhoCorasick
[00:36:0609] [PE] Looking results : 0
[00:36:0609] [PE] Section[3/3] : 0x251f600
[00:36:0609] [PE] Init AhoCorasick
[00:36:0625] [PE] Start AhoCorasick
[00:36:0625] [PE] Looking results : 0
[00:36:0625] [CHECK] Blacklist
[00:36:0625] [CHECK] BlacklistPath
[00:36:0625] [CHECK] BlacklistMD5
[00:36:0625] [CHECK] MadeNumbers
[00:36:0625] [CHECK] HasUnicode
[00:36:0625] [CHECK] SuspPath
[00:36:0625] [CHECK] ProcessResidue
[00:36:0625] [CHECK] Not found!
[00:36:0625] [Check DLLs] WINTRUST.dll : C:\WINDOWS\system32\WINTRUST.dll
[00:36:0625] [CHECK] WhiteDLL
[00:36:0625] [CHECK] Whitelist
[00:36:0625] [CHECK] WellKnown
[00:36:0625] [CHECK] WhitelistPath
[00:36:0625] [CHECK] HijackName
[00:36:0625] [CHECK] Signature
[00:36:0750] [PE] Mapping
[00:36:0750] [PE] Parsing
[00:36:0750] [PE] Dos header -> 0x1e50000
[00:36:0766] [PE] Nt header (offset : 0xf0) file size 0x2b600
[00:36:0766] [PE] pNtHeadersx86 -> 0x1e500f0
[00:36:0766] [PE] Chars -> 0x210e
[00:36:0766] [PE] Optional header
[00:36:0766] [PE] Sections : 4
[00:36:0766] [PE] Section : 0 - .text
[00:36:0766] [PE] Section : 1 - .data
[00:36:0766] [PE] Section : 2 - .rsrc
[00:36:0766] [PE] Section : 3 - .reloc
[00:36:0766] [PE] File open : 1
[00:36:0766] [PE] Search sigs
[00:36:0766] [PE] Section[0/3] : 0x1e50400
[00:36:0766] [PE] Init AhoCorasick
[00:36:0766] [PE] Start AhoCorasick
[00:36:0766] [PE] Looking results : 0
[00:36:0766] [PE] Section[1/3] : 0x1e78c00
[00:36:0766] [PE] Init AhoCorasick
[00:36:0766] [PE] Start AhoCorasick
[00:36:0766] [PE] Looking results : 0
[00:36:0766] [PE] Section[2/3] : 0x1e79000
[00:36:0766] [PE] Init AhoCorasick
[00:36:0766] [PE] Start AhoCorasick
[00:36:0766] [PE] Looking results : 0
[00:36:0766] [PE] Section[3/3] : 0x1e7a000
[00:36:0766] [PE] Init AhoCorasick
[00:36:0766] [PE] Start AhoCorasick
[00:36:0766] [PE] Looking results : 0
[00:36:0766] [CHECK] Blacklist
[00:36:0766] [CHECK] BlacklistPath
[00:36:0766] [CHECK] BlacklistMD5
[00:36:0766] [CHECK] MadeNumbers
[00:36:0766] [CHECK] HasUnicode
[00:36:0766] [CHECK] SuspPath
[00:36:0766] [CHECK] ProcessResidue
[00:36:0766] [CHECK] Not found!
[00:36:0766] [Check DLLs] IMAGEHLP.dll : C:\WINDOWS\system32\IMAGEHLP.dll
[00:36:0766] [CHECK] WhiteDLL
[00:36:0766] [CHECK] Whitelist
[00:36:0766] [CHECK] WellKnown
[00:36:0766] [CHECK] WhitelistPath
[00:36:0766] [CHECK] HijackName
[00:36:0766] [CHECK] Signature
[00:36:0828] [PE] Mapping
[00:36:0828] [PE] Parsing
[00:36:0828] [PE] Dos header -> 0x1e50000
[00:36:0828] [PE] Nt header (offset : 0x108) file size 0x23400
[00:36:0828] [PE] pNtHeadersx86 -> 0x1e50108
[00:36:0828] [PE] Chars -> 0x210e
[00:36:0828] [PE] Optional header
[00:36:0828] [PE] Sections : 4
[00:36:0828] [PE] Section : 0 - .text
[00:36:0828] [PE] Section : 1 - .data
[00:36:0828] [PE] Section : 2 - .rsrc
[00:36:0828] [PE] Section : 3 - .reloc
[00:36:0828] [PE] File open : 1
[00:36:0828] [PE] Search sigs
[00:36:0828] [PE] Section[0/3] : 0x1e50400
[00:36:0828] [PE] Init AhoCorasick
[00:36:0828] [PE] Start AhoCorasick
[00:36:0828] [PE] Looking results : 0
[00:36:0828] [PE] Section[1/3] : 0x1e71600
[00:36:0844] [PE] Init AhoCorasick
[00:36:0844] [PE] Start AhoCorasick
[00:36:0844] [PE] Looking results : 0
[00:36:0844] [PE] Section[2/3] : 0x1e71e00
[00:36:0844] [PE] Init AhoCorasick
[00:36:0844] [PE] Start AhoCorasick
[00:36:0844] [PE] Looking results : 0
[00:36:0844] [PE] Section[3/3] : 0x1e72200
[00:36:0844] [PE] Init AhoCorasick
[00:36:0844] [PE] Start AhoCorasick
[00:36:0844] [PE] Looking results : 0
[00:36:0844] [CHECK] Blacklist
[00:36:0844] [CHECK] BlacklistPath
[00:36:0844] [CHECK] BlacklistMD5
[00:36:0844] [CHECK] MadeNumbers
[00:36:0844] [CHECK] HasUnicode
[00:36:0844] [CHECK] SuspPath
[00:36:0844] [CHECK] ProcessResidue
[00:36:0844] [CHECK] Not found!
[00:36:0844] [Check DLLs] WLDAP32.dll : C:\WINDOWS\system32\WLDAP32.dll
[00:36:0844] [CHECK] WhiteDLL
[00:36:0844] [CHECK] Whitelist
[00:36:0844] [CHECK] WellKnown
[00:36:0844] [CHECK] WhitelistPath
[00:36:0844] [CHECK] HijackName
[00:36:0844] [CHECK] Signature
[00:36:0859] [PE] Mapping
[00:36:0859] [PE] Parsing
[00:36:0859] [PE] Dos header -> 0x1e50000
[00:36:0859] [PE] Nt header (offset : 0xf0) file size 0x2a000
[00:36:0859] [PE] pNtHeadersx86 -> 0x1e500f0
[00:36:0859] [PE] Chars -> 0x210e
[00:36:0859] [PE] Optional header
[00:36:0859] [PE] Sections : 4
[00:36:0859] [PE] Section : 0 - .text
[00:36:0859] [PE] Section : 1 - .data
[00:36:0859] [PE] Section : 2 - .rsrc
[00:36:0859] [PE] Section : 3 - .reloc
[00:36:0859] [PE] File open : 1
[00:36:0859] [PE] Search sigs
[00:36:0859] [PE] Section[0/3] : 0x1e50400
[00:36:0859] [PE] Init AhoCorasick
[00:36:0859] [PE] Start AhoCorasick
[00:36:0859] [PE] Looking results : 0
[00:36:0859] [PE] Section[1/3] : 0x1e70400
[00:36:0859] [PE] Init AhoCorasick
[00:36:0859] [PE] Start AhoCorasick
[00:36:0859] [PE] Looking results : 0
[00:36:0859] [PE] Section[2/3] : 0x1e77c00
[00:36:0859] [PE] Init AhoCorasick
[00:36:0859] [PE] Start AhoCorasick
[00:36:0859] [PE] Looking results : 0
[00:36:0859] [PE] Section[3/3] : 0x1e78c00
[00:36:0859] [PE] Init AhoCorasick
[00:36:0859] [PE] Start AhoCorasick
[00:36:0859] [PE] Looking results : 0
[00:36:0859] [CHECK] Blacklist
[00:36:0859] [CHECK] BlacklistPath
[00:36:0859] [CHECK] BlacklistMD5
[00:36:0859] [CHECK] MadeNumbers
[00:36:0859] [CHECK] HasUnicode
[00:36:0859] [CHECK] SuspPath
[00:36:0859] [CHECK] ProcessResidue
[00:36:0859] [CHECK] Not found!
[00:36:0859] [Check DLLs] SHELL32.dll : C:\WINDOWS\system32\SHELL32.dll
[00:36:0859] [CHECK] WhiteDLL
[00:36:0859] [CHECK] Whitelist
[00:36:0859] [CHECK] WellKnown
[00:36:0859] [CHECK] WhitelistPath
[00:36:0859] [CHECK] HijackName
[00:36:0859] [CHECK] Signature
[00:37:0063] [CHECK] Blacklist
[00:37:0063] [CHECK] BlacklistPath
[00:37:0063] [CHECK] BlacklistMD5
[00:37:0063] [CHECK] MadeNumbers
[00:37:0063] [CHECK] HasUnicode
[00:37:0063] [CHECK] SuspPath
[00:37:0063] [CHECK] ProcessResidue
[00:37:0063] [CHECK] Not found!
[00:37:0063] [Check DLLs] UxTheme.dll : C:\WINDOWS\system32\UxTheme.dll
[00:37:0063] [CHECK] WhiteDLL
[00:37:0063] [CHECK] Whitelist
[00:37:0063] [CHECK] WellKnown
[00:37:0063] [CHECK] WhitelistPath
[00:37:0063] [CHECK] HijackName
[00:37:0063] [CHECK] Signature
[00:37:0078] [PE] Mapping
[00:37:0078] [PE] Parsing
[00:37:0094] [PE] Dos header -> 0x1e50000
[00:37:0094] [PE] Nt header (offset : 0xe8) file size 0x35600
[00:37:0094] [PE] pNtHeadersx86 -> 0x1e500e8
[00:37:0094] [PE] Chars -> 0x210e
[00:37:0094] [PE] Optional header
[00:37:0094] [PE] Sections : 4
[00:37:0094] [PE] Section : 0 - .text
[00:37:0094] [PE] Section : 1 - .data
[00:37:0094] [PE] Section : 2 - .rsrc
[00:37:0094] [PE] Section : 3 - .reloc
[00:37:0094] [PE] File open : 1
[00:37:0094] [PE] Search sigs
[00:37:0094] [PE] Section[0/3] : 0x1e50400
[00:37:0094] [PE] Init AhoCorasick
[00:37:0094] [PE] Start AhoCorasick
[00:37:0094] [PE] Looking results : 0
[00:37:0094] [PE] Section[1/3] : 0x1e7f600
[00:37:0094] [PE] Init AhoCorasick
[00:37:0094] [PE] Start AhoCorasick
[00:37:0094] [PE] Looking results : 0
[00:37:0094] [PE] Section[2/3] : 0x1e80600
[00:37:0094] [PE] Init AhoCorasick
[00:37:0094] [PE] Start AhoCorasick
[00:37:0094] [PE] Looking results : 0
[00:37:0094] [PE] Section[3/3] : 0x1e83c00
[00:37:0094] [PE] Init AhoCorasick
[00:37:0094] [PE] Start AhoCorasick
[00:37:0094] [PE] Looking results : 0
[00:37:0094] [CHECK] Blacklist
[00:37:0094] [CHECK] BlacklistPath
[00:37:0094] [CHECK] BlacklistMD5
[00:37:0094] [CHECK] MadeNumbers
[00:37:0094] [CHECK] HasUnicode
[00:37:0094] [CHECK] SuspPath
[00:37:0094] [CHECK] ProcessResidue
[00:37:0094] [CHECK] Not found!
[00:37:0094] [Check DLLs] ShimEng.dll : C:\WINDOWS\system32\ShimEng.dll
[00:37:0094] [CHECK] WhiteDLL
[00:37:0094] [CHECK] Whitelist
[00:37:0094] [CHECK] WellKnown
[00:37:0094] [CHECK] WhitelistPath
[00:37:0094] [CHECK] HijackName
[00:37:0094] [CHECK] Signature
[00:37:0109] [PE] Mapping
[00:37:0109] [PE] Parsing
[00:37:0109] [PE] Dos header -> 0x1e50000
[00:37:0109] [PE] Nt header (offset : 0xe8) file size 0xfe00
[00:37:0109] [PE] pNtHeadersx86 -> 0x1e500e8
[00:37:0109] [PE] Chars -> 0x210e
[00:37:0109] [PE] Optional header
[00:37:0109] [PE] Sections : 4
[00:37:0109] [PE] Section : 0 - .text
[00:37:0109] [PE] Section : 1 - .data
[00:37:0109] [PE] Section : 2 - .rsrc
[00:37:0109] [PE] Section : 3 - .reloc
[00:37:0109] [PE] File open : 1
[00:37:0109] [PE] Search sigs
[00:37:0109] [PE] Section[0/3] : 0x1e50400
[00:37:0109] [PE] Init AhoCorasick
[00:37:0109] [PE] Start AhoCorasick
[00:37:0125] [PE] Looking results : 0
[00:37:0125] [PE] Section[1/3] : 0x1e5de00
[00:37:0125] [PE] Init AhoCorasick
[00:37:0125] [PE] Start AhoCorasick
[00:37:0125] [PE] Looking results : 0
[00:37:0125] [PE] Section[2/3] : 0x1e5e400
[00:37:0125] [PE] Init AhoCorasick
[00:37:0125] [PE] Start AhoCorasick
[00:37:0125] [PE] Looking results : 0
[00:37:0125] [PE] Section[3/3] : 0x1e5e800
[00:37:0125] [PE] Init AhoCorasick
[00:37:0125] [PE] Start AhoCorasick
[00:37:0125] [PE] Looking results : 0
[00:37:0125] [CHECK] Blacklist
[00:37:0125] [CHECK] BlacklistPath
[00:37:0125] [CHECK] BlacklistMD5
[00:37:0125] [CHECK] MadeNumbers
[00:37:0125] [CHECK] HasUnicode
[00:37:0125] [CHECK] SuspPath
[00:37:0125] [CHECK] ProcessResidue
[00:37:0125] [CHECK] Not found!
[00:37:0125] [Check DLLs] AcGenral.DLL : C:\WINDOWS\AppPatch\AcGenral.DLL
[00:37:0125] [CHECK] WhiteDLL
[00:37:0125] [CHECK] Whitelist
[00:37:0125] [CHECK] WellKnown
[00:37:0125] [CHECK] WhitelistPath
[00:37:0125] [CHECK] HijackName
[00:37:0125] [CHECK] Signature
[00:37:0188] [PE] Mapping
[00:37:0188] [PE] Parsing
[00:37:0188] [PE] Dos header -> 0x2350000
[00:37:0188] [PE] Nt header (offset : 0xe8) file size 0x1c4600
[00:37:0188] [PE] pNtHeadersx86 -> 0x23500e8
[00:37:0188] [PE] Chars -> 0x210e
[00:37:0188] [PE] Optional header
[00:37:0188] [PE] Sections : 4
[00:37:0188] [PE] Section : 0 - .text
[00:37:0188] [PE] Section : 1 - .data
[00:37:0188] [PE] Section : 2 - .rsrc
[00:37:0188] [PE] Section : 3 - .reloc
[00:37:0188] [PE] File open : 1
[00:37:0188] [PE] Search sigs
[00:37:0188] [PE] Section[0/3] : 0x2350400
[00:37:0188] [PE] Init AhoCorasick
[00:37:0188] [PE] Start AhoCorasick
[00:37:0203] [PE] Looking results : 0
[00:37:0203] [PE] Section[1/3] : 0x2382400
[00:37:0203] [PE] Init AhoCorasick
[00:37:0203] [PE] Start AhoCorasick
[00:37:0203] [PE] Looking results : 0
[00:37:0203] [PE] Section[2/3] : 0x2388000
[00:37:0203] [PE] Init AhoCorasick
[00:37:0203] [PE] Start AhoCorasick
[00:37:0219] [PE] Looking results : 0
[00:37:0219] [PE] Section[3/3] : 0x250f200
[00:37:0219] [PE] Init AhoCorasick
[00:37:0219] [PE] Start AhoCorasick
[00:37:0219] [PE] Looking results : 0
[00:37:0234] [CHECK] Blacklist
[00:37:0234] [CHECK] BlacklistPath
[00:37:0234] [CHECK] BlacklistMD5
[00:37:0234] [CHECK] MadeNumbers
[00:37:0234] [CHECK] HasUnicode
[00:37:0234] [CHECK] SuspPath
[00:37:0234] [CHECK] ProcessResidue
[00:37:0234] [CHECK] Not found!
[00:37:0234] [Check DLLs] WINMM.dll : C:\WINDOWS\system32\WINMM.dll
[00:37:0234] [CHECK] WhiteDLL
[00:37:0234] [CHECK] Whitelist
[00:37:0234] [CHECK] WellKnown
[00:37:0234] [CHECK] WhitelistPath
[00:37:0234] [CHECK] HijackName
[00:37:0234] [CHECK] Signature
[00:37:0234] [PE] Mapping
[00:37:0234] [PE] Parsing
[00:37:0234] [PE] Dos header -> 0x1e50000
[00:37:0234] [PE] Nt header (offset : 0xf0) file size 0x2b000
[00:37:0234] [PE] pNtHeadersx86 -> 0x1e500f0
[00:37:0234] [PE] Chars -> 0x210e
[00:37:0234] [PE] Optional header
[00:37:0234] [PE] Sections : 4
[00:37:0234] [PE] Section : 0 - .text
[00:37:0234] [PE] Section : 1 - .data
[00:37:0234] [PE] Section : 2 - .rsrc
[00:37:0234] [PE] Section : 3 - .reloc
[00:37:0234] [PE] File open : 1
[00:37:0234] [PE] Search sigs
[00:37:0234] [PE] Section[0/3] : 0x1e50400
[00:37:0234] [PE] Init AhoCorasick
[00:37:0234] [PE] Start AhoCorasick
[00:37:0250] [PE] Looking results : 0
[00:37:0250] [PE] Section[1/3] : 0x1e6f200
[00:37:0250] [PE] Init AhoCorasick
[00:37:0250] [PE] Start AhoCorasick
[00:37:0250] [PE] Looking results : 0
[00:37:0250] [PE] Section[2/3] : 0x1e70600
[00:37:0250] [PE] Init AhoCorasick
[00:37:0250] [PE] Start AhoCorasick
[00:37:0250] [PE] Looking results : 0
[00:37:0250] [PE] Section[3/3] : 0x1e79600
[00:37:0250] [PE] Init AhoCorasick
[00:37:0250] [PE] Start AhoCorasick
[00:37:0250] [PE] Looking results : 0
[00:37:0250] [CHECK] Blacklist
[00:37:0250] [CHECK] BlacklistPath
[00:37:0250] [CHECK] BlacklistMD5
[00:37:0250] [CHECK] MadeNumbers
[00:37:0250] [CHECK] HasUnicode
[00:37:0250] [CHECK] SuspPath
[00:37:0250] [CHECK] ProcessResidue
[00:37:0250] [CHECK] Not found!
[00:37:0250] [Check DLLs] MSACM32.dll : C:\WINDOWS\system32\MSACM32.dll
[00:37:0250] [CHECK] WhiteDLL
[00:37:0250] [CHECK] Whitelist
[00:37:0250] [CHECK] WellKnown
[00:37:0250] [CHECK] WhitelistPath
[00:37:0250] [CHECK] HijackName
[00:37:0250] [CHECK] Signature
[00:37:0250] [PE] Mapping
[00:37:0250] [PE] Parsing
[00:37:0250] [PE] Dos header -> 0x1e50000
[00:37:0250] [PE] Nt header (offset : 0xe8) file size 0x11800
[00:37:0250] [PE] pNtHeadersx86 -> 0x1e500e8
[00:37:0250] [PE] Chars -> 0x210e
[00:37:0250] [PE] Optional header
[00:37:0250] [PE] Sections : 4
[00:37:0250] [PE] Section : 0 - .text
[00:37:0250] [PE] Section : 1 - .data
[00:37:0250] [PE] Section : 2 - .rsrc
[00:37:0250] [PE] Section : 3 - .reloc
[00:37:0250] [PE] File open : 1
[00:37:0250] [PE] Search sigs
[00:37:0250] [PE] Section[0/3] : 0x1e50400
[00:37:0250] [PE] Init AhoCorasick
[00:37:0250] [PE] Start AhoCorasick
[00:37:0266] [PE] Looking results : 0
[00:37:0266] [PE] Section[1/3] : 0x1e5f800
[00:37:0266] [PE] Init AhoCorasick
[00:37:0266] [PE] Start AhoCorasick
[00:37:0266] [PE] Looking results : 0
[00:37:0266] [PE] Section[2/3] : 0x1e5fa00
[00:37:0266] [PE] Init AhoCorasick
[00:37:0266] [PE] Start AhoCorasick
[00:37:0266] [PE] Looking results : 0
[00:37:0266] [PE] Section[3/3] : 0x1e61000
[00:37:0266] [PE] Init AhoCorasick
[00:37:0266] [PE] Start AhoCorasick
[00:37:0266] [PE] Looking results : 0
[00:37:0266] [CHECK] Blacklist
[00:37:0266] [CHECK] BlacklistPath
[00:37:0266] [CHECK] BlacklistMD5
[00:37:0266] [CHECK] MadeNumbers
[00:37:0266] [CHECK] HasUnicode
[00:37:0266] [CHECK] SuspPath
[00:37:0266] [CHECK] ProcessResidue
[00:37:0266] [CHECK] Not found!
[00:37:0266] [Check DLLs] USERENV.dll : C:\WINDOWS\system32\USERENV.dll
[00:37:0266] [CHECK] WhiteDLL
[00:37:0266] [CHECK] Whitelist
[00:37:0266] [CHECK] WellKnown
[00:37:0266] [CHECK] WhitelistPath
[00:37:0266] [CHECK] HijackName
[00:37:0266] [CHECK] Signature
[00:37:0313] [PE] Mapping
[00:37:0313] [PE] Parsing
[00:37:0313] [PE] Dos header -> 0x1e50000
[00:37:0313] [PE] Nt header (offset : 0xf0) file size 0xb1800
[00:37:0313] [PE] pNtHeadersx86 -> 0x1e500f0
[00:37:0313] [PE] Chars -> 0x210e
[00:37:0313] [PE] Optional header
[00:37:0313] [PE] Sections : 4
[00:37:0313] [PE] Section : 0 - .text
[00:37:0313] [PE] Section : 1 - .data
[00:37:0313] [PE] Section : 2 - .rsrc
[00:37:0313] [PE] Section : 3 - .reloc
[00:37:0313] [PE] File open : 1
[00:37:0313] [PE] Search sigs
[00:37:0313] [PE] Section[0/3] : 0x1e50400
[00:37:0313] [PE] Init AhoCorasick
[00:37:0313] [PE] Start AhoCorasick
[00:37:0328] [PE] Looking results : 0
[00:37:0328] [PE] Section[1/3] : 0x1eefa00
[00:37:0328] [PE] Init AhoCorasick
[00:37:0328] [PE] Start AhoCorasick
[00:37:0328] [PE] Looking results : 0
[00:37:0328] [PE] Section[2/3] : 0x1ef1800
[00:37:0328] [PE] Init AhoCorasick
[00:37:0328] [PE] Start AhoCorasick
[00:37:0328] [PE] Looking results : 0
[00:37:0328] [PE] Section[3/3] : 0x1efb000
[00:37:0328] [PE] Init AhoCorasick
[00:37:0328] [PE] Start AhoCorasick
[00:37:0328] [PE] Looking results : 0
[00:37:0328] [CHECK] Blacklist
[00:37:0328] [CHECK] BlacklistPath
[00:37:0328] [CHECK] BlacklistMD5
[00:37:0328] [CHECK] MadeNumbers
[00:37:0328] [CHECK] HasUnicode
[00:37:0328] [CHECK] SuspPath
[00:37:0328] [CHECK] ProcessResidue
[00:37:0328] [CHECK] Not found!
[00:37:0328] [Check DLLs] IMM32.DLL : C:\WINDOWS\system32\IMM32.DLL
[00:37:0328] [CHECK] WhiteDLL
[00:37:0328] [CHECK] Whitelist
[00:37:0328] [CHECK] WellKnown
[00:37:0328] [CHECK] WhitelistPath
[00:37:0328] [CHECK] HijackName
[00:37:0328] [CHECK] Signature
[00:37:0484] [PE] Mapping
[00:37:0484] [PE] Parsing
[00:37:0484] [PE] Dos header -> 0x1e50000
[00:37:0484] [PE] Nt header (offset : 0xe8) file size 0x1ae00
[00:37:0484] [PE] pNtHeadersx86 -> 0x1e500e8
[00:37:0484] [PE] Chars -> 0x210e
[00:37:0484] [PE] Optional header
[00:37:0484] [PE] Sections : 4
[00:37:0484] [PE] Section : 0 - .text
[00:37:0484] [PE] Section : 1 - .data
[00:37:0484] [PE] Section : 2 - .rsrc
[00:37:0484] [PE] Section : 3 - .reloc
[00:37:0484] [PE] File open : 1
[00:37:0484] [PE] Search sigs
[00:37:0484] [PE] Section[0/3] : 0x1e50400
[00:37:0484] [PE] Init AhoCorasick
[00:37:0484] [PE] Start AhoCorasick
[00:37:0484] [PE] Looking results : 0
[00:37:0484] [PE] Section[1/3] : 0x1e65000
[00:37:0484] [PE] Init AhoCorasick
[00:37:0484] [PE] Start AhoCorasick
[00:37:0484] [PE] Looking results : 0
[00:37:0484] [PE] Section[2/3] : 0x1e65200
[00:37:0484] [PE] Init AhoCorasick
[00:37:0484] [PE] Start AhoCorasick
[00:37:0484] [PE] Looking results : 0
[00:37:0484] [PE] Section[3/3] : 0x1e6a000
[00:37:0484] [PE] Init AhoCorasick
[00:37:0484] [PE] Start AhoCorasick
[00:37:0484] [PE] Looking results : 0
[00:37:0484] [CHECK] Blacklist
[00:37:0484] [CHECK] BlacklistPath
[00:37:0484] [CHECK] BlacklistMD5
[00:37:0484] [CHECK] MadeNumbers
[00:37:0484] [CHECK] HasUnicode
[00:37:0484] [CHECK] SuspPath
[00:37:0484] [CHECK] ProcessResidue
[00:37:0484] [CHECK] Not found!
[00:37:0484] [Check DLLs] comctl32.dll : C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[00:37:0484] [CHECK] WhiteDLL
[00:37:0484] [CHECK] Whitelist
[00:37:0484] [CHECK] WellKnown
[00:37:0484] [CHECK] WhitelistPath
[00:37:0484] [CHECK] HijackName
[00:37:0484] [CHECK] Signature
[00:37:0563] [PE] Mapping
[00:37:0563] [PE] Parsing
[00:37:0563] [PE] Dos header -> 0x2350000
[00:37:0563] [PE] Nt header (offset : 0xf0) file size 0x101600
[00:37:0563] [PE] pNtHeadersx86 -> 0x23500f0
[00:37:0563] [PE] Chars -> 0x210e
[00:37:0563] [PE] Optional header
[00:37:0563] [PE] Sections : 4
[00:37:0563] [PE] Section : 0 - .text
[00:37:0563] [PE] Section : 1 - .data
[00:37:0563] [PE] Section : 2 - .rsrc
[00:37:0563] [PE] Section : 3 - .reloc
[00:37:0563] [PE] File open : 1
[00:37:0563] [PE] Search sigs
[00:37:0563] [PE] Section[0/3] : 0x2350400
[00:37:0563] [PE] Init AhoCorasick
[00:37:0563] [PE] Start AhoCorasick
[00:37:0594] [PE] Looking results : 0
[00:37:0594] [PE] Section[1/3] : 0x23e1000
[00:37:0594] [PE] Init AhoCorasick
[00:37:0594] [PE] Start AhoCorasick
[00:37:0594] [PE] Looking results : 0
[00:37:0594] [PE] Section[2/3] : 0x23e1600
[00:37:0594] [PE] Init AhoCorasick
[00:37:0594] [PE] Start AhoCorasick
[00:37:0594] [PE] Looking results : 0
[00:37:0594] [PE] Section[3/3] : 0x244b600
[00:37:0594] [PE] Init AhoCorasick
[00:37:0594] [PE] Start AhoCorasick
[00:37:0594] [PE] Looking results : 0
[00:37:0609] [CHECK] Blacklist
[00:37:0609] [CHECK] BlacklistPath
[00:37:0609] [CHECK] BlacklistMD5
[00:37:0609] [CHECK] MadeNumbers
[00:37:0609] [CHECK] HasUnicode
[00:37:0609] [CHECK] SuspPath
[00:37:0609] [CHECK] ProcessResidue
[00:37:0609] [CHECK] Not found!
[00:37:0609] [Check DLLs] comctl32.dll : C:\WINDOWS\system32\comctl32.dll
[00:37:0609] [CHECK] WhiteDLL
[00:37:0609] [CHECK] Whitelist
[00:37:0609] [CHECK] WellKnown
[00:37:0609] [CHECK] WhitelistPath
[00:37:0609] [CHECK] HijackName
[00:37:0609] [CHECK] Signature
[00:37:0656] [PE] Mapping
[00:37:0656] [PE] Parsing
[00:37:0656] [PE] Dos header -> 0x1e50000
[00:37:0656] [PE] Nt header (offset : 0xf0) file size 0x96c00
[00:37:0656] [PE] pNtHeadersx86 -> 0x1e500f0
[00:37:0656] [PE] Chars -> 0x210e
[00:37:0656] [PE] Optional header
[00:37:0656] [PE] Sections : 4
[00:37:0656] [PE] Section : 0 - .text
[00:37:0672] [PE] Section : 1 - .data
[00:37:0672] [PE] Section : 2 - .rsrc
[00:37:0672] [PE] Section : 3 - .reloc
[00:37:0672] [PE] File open : 1
[00:37:0672] [PE] Search sigs
[00:37:0672] [PE] Section[0/3] : 0x1e50400
[00:37:0672] [PE] Init AhoCorasick
[00:37:0672] [PE] Start AhoCorasick
[00:37:0688] [PE] Looking results : 0
[00:37:0688] [PE] Section[1/3] : 0x1ec1000
[00:37:0688] [PE] Init AhoCorasick
[00:37:0688] [PE] Start AhoCorasick
[00:37:0688] [PE] Looking results : 0
[00:37:0688] [PE] Section[2/3] : 0x1ec3600
[00:37:0688] [PE] Init AhoCorasick
[00:37:0688] [PE] Start AhoCorasick
[00:37:0688] [PE] Looking results : 0
[00:37:0688] [PE] Section[3/3] : 0x1ee2a00
[00:37:0688] [PE] Init AhoCorasick
[00:37:0688] [PE] Start AhoCorasick
[00:37:0688] [PE] Looking results : 0
[00:37:0688] [CHECK] Blacklist
[00:37:0688] [CHECK] BlacklistPath
[00:37:0688] [CHECK] BlacklistMD5
[00:37:0688] [CHECK] MadeNumbers
[00:37:0688] [CHECK] HasUnicode
[00:37:0688] [CHECK] SuspPath
[00:37:0688] [CHECK] ProcessResidue
[00:37:0688] [CHECK] Not found!
[00:37:0688] [Check DLLs] MSCTF.dll : C:\WINDOWS\system32\MSCTF.dll
[00:37:0688] [CHECK] WhiteDLL
[00:37:0688] [CHECK] Whitelist
[00:37:0688] [CHECK] WellKnown
[00:37:0688] [CHECK] WhitelistPath
[00:37:0688] [CHECK] HijackName
[00:37:0688] [CHECK] Signature
[00:37:0734] [PE] Mapping
[00:37:0734] [PE] Parsing
[00:37:0734] [PE] Dos header -> 0x1e50000
[00:37:0734] [PE] Nt header (offset : 0xe0) file size 0x48c00
[00:37:0734] [PE] pNtHeadersx86 -> 0x1e500e0
[00:37:0734] [PE] Chars -> 0x210e
[00:37:0734] [PE] Optional header
[00:37:0734] [PE] Sections : 4
[00:37:0734] [PE] Section : 0 - .text
[00:37:0734] [PE] Section : 1 - .data
[00:37:0734] [PE] Section : 2 - .rsrc
[00:37:0734] [PE] Section : 3 - .reloc
[00:37:0734] [PE] File open : 1
[00:37:0734] [PE] Search sigs
[00:37:0734] [PE] Section[0/3] : 0x1e50400
[00:37:0734] [PE] Init AhoCorasick
[00:37:0734] [PE] Start AhoCorasick
[00:37:0734] [PE] Looking results : 0
[00:37:0734] [PE] Section[1/3] : 0x1e91c00
[00:37:0734] [PE] Init AhoCorasick
[00:37:0750] [PE] Start AhoCorasick
[00:37:0750] [PE] Looking results : 0
[00:37:0750] [PE] Section[2/3] : 0x1e92800
[00:37:0750] [PE] Init AhoCorasick
[00:37:0750] [PE] Start AhoCorasick
[00:37:0750] [PE] Looking results : 0
[00:37:0750] [PE] Section[3/3] : 0x1e95e00
[00:37:0750] [PE] Init AhoCorasick
[00:37:0750] [PE] Start AhoCorasick
[00:37:0750] [PE] Looking results : 0
[00:37:0750] [CHECK] Blacklist
[00:37:0750] [CHECK] BlacklistPath
[00:37:0750] [CHECK] BlacklistMD5
[00:37:0750] [CHECK] MadeNumbers
[00:37:0750] [CHECK] HasUnicode
[00:37:0750] [CHECK] SuspPath
[00:37:0750] [CHECK] ProcessResidue
[00:37:0750] [CHECK] Not found!
[00:37:0750] [Check DLLs] msctfime.ime : C:\WINDOWS\system32\msctfime.ime
[00:37:0750] [CHECK] WhiteDLL
[00:37:0750] [CHECK] Whitelist
[00:37:0750] [CHECK] WellKnown
[00:37:0750] [CHECK] WhitelistPath
[00:37:0750] [CHECK] HijackName
[00:37:0750] [CHECK] Signature
[00:37:0766] [PE] Mapping
[00:37:0766] [PE] Parsing
[00:37:0766] [PE] Dos header -> 0x1e50000
[00:37:0766] [PE] Nt header (offset : 0xe8) file size 0x2b400
[00:37:0766] [PE] pNtHeadersx86 -> 0x1e500e8
[00:37:0766] [PE] Chars -> 0x210e
[00:37:0766] [PE] Optional header
[00:37:0766] [PE] Sections : 4
[00:37:0766] [PE] Section : 0 - .text
[00:37:0766] [PE] Section : 1 - .data
[00:37:0766] [PE] Section : 2 - .rsrc
[00:37:0766] [PE] Section : 3 - .reloc
[00:37:0766] [PE] File open : 1
[00:37:0766] [PE] Search sigs
[00:37:0766] [PE] Section[0/3] : 0x1e50400
[00:37:0766] [PE] Init AhoCorasick
[00:37:0766] [PE] Start AhoCorasick
[00:37:0766] [PE] Looking results : 0
[00:37:0766] [PE] Section[1/3] : 0x1e77000
[00:37:0766] [PE] Init AhoCorasick
[00:37:0766] [PE] Start AhoCorasick
[00:37:0766] [PE] Looking results : 0
[00:37:0766] [PE] Section[2/3] : 0x1e77200
[00:37:0766] [PE] Init AhoCorasick
[00:37:0766] [PE] Start AhoCorasick
[00:37:0766] [PE] Looking results : 0
[00:37:0766] [PE] Section[3/3] : 0x1e78800
[00:37:0766] [PE] Init AhoCorasick
[00:37:0766] [PE] Start AhoCorasick
[00:37:0766] [PE] Looking results : 0
[00:37:0766] [CHECK] Blacklist
[00:37:0766] [CHECK] BlacklistPath
[00:37:0766] [CHECK] BlacklistMD5
[00:37:0766] [CHECK] MadeNumbers
[00:37:0781] [CHECK] HasUnicode
[00:37:0781] [CHECK] SuspPath
[00:37:0781] [CHECK] ProcessResidue
[00:37:0781] [CHECK] Not found!
[00:37:0781] [Check DLLs] appHelp.dll : C:\WINDOWS\system32\appHelp.dll
[00:37:0781] [CHECK] WhiteDLL
[00:37:0781] [CHECK] Whitelist
[00:37:0781] [CHECK] WellKnown
[00:37:0781] [CHECK] WhitelistPath
[00:37:0781] [CHECK] HijackName
[00:37:0781] [CHECK] Signature
[00:37:0781] [PE] Mapping
[00:37:0781] [PE] Parsing
[00:37:0781] [PE] Dos header -> 0x1e50000
[00:37:0781] [PE] Nt header (offset : 0xe0) file size 0x1ec00
[00:37:0781] [PE] pNtHeadersx86 -> 0x1e500e0
[00:37:0781] [PE] Chars -> 0x210e
[00:37:0781] [PE] Optional header
[00:37:0781] [PE] Sections : 4
[00:37:0781] [PE] Section : 0 - .text
[00:37:0781] [PE] Section : 1 - .data
[00:37:0781] [PE] Section : 2 - .rsrc
[00:37:0781] [PE] Section : 3 - .reloc
[00:37:0781] [PE] File open : 1
[00:37:0781] [PE] Search sigs
[00:37:0781] [PE] Section[0/3] : 0x1e50400
[00:37:0781] [PE] Init AhoCorasick
[00:37:0781] [PE] Start AhoCorasick
[00:37:0781] [PE] Looking results : 0
[00:37:0781] [PE] Section[1/3] : 0x1e6ca00
[00:37:0781] [PE] Init AhoCorasick
[00:37:0781] [PE] Start AhoCorasick
[00:37:0781] [PE] Looking results : 0
[00:37:0781] [PE] Section[2/3] : 0x1e6d400
[00:37:0781] [PE] Init AhoCorasick
[00:37:0781] [PE] Start AhoCorasick
[00:37:0781] [PE] Looking results : 0
[00:37:0781] [PE] Section[3/3] : 0x1e6d800
[00:37:0781] [PE] Init AhoCorasick
[00:37:0781] [PE] Start AhoCorasick
[00:37:0781] [PE] Looking results : 0
[00:37:0781] [CHECK] Blacklist
[00:37:0797] [CHECK] BlacklistPath
[00:37:0797] [CHECK] BlacklistMD5
[00:37:0797] [CHECK] MadeNumbers
[00:37:0797] [CHECK] HasUnicode
[00:37:0797] [CHECK] SuspPath
[00:37:0797] [CHECK] ProcessResidue
[00:37:0797] [CHECK] Not found!
[00:37:0797] [Check DLLs] CLBCATQ.DLL : C:\WINDOWS\system32\CLBCATQ.DLL
[00:37:0797] [CHECK] WhiteDLL
[00:37:0797] [CHECK] Whitelist
[00:37:0797] [CHECK] WellKnown
[00:37:0797] [CHECK] WhitelistPath
[00:37:0797] [CHECK] HijackName
[00:37:0797] [CHECK] Signature
[00:37:0813] [PE] Mapping
[00:37:0813] [PE] Parsing
[00:37:0813] [PE] Dos header -> 0x1e50000
[00:37:0813] [PE] Nt header (offset : 0xe0) file size 0x79c00
[00:37:0813] [PE] pNtHeadersx86 -> 0x1e500e0
[00:37:0813] [PE] Chars -> 0x210e
[00:37:0813] [PE] Optional header
[00:37:0813] [PE] Sections : 4
[00:37:0813] [PE] Section : 0 - .text
[00:37:0813] [PE] Section : 1 - .data
[00:37:0813] [PE] Section : 2 - .rsrc
[00:37:0813] [PE] Section : 3 - .reloc
[00:37:0813] [PE] File open : 1
[00:37:0813] [PE] Search sigs
[00:37:0813] [PE] Section[0/3] : 0x1e50400
[00:37:0813] [PE] Init AhoCorasick
[00:37:0813] [PE] Start AhoCorasick
[00:37:0828] [PE] Looking results : 0
[00:37:0828] [PE] Section[1/3] : 0x1ec1a00
[00:37:0828] [PE] Init AhoCorasick
[00:37:0828] [PE] Start AhoCorasick
[00:37:0828] [PE] Looking results : 0
[00:37:0828] [PE] Section[2/3] : 0x1ec3800
[00:37:0828] [PE] Init AhoCorasick
[00:37:0828] [PE] Start AhoCorasick
[00:37:0828] [PE] Looking results : 0
[00:37:0828] [PE] Section[3/3] : 0x1ec5800
[00:37:0828] [PE] Init AhoCorasick
[00:37:0828] [PE] Start AhoCorasick
[00:37:0828] [PE] Looking results : 0
[00:37:0828] [CHECK] Blacklist
[00:37:0828] [CHECK] BlacklistPath
[00:37:0828] [CHECK] BlacklistMD5
[00:37:0828] [CHECK] MadeNumbers
[00:37:0828] [CHECK] HasUnicode
[00:37:0828] [CHECK] SuspPath
[00:37:0828] [CHECK] ProcessResidue
[00:37:0828] [CHECK] Not found!
[00:37:0828] [Check DLLs] COMRes.dll : C:\WINDOWS\system32\COMRes.dll
[00:37:0828] [CHECK] WhiteDLL
[00:37:0828] [CHECK] Whitelist
[00:37:0828] [CHECK] WellKnown
[00:37:0828] [CHECK] WhitelistPath
[00:37:0828] [CHECK] HijackName
[00:37:0844] [CHECK] Signature
[00:37:0859] [PE] Mapping
[00:37:0859] [PE] Parsing
[00:37:0859] [PE] Dos header -> 0x1e50000
[00:37:0859] [PE] Nt header (offset : 0xe0) file size 0xc1600
[00:37:0859] [PE] pNtHeadersx86 -> 0x1e500e0
[00:37:0859] [PE] Chars -> 0x210e
[00:37:0859] [PE] Optional header
[00:37:0859] [PE] Sections : 4
[00:37:0859] [PE] Section : 0 - .text
[00:37:0859] [PE] Section : 1 - .data
[00:37:0859] [PE] Section : 2 - .rsrc
[00:37:0859] [PE] Section : 3 - .reloc
[00:37:0859] [PE] File open : 1
[00:37:0875] [PE] Search sigs
[00:37:0875] [PE] Section[0/3] : 0x1e50400
[00:37:0875] [PE] Init AhoCorasick
[00:37:0875] [PE] Start AhoCorasick
[00:37:0875] [PE] Looking results : 0
[00:37:0875] [PE] Section[1/3] : 0x1e50000
[00:37:0875] [PE] Init AhoCorasick
[00:37:0875] [PE] Start AhoCorasick
[00:37:0875] [PE] Looking results : 0
[00:37:0875] [PE] Section[2/3] : 0x1e50600
[00:37:0875] [PE] Init AhoCorasick
[00:37:0875] [PE] Start AhoCorasick
[00:37:0875] [PE] Looking results : 0
[00:37:0875] [PE] Section[3/3] : 0x1f11400
[00:37:0891] [PE] Init AhoCorasick
[00:37:0891] [PE] Start AhoCorasick
[00:37:0891] [PE] Looking results : 0
[00:37:0891] [CHECK] Blacklist
[00:37:0891] [CHECK] BlacklistPath
[00:37:0891] [CHECK] BlacklistMD5
[00:37:0891] [CHECK] MadeNumbers
[00:37:0891] [CHECK] HasUnicode
[00:37:0891] [CHECK] SuspPath
[00:37:0891] [CHECK] ProcessResidue
[00:37:0891] [CHECK] Not found!
[00:37:0891] [Check DLLs] cscui.dll : C:\WINDOWS\System32\cscui.dll
[00:37:0891] [CHECK] WhiteDLL
[00:37:0891] [CHECK] Whitelist
[00:37:0891] [CHECK] WellKnown
[00:37:0891] [CHECK] WhitelistPath
[00:37:0891] [CHECK] HijackName
[00:37:0891] [CHECK] Signature
[00:37:0906] [PE] Mapping
[00:37:0906] [PE] Parsing
[00:37:0906] [PE] Dos header -> 0x1e50000
[00:37:0906] [PE] Nt header (offset : 0xe8) file size 0x4fc00
[00:37:0906] [PE] pNtHeadersx86 -> 0x1e500e8
[00:37:0906] [PE] Chars -> 0x210e
[00:37:0906] [PE] Optional header
[00:37:0906] [PE] Sections : 4
[00:37:0906] [PE] Section : 0 - .text
[00:37:0906] [PE] Section : 1 - .data
[00:37:0906] [PE] Section : 2 - .rsrc
[00:37:0906] [PE] Section : 3 - .reloc
[00:37:0906] [PE] File open : 1
[00:37:0906] [PE] Search sigs
[00:37:0906] [PE] Section[0/3] : 0x1e50400
[00:37:0906] [PE] Init AhoCorasick
[00:37:0906] [PE] Start AhoCorasick
[00:37:0922] [PE] Looking results : 0
[00:37:0922] [PE] Section[1/3] : 0x1e72c00
[00:37:0922] [PE] Init AhoCorasick
[00:37:0922] [PE] Start AhoCorasick
[00:37:0922] [PE] Looking results : 0
[00:37:0922] [PE] Section[2/3] : 0x1e73200
[00:37:0922] [PE] Init AhoCorasick
[00:37:0922] [PE] Start AhoCorasick
[00:37:0922] [PE] Looking results : 0
[00:37:0922] [PE] Section[3/3] : 0x1e9e400
[00:37:0922] [PE] Init AhoCorasick
[00:37:0922] [PE] Start AhoCorasick
[00:37:0922] [PE] Looking results : 0
[00:37:0922] [CHECK] Blacklist
[00:37:0922] [CHECK] BlacklistPath
[00:37:0922] [CHECK] BlacklistMD5
[00:37:0922] [CHECK] MadeNumbers
[00:37:0922] [CHECK] HasUnicode
[00:37:0922] [CHECK] SuspPath
[00:37:0922] [CHECK] ProcessResidue
[00:37:0922] [CHECK] Not found!
[00:37:0922] [Check DLLs] CSCDLL.dll : C:\WINDOWS\System32\CSCDLL.dll
[00:37:0922] [CHECK] WhiteDLL
[00:37:0922] [CHECK] Whitelist
[00:37:0922] [CHECK] WellKnown
[00:37:0922] [CHECK] WhitelistPath
[00:37:0922] [CHECK] HijackName
[00:37:0922] [CHECK] Signature
[00:37:0984] [PE] Mapping
[00:37:0984] [PE] Parsing
[00:37:0984] [PE] Dos header -> 0x1e50000
[00:37:0984] [PE] Nt header (offset : 0xe8) file size 0x18e00
[00:37:0984] [PE] pNtHeadersx86 -> 0x1e500e8
[00:37:0984] [PE] Chars -> 0x210e
[00:37:0984] [PE] Optional header
[00:37:0984] [PE] Sections : 5
[00:37:0984] [PE] Section : 0 - .text
[00:37:0984] [PE] Section : 1 - PAGE
[00:37:0984] [PE] Section : 2 - .data
[00:38:0000] [PE] Section : 3 - .rsrc
[00:38:0000] [PE] Section : 4 - .reloc
[00:38:0000] [PE] File open : 1
[00:38:0000] [PE] Search sigs
[00:38:0000] [PE] Section[0/4] : 0x1e50400
[00:38:0000] [PE] Init AhoCorasick
[00:38:0000] [PE] Start AhoCorasick
[00:38:0000] [PE] Looking results : 0
[00:38:0000] [PE] Section[1/4] : 0x1e5e600
[00:38:0000] [PE] Init AhoCorasick
[00:38:0000] [PE] Start AhoCorasick
[00:38:0000] [PE] Looking results : 0
[00:38:0000] [PE] Section[2/4] : 0x1e60c00
[00:38:0000] [PE] Init AhoCorasick
[00:38:0000] [PE] Start AhoCorasick
[00:38:0000] [PE] Looking results : 0
[00:38:0000] [PE] Section[3/4] : 0x1e62000
[00:38:0000] [PE] Init AhoCorasick
[00:38:0000] [PE] Start AhoCorasick
[00:38:0000] [PE] Looking results : 0
[00:38:0000] [PE] Section[4/4] : 0x1e68200
[00:38:0000] [PE] Init AhoCorasick
[00:38:0000] [PE] Start AhoCorasick
[00:38:0000] [PE] Looking results : 0
[00:38:0000] [CHECK] Blacklist
[00:38:0000] [CHECK] BlacklistPath
[00:38:0000] [CHECK] BlacklistMD5
[00:38:0000] [CHECK] MadeNumbers
[00:38:0000] [CHECK] HasUnicode
[00:38:0000] [CHECK] SuspPath
[00:38:0000] [CHECK] ProcessResidue
[00:38:0000] [CHECK] Not found!
[00:38:0000] [Check DLLs] themeui.dll : C:\WINDOWS\System32\themeui.dll
[00:38:0000] [CHECK] WhiteDLL
[00:38:0000] [CHECK] Whitelist
[00:38:0000] [CHECK] WellKnown
[00:38:0000] [CHECK] WhitelistPath
[00:38:0000] [CHECK] HijackName
[00:38:0000] [CHECK] Signature
[00:38:0078] [PE] Mapping
[00:38:0078] [PE] Parsing
[00:38:0078] [PE] Dos header -> 0x1e50000
[00:38:0078] [PE] Nt header (offset : 0xe0) file size 0x5e200
[00:38:0078] [PE] pNtHeadersx86 -> 0x1e500e0
[00:38:0078] [PE] Chars -> 0x210e
[00:38:0078] [PE] Optional header
[00:38:0078] [PE] Sections : 4
[00:38:0078] [PE] Section : 0 - .text
[00:38:0078] [PE] Section : 1 - .data
[00:38:0078] [PE] Section : 2 - .rsrc
[00:38:0078] [PE] Section : 3 - .reloc
[00:38:0078] [PE] File open : 1
[00:38:0078] [PE] Search sigs
[00:38:0078] [PE] Section[0/3] : 0x1e50400
[00:38:0094] [PE] Init AhoCorasick
[00:38:0094] [PE] Start AhoCorasick
[00:38:0094] [PE] Looking results : 0
[00:38:0094] [PE] Section[1/3] : 0x1e86a00
[00:38:0094] [PE] Init AhoCorasick
[00:38:0094] [PE] Start AhoCorasick
[00:38:0094] [PE] Looking results : 0
[00:38:0094] [PE] Section[2/3] : 0x1e87800
[00:38:0094] [PE] Init AhoCorasick
[00:38:0094] [PE] Start AhoCorasick
[00:38:0094] [PE] Looking results : 0
[00:38:0094] [PE] Section[3/3] : 0x1eaa600
[00:38:0094] [PE] Init AhoCorasick
[00:38:0094] [PE] Start AhoCorasick
[00:38:0094] [PE] Looking results : 0
[00:38:0094] [CHECK] Blacklist
[00:38:0094] [CHECK] BlacklistPath
[00:38:0094] [CHECK] BlacklistMD5
[00:38:0094] [CHECK] MadeNumbers
[00:38:0094] [CHECK] HasUnicode
[00:38:0094] [CHECK] SuspPath
[00:38:0094] [CHECK] ProcessResidue
[00:38:0094] [CHECK] Not found!
[00:38:0094] [Check DLLs] MSIMG32.dll : C:\WINDOWS\System32\MSIMG32.dll
[00:38:0094] [CHECK] WhiteDLL
[00:38:0094] [CHECK] Whitelist
[00:38:0094] [CHECK] WellKnown
[00:38:0094] [CHECK] WhitelistPath
[00:38:0094] [CHECK] HijackName
[00:38:0094] [CHECK] Signature
[00:38:0125] [PE] Mapping
[00:38:0141] [PE] Parsing
[00:38:0141] [PE] Dos header -> 0x1e50000
[00:38:0141] [PE] Nt header (offset : 0xe0) file size 0x1200
[00:38:0141] [PE] pNtHeadersx86 -> 0x1e500e0
[00:38:0141] [PE] Chars -> 0x210e
[00:38:0141] [PE] Optional header
[00:38:0141] [PE] Sections : 4
[00:38:0141] [PE] Section : 0 - .text
[00:38:0141] [PE] Section : 1 - .data
[00:38:0141] [PE] Section : 2 - .rsrc
[00:38:0141] [PE] Section : 3 - .reloc
[00:38:0141] [PE] File open : 1
[00:38:0141] [PE] Search sigs
[00:38:0141] [PE] Section[0/3] : 0x1e50400
[00:38:0141] [PE] Init AhoCorasick
[00:38:0141] [PE] Start AhoCorasick
[00:38:0141] [PE] Looking results : 0
[00:38:0141] [PE] Section[1/3] : 0x1e50a00
[00:38:0141] [PE] Init AhoCorasick
[00:38:0141] [PE] Start AhoCorasick
[00:38:0141] [PE] Looking results : 0
[00:38:0141] [PE] Section[2/3] : 0x1e50c00
[00:38:0141] [PE] Init AhoCorasick
[00:38:0141] [PE] Start AhoCorasick
[00:38:0141] [PE] Looking results : 0
[00:38:0141] [PE] Section[3/3] : 0x1e51000
[00:38:0141] [PE] Init AhoCorasick
[00:38:0141] [PE] Start AhoCorasick
[00:38:0141] [PE] Looking results : 0
[00:38:0141] [CHECK] Blacklist
[00:38:0141] [CHECK] BlacklistPath
[00:38:0141] [CHECK] BlacklistMD5
[00:38:0141] [CHECK] MadeNumbers
[00:38:0141] [CHECK] HasUnicode
[00:38:0141] [CHECK] SuspPath
[00:38:0141] [CHECK] ProcessResidue
[00:38:0141] [CHECK] Not found!
[00:38:0141] [Check DLLs] xpsp2res.dll : C:\WINDOWS\system32\xpsp2res.dll
[00:38:0141] [CHECK] WhiteDLL
[00:38:0141] [CHECK] Whitelist
[00:38:0141] [CHECK] WellKnown
[00:38:0141] [CHECK] WhitelistPath
[00:38:0141] [CHECK] HijackName
[00:38:0141] [CHECK] Signature
[00:38:0266] [PE] Mapping
[00:38:0266] [PE] Parsing
[00:38:0266] [PE] Dos header -> 0x2350000
[00:38:0266] [PE] Nt header (offset : 0xc0) file size 0x2c3800
[00:38:0266] [PE] pNtHeadersx86 -> 0x23500c0
[00:38:0266] [PE] Chars -> 0x210e
[00:38:0281] [PE] Optional header
[00:38:0281] [PE] Sections : 1
[00:38:0281] [PE] Section : 0 - .rsrc
[00:38:0281] [PE] File open : 1
[00:38:0281] [PE] Search sigs
[00:38:0281] [PE] Section[0/0] : 0x2350200
[00:38:0281] [PE] Init AhoCorasick
[00:38:0281] [PE] Start AhoCorasick
[00:38:0328] [PE] Looking results : 0
[00:38:0328] [CHECK] Blacklist
[00:38:0328] [CHECK] BlacklistPath
[00:38:0328] [CHECK] BlacklistMD5
[00:38:0328] [CHECK] MadeNumbers
[00:38:0328] [CHECK] HasUnicode
[00:38:0328] [CHECK] SuspPath
[00:38:0328] [CHECK] ProcessResidue
[00:38:0328] [CHECK] Not found!
[00:38:0328] [Check DLLs] actxprxy.dll : C:\WINDOWS\system32\actxprxy.dll
[00:38:0328] [CHECK] WhiteDLL
[00:38:0328] [CHECK] Whitelist
[00:38:0328] [CHECK] WellKnown
[00:38:0328] [CHECK] WhitelistPath
[00:38:0328] [CHECK] HijackName
[00:38:0328] [CHECK] Signature
[00:38:0375] [PE] Mapping
[00:38:0375] [PE] Parsing
[00:38:0375] [PE] Dos header -> 0x1e50000
[00:38:0375] [PE] Nt header (offset : 0xe8) file size 0x18000
[00:38:0375] [PE] pNtHeadersx86 -> 0x1e500e8
[00:38:0375] [PE] Chars -> 0x210e
[00:38:0375] [PE] Optional header
[00:38:0375] [PE] Sections : 5
[00:38:0375] [PE] Section : 0 - .text
[00:38:0375] [PE] Section : 1 - .orpc
[00:38:0375] [PE] Section : 2 - .data
[00:38:0375] [PE] Section : 3 - .rsrc
[00:38:0375] [PE] Section : 4 - .reloc
[00:38:0375] [PE] File open : 1
[00:38:0375] [PE] Search sigs
[00:38:0375] [PE] Section[0/4] : 0x1e50400
[00:38:0375] [PE] Init AhoCorasick
[00:38:0375] [PE] Start AhoCorasick
[00:38:0391] [PE] Looking results : 0
[00:38:0391] [PE] Section[1/4] : 0x1e61e00
[00:38:0391] [PE] Init AhoCorasick
[00:38:0391] [PE] Start AhoCorasick
[00:38:0391] [PE] Looking results : 0
[00:38:0391] [PE] Section[2/4] : 0x1e62c00
[00:38:0391] [PE] Init AhoCorasick
[00:38:0391] [PE] Start AhoCorasick
[00:38:0391] [PE] Looking results : 0
[00:38:0391] [PE] Section[3/4] : 0x1e65200
[00:38:0391] [PE] Init AhoCorasick
[00:38:0391] [PE] Start AhoCorasick
[00:38:0391] [PE] Looking results : 0
[00:38:0391] [PE] Section[4/4] : 0x1e65800
[00:38:0391] [PE] Init AhoCorasick
[00:38:0391] [PE] Start AhoCorasick
[00:38:0391] [PE] Looking results : 0
[00:38:0391] [CHECK] Blacklist
[00:38:0391] [CHECK] BlacklistPath
[00:38:0391] [CHECK] BlacklistMD5
[00:38:0391] [CHECK] MadeNumbers
[00:38:0391] [CHECK] HasUnicode
[00:38:0391] [CHECK] SuspPath
[00:38:0391] [CHECK] ProcessResidue
[00:38:0391] [CHECK] Not found!
[00:38:0391] [Check DLLs] LINKINFO.dll : C:\WINDOWS\system32\LINKINFO.dll
[00:38:0391] [CHECK] WhiteDLL
[00:38:0391] [CHECK] Whitelist
[00:38:0391] [CHECK] WellKnown
[00:38:0391] [CHECK] WhitelistPath
[00:38:0391] [CHECK] HijackName
[00:38:0391] [CHECK] Signature
[00:38:0469] [PE] Mapping
[00:38:0469] [PE] Parsing
[00:38:0469] [PE] Dos header -> 0x1e50000
[00:38:0469] [PE] Nt header (offset : 0xe8) file size 0x4e00
[00:38:0469] [PE] pNtHeadersx86 -> 0x1e500e8
[00:38:0469] [PE] Chars -> 0x210e
[00:38:0469] [PE] Optional header
[00:38:0469] [PE] Sections : 4
[00:38:0469] [PE] Section : 0 - .text
[00:38:0469] [PE] Section : 1 - .data
[00:38:0469] [PE] Section : 2 - .rsrc
[00:38:0469] [PE] Section : 3 - .reloc
[00:38:0469] [PE] File open : 1
[00:38:0469] [PE] Search sigs
[00:38:0469] [PE] Section[0/3] : 0x1e50400
[00:38:0469] [PE] Init AhoCorasick
[00:38:0469] [PE] Start AhoCorasick
[00:38:0469] [PE] Looking results : 0
[00:38:0469] [PE] Section[1/3] : 0x1e54400
[00:38:0469] [PE] Init AhoCorasick
[00:38:0469] [PE] Start AhoCorasick
[00:38:0469] [PE] Looking results : 0
[00:38:0469] [PE] Section[2/3] : 0x1e54600
[00:38:0469] [PE] Init AhoCorasick
[00:38:0469] [PE] Start AhoCorasick
[00:38:0469] [PE] Looking results : 0
[00:38:0469] [PE] Section[3/3] : 0x1e54a00
[00:38:0469] [PE] Init AhoCorasick
[00:38:0469] [PE] Start AhoCorasick
[00:38:0469] [PE] Looking results : 0
[00:38:0469] [CHECK] Blacklist
[00:38:0469] [CHECK] BlacklistPath
[00:38:0469] [CHECK] BlacklistMD5
[00:38:0469] [CHECK] MadeNumbers
[00:38:0469] [CHECK] HasUnicode
[00:38:0469] [CHECK] SuspPath
[00:38:0469] [CHECK] ProcessResidue
[00:38:0469] [CHECK] Not found!
[00:38:0484] [Check DLLs] ntshrui.dll : C:\WINDOWS\system32\ntshrui.dll
[00:38:0484] [CHECK] WhiteDLL
[00:38:0484] [CHECK] Whitelist
[00:38:0484] [CHECK] WellKnown
[00:38:0484] [CHECK] WhitelistPath
[00:38:0484] [CHECK] HijackName
[00:38:0484] [CHECK] Signature
[00:38:0531] [PE] Mapping
[00:38:0531] [PE] Parsing
[00:38:0531] [PE] Dos header -> 0x1e50000
[00:38:0531] [PE] Nt header (offset : 0xe8) file size 0x23000
[00:38:0531] [PE] pNtHeadersx86 -> 0x1e500e8
[00:38:0531] [PE] Chars -> 0x210e
[00:38:0531] [PE] Optional header
[00:38:0531] [PE] Sections : 4
[00:38:0531] [PE] Section : 0 - .text
[00:38:0531] [PE] Section : 1 - .data
[00:38:0531] [PE] Section : 2 - .rsrc
[00:38:0531] [PE] Section : 3 - .reloc
[00:38:0531] [PE] File open : 1
[00:38:0531] [PE] Search sigs
[00:38:0531] [PE] Section[0/3] : 0x1e50400
[00:38:0531] [PE] Init AhoCorasick
[00:38:0531] [PE] Start AhoCorasick
[00:38:0531] [PE] Looking results : 0
[00:38:0531] [PE] Section[1/3] : 0x1e5b400
[00:38:0531] [PE] Init AhoCorasick
[00:38:0531] [PE] Start AhoCorasick
[00:38:0531] [PE] Looking results : 0
[00:38:0531] [PE] Section[2/3] : 0x1e5b800
[00:38:0531] [PE] Init AhoCorasick
[00:38:0531] [PE] Start AhoCorasick
[00:38:0531] [PE] Looking results : 0
[00:38:0531] [PE] Section[3/3] : 0x1e72600
[00:38:0531] [PE] Init AhoCorasick
[00:38:0531] [PE] Start AhoCorasick
[00:38:0531] [PE] Looking results : 0
[00:38:0531] [CHECK] Blacklist
[00:38:0531] [CHECK] BlacklistPath
[00:38:0531] [CHECK] BlacklistMD5
[00:38:0531] [CHECK] MadeNumbers
[00:38:0531] [CHECK] HasUnicode
[00:38:0531] [CHECK] SuspPath
[00:38:0531] [CHECK] ProcessResidue
[00:38:0531] [CHECK] Not found!
[00:38:0531] [Check DLLs] ATL.DLL : C:\WINDOWS\system32\ATL.DLL
[00:38:0531] [CHECK] WhiteDLL
[00:38:0531] [CHECK] Whitelist
[00:38:0531] [CHECK] WellKnown
[00:38:0531] [CHECK] WhitelistPath
[00:38:0531] [CHECK] HijackName
[00:38:0531] [CHECK] Signature
[00:38:0547] [PE] Mapping
[00:38:0547] [PE] Parsing
[00:38:0547] [PE] Dos header -> 0x1e50000
[00:38:0547] [PE] Nt header (offset : 0xf0) file size 0xe600
[00:38:0547] [PE] pNtHeadersx86 -> 0x1e500f0
[00:38:0547] [PE] Chars -> 0x210e
[00:38:0547] [PE] Optional header
[00:38:0547] [PE] Sections : 4
[00:38:0547] [PE] Section : 0 - .text
[00:38:0547] [PE] Section : 1 - .data
[00:38:0547] [PE] Section : 2 - .rsrc
[00:38:0547] [PE] Section : 3 - .reloc
[00:38:0547] [PE] File open : 1
[00:38:0547] [PE] Search sigs
[00:38:0547] [PE] Section[0/3] : 0x1e50400
[00:38:0547] [PE] Init AhoCorasick
[00:38:0547] [PE] Start AhoCorasick
[00:38:0547] [PE] Looking results : 0
[00:38:0547] [PE] Section[1/3] : 0x1e5b200
[00:38:0547] [PE] Init AhoCorasick
[00:38:0547] [PE] Start AhoCorasick
[00:38:0547] [PE] Looking results : 0
[00:38:0547] [PE] Section[2/3] : 0x1e5b600
[00:38:0547] [PE] Init AhoCorasick
[00:38:0547] [PE] Start AhoCorasick
[00:38:0547] [PE] Looking results : 0
[00:38:0547] [PE] Section[3/3] : 0x1e5da00
[00:38:0547] [PE] Init AhoCorasick
[00:38:0547] [PE] Start AhoCorasick
[00:38:0547] [PE] Looking results : 0
[00:38:0547] [CHECK] Blacklist
[00:38:0547] [CHECK] BlacklistPath
[00:38:0547] [CHECK] BlacklistMD5
[00:38:0547] [CHECK] MadeNumbers
[00:38:0547] [CHECK] HasUnicode
[00:38:0547] [CHECK] SuspPath
[00:38:0547] [CHECK] ProcessResidue
[00:38:0547] [CHECK] Not found!
[00:38:0547] [Check DLLs] SAMLIB.dll : C:\WINDOWS\system32\SAMLIB.dll
[00:38:0547] [CHECK] WhiteDLL
[00:38:0563] [CHECK] Whitelist
[00:38:0563] [CHECK] WellKnown
[00:38:0563] [CHECK] WhitelistPath
[00:38:0563] [CHECK] HijackName
[00:38:0563] [CHECK] Signature
[00:38:0563] [PE] Mapping
[00:38:0563] [PE] Parsing
[00:38:0563] [PE] Dos header -> 0x1e50000
[00:38:0563] [PE] Nt header (offset : 0xf0) file size 0xfa00
[00:38:0563] [PE] pNtHeadersx86 -> 0x1e500f0
[00:38:0563] [PE] Chars -> 0x210e
[00:38:0563] [PE] Optional header
[00:38:0563] [PE] Sections : 4
[00:38:0563] [PE] Section : 0 - .text
[00:38:0563] [PE] Section : 1 - .data
[00:38:0563] [PE] Section : 2 - .rsrc
[00:38:0563] [PE] Section : 3 - .reloc
[00:38:0563] [PE] File open : 1
[00:38:0563] [PE] Search sigs
[00:38:0563] [PE] Section[0/3] : 0x1e50400
[00:38:0563] [PE] Init AhoCorasick
[00:38:0563] [PE] Start AhoCorasick
[00:38:0578] [PE] Looking results : 0
[00:38:0578] [PE] Section[1/3] : 0x1e5ec00
[00:38:0578] [PE] Init AhoCorasick
[00:38:0578] [PE] Start AhoCorasick
[00:38:0578] [PE] Looking results : 0
[00:38:0578] [PE] Section[2/3] : 0x1e5ee00
[00:38:0578] [PE] Init AhoCorasick
[00:38:0578] [PE] Start AhoCorasick
[00:38:0578] [PE] Looking results : 0
[00:38:0578] [PE] Section[3/3] : 0x1e5f200
[00:38:0578] [PE] Init AhoCorasick
[00:38:0578] [PE] Start AhoCorasick
[00:38:0578] [PE] Looking results : 0
[00:38:0578] [CHECK] Blacklist
[00:38:0578] [CHECK] BlacklistPath
[00:38:0578] [CHECK] BlacklistMD5
[00:38:0578] [CHECK] MadeNumbers
[00:38:0578] [CHECK] HasUnicode
[00:38:0578] [CHECK] SuspPath
[00:38:0578] [CHECK] ProcessResidue
[00:38:0578] [CHECK] Not found!
[00:38:0578] [Check DLLs] ieframe.dll : C:\WINDOWS\system32\ieframe.dll
[00:38:0578] [CHECK] WhiteDLL
[00:38:0578] [CHECK] Whitelist
[00:38:0578] [CHECK] WellKnown
[00:38:0578] [CHECK] WhitelistPath
[00:38:0578] [CHECK] HijackName
[00:38:0578] [CHECK] Signature
[00:38:0813] [CHECK] Blacklist
[00:38:0813] [CHECK] BlacklistPath
[00:38:0813] [CHECK] BlacklistMD5
[00:38:0813] [CHECK] MadeNumbers
[00:38:0813] [CHECK] HasUnicode
[00:38:0813] [CHECK] SuspPath
[00:38:0813] [CHECK] ProcessResidue
[00:38:0813] [CHECK] Not found!
[00:38:0813] [Check DLLs] mshtml.dll : C:\WINDOWS\system32\mshtml.dll
[00:38:0813] [CHECK] WhiteDLL
[00:38:0813] [CHECK] Whitelist
[00:38:0813] [CHECK] WellKnown
[00:38:0813] [CHECK] WhitelistPath
[00:38:0813] [CHECK] HijackName
[00:38:0813] [CHECK] Signature
[00:38:0938] [CHECK] Blacklist
[00:38:0938] [CHECK] BlacklistPath
[00:38:0938] [CHECK] BlacklistMD5
[00:38:0938] [CHECK] MadeNumbers
[00:38:0938] [CHECK] HasUnicode
[00:38:0953] [CHECK] SuspPath
[00:38:0953] [CHECK] ProcessResidue
[00:38:0953] [CHECK] Not found!
[00:38:0953] [Check DLLs] msls31.dll : C:\WINDOWS\system32\msls31.dll
[00:38:0953] [CHECK] WhiteDLL
[00:38:0953] [CHECK] Whitelist
[00:38:0953] [CHECK] WellKnown
[00:38:0953] [CHECK] WhitelistPath
[00:38:0953] [CHECK] HijackName
[00:38:0953] [CHECK] Signature
[00:38:0953] [PE] Mapping
[00:38:0953] [PE] Parsing
[00:38:0953] [PE] Dos header -> 0x1e50000
[00:38:0953] [PE] Nt header (offset : 0xf8) file size 0x26200
[00:38:0953] [PE] pNtHeadersx86 -> 0x1e500f8
[00:38:0953] [PE] Chars -> 0x2102
[00:38:0953] [PE] Optional header
[00:38:0953] [PE] Sections : 4
[00:38:0953] [PE] Section : 0 - .text
[00:38:0953] [PE] Section : 1 - .data
[00:38:0953] [PE] Section : 2 - .rsrc
[00:38:0953] [PE] Section : 3 - .reloc
[00:38:0953] [PE] File open : 1
[00:38:0953] [PE] Search sigs
[00:38:0953] [PE] Section[0/3] : 0x1e50400
[00:38:0953] [PE] Init AhoCorasick
[00:38:0953] [PE] Start AhoCorasick
[00:38:0969] [PE] Looking results : 0
[00:38:0969] [PE] Section[1/3] : 0x1e75400
[00:38:0969] [PE] Init AhoCorasick
[00:38:0969] [PE] Start AhoCorasick
[00:38:0969] [PE] Looking results : 0
[00:38:0969] [PE] Section[2/3] : 0x1e75800
[00:38:0969] [PE] Init AhoCorasick
[00:38:0969] [PE] Start AhoCorasick
[00:38:0969] [PE] Looking results : 0
[00:38:0969] [PE] Section[3/3] : 0x1e75e00
[00:38:0969] [PE] Init AhoCorasick
[00:38:0969] [PE] Start AhoCorasick
[00:38:0969] [PE] Looking results : 0
[00:38:0969] [CHECK] Blacklist
[00:38:0969] [CHECK] BlacklistPath
[00:38:0969] [CHECK] BlacklistMD5
[00:38:0969] [CHECK] MadeNumbers
[00:38:0969] [CHECK] HasUnicode
[00:38:0969] [CHECK] SuspPath
[00:38:0969] [CHECK] ProcessResidue
[00:38:0969] [CHECK] Not found!
[00:38:0969] [Check DLLs] PSAPI.DLL : C:\WINDOWS\system32\PSAPI.DLL
[00:38:0969] [CHECK] WhiteDLL
[00:38:0969] [CHECK] Whitelist
[00:38:0969] [CHECK] WellKnown
[00:38:0969] [CHECK] WhitelistPath
[00:38:0969] [CHECK] HijackName
[00:38:0969] [CHECK] Signature
[00:39:0016] [PE] Mapping
[00:39:0016] [PE] Parsing
[00:39:0016] [PE] Dos header -> 0x1e50000
[00:39:0016] [PE] Nt header (offset : 0xe0) file size 0x5a00
[00:39:0016] [PE] pNtHeadersx86 -> 0x1e500e0
[00:39:0016] [PE] Chars -> 0x210e
[00:39:0016] [PE] Optional header
[00:39:0016] [PE] Sections : 4
[00:39:0016] [PE] Section : 0 - .text
[00:39:0016] [PE] Section : 1 - .data
[00:39:0016] [PE] Section : 2 - .rsrc
[00:39:0016] [PE] Section : 3 - .reloc
[00:39:0016] [PE] File open : 1
[00:39:0016] [PE] Search sigs
[00:39:0016] [PE] Section[0/3] : 0x1e50400
[00:39:0016] [PE] Init AhoCorasick
[00:39:0016] [PE] Start AhoCorasick
[00:39:0016] [PE] Looking results : 0
[00:39:0016] [PE] Section[1/3] : 0x1e54400
[00:39:0016] [PE] Init AhoCorasick
[00:39:0016] [PE] Start AhoCorasick
[00:39:0016] [PE] Looking results : 0
[00:39:0016] [PE] Section[2/3] : 0x1e55200
[00:39:0016] [PE] Init AhoCorasick
[00:39:0016] [PE] Start AhoCorasick
[00:39:0016] [PE] Looking results : 0
[00:39:0016] [PE] Section[3/3] : 0x1e55600
[00:39:0016] [PE] Init AhoCorasick
[00:39:0016] [PE] Start AhoCorasick
[00:39:0016] [PE] Looking results : 0
[00:39:0016] [CHECK] Blacklist
[00:39:0016] [CHECK] BlacklistPath
[00:39:0016] [CHECK] BlacklistMD5
[00:39:0016] [CHECK] MadeNumbers
[00:39:0016] [CHECK] HasUnicode
[00:39:0016] [CHECK] SuspPath
[00:39:0016] [CHECK] ProcessResidue
[00:39:0016] [CHECK] Not found!
[00:39:0016] [Check DLLs] MLANG.dll : C:\WINDOWS\system32\MLANG.dll
[00:39:0016] [CHECK] WhiteDLL
[00:39:0016] [CHECK] Whitelist
[00:39:0016] [CHECK] WellKnown
[00:39:0016] [CHECK] WhitelistPath
[00:39:0016] [CHECK] HijackName
[00:39:0016] [CHECK] Signature
[00:39:0031] [PE] Mapping
[00:39:0031] [PE] Parsing
[00:39:0031] [PE] Dos header -> 0x1e50000
[00:39:0031] [PE] Nt header (offset : 0xf0) file size 0x8f200
[00:39:0031] [PE] pNtHeadersx86 -> 0x1e500f0
[00:39:0031] [PE] Chars -> 0x210e
[00:39:0031] [PE] Optional header
[00:39:0031] [PE] Sections : 4
[00:39:0031] [PE] Section : 0 - .text
[00:39:0031] [PE] Section : 1 - .data
[00:39:0031] [PE] Section : 2 - .rsrc
[00:39:0031] [PE] Section : 3 - .reloc
[00:39:0031] [PE] File open : 1
[00:39:0031] [PE] Search sigs
[00:39:0031] [PE] Section[0/3] : 0x1e50400
[00:39:0031] [PE] Init AhoCorasick
[00:39:0031] [PE] Start AhoCorasick
[00:39:0047] [PE] Looking results : 0
[00:39:0047] [PE] Section[1/3] : 0x1e71400
[00:39:0047] [PE] Init AhoCorasick
[00:39:0047] [PE] Start AhoCorasick
[00:39:0047] [PE] Looking results : 0
[00:39:0047] [PE] Section[2/3] : 0x1e75c00
[00:39:0047] [PE] Init AhoCorasick
[00:39:0047] [PE] Start AhoCorasick
[00:39:0047] [PE] Looking results : 0
[00:39:0047] [PE] Section[3/3] : 0x1edd200
[00:39:0047] [PE] Init AhoCorasick
[00:39:0047] [PE] Start AhoCorasick
[00:39:0047] [PE] Looking results : 0
[00:39:0047] [CHECK] Blacklist
[00:39:0047] [CHECK] BlacklistPath
[00:39:0047] [CHECK] BlacklistMD5
[00:39:0047] [CHECK] MadeNumbers
[00:39:0047] [CHECK] HasUnicode
[00:39:0047] [CHECK] SuspPath
[00:39:0047] [CHECK] ProcessResidue
[00:39:0047] [CHECK] Not found!
[00:39:0063] [Check DLLs] IPHLPAPI.DLL : C:\WINDOWS\system32\IPHLPAPI.DLL
[00:39:0063] [CHECK] WhiteDLL
[00:39:0063] [CHECK] Whitelist
[00:39:0063] [CHECK] WellKnown
[00:39:0063] [CHECK] WhitelistPath
[00:39:0063] [CHECK] HijackName
[00:39:0063] [CHECK] Signature
[00:39:0094] [PE] Mapping
[00:39:0094] [PE] Parsing
[00:39:0094] [PE] Dos header -> 0x1ee0000
[00:39:0094] [PE] Nt header (offset : 0xe0) file size 0x17200
[00:39:0094] [PE] pNtHeadersx86 -> 0x1ee00e0
[00:39:0094] [PE] Chars -> 0x210e
[00:39:0094] [PE] Optional header
[00:39:0094] [PE] Sections : 4
[00:39:0094] [PE] Section : 0 - .text
[00:39:0094] [PE] Section : 1 - .data
[00:39:0094] [PE] Section : 2 - .rsrc
[00:39:0094] [PE] Section : 3 - .reloc
[00:39:0094] [PE] File open : 1
[00:39:0094] [PE] Search sigs
[00:39:0094] [PE] Section[0/3] : 0x1ee0400
[00:39:0094] [PE] Init AhoCorasick
[00:39:0094] [PE] Start AhoCorasick
[00:39:0094] [PE] Looking results : 0
[00:39:0094] [PE] Section[1/3] : 0x1ef3200
[00:39:0094] [PE] Init AhoCorasick
[00:39:0094] [PE] Start AhoCorasick
[00:39:0094] [PE] Looking results : 0
[00:39:0094] [PE] Section[2/3] : 0x1ef4200
[00:39:0094] [PE] Init AhoCorasick
[00:39:0094] [PE] Start AhoCorasick
[00:39:0094] [PE] Looking results : 0
[00:39:0094] [PE] Section[3/3] : 0x1ef6400
[00:39:0094] [PE] Init AhoCorasick
[00:39:0094] [PE] Start AhoCorasick
[00:39:0094] [PE] Looking results : 0
[00:39:0094] [CHECK] Blacklist
[00:39:0094] [CHECK] BlacklistPath
[00:39:0094] [CHECK] BlacklistMD5
[00:39:0094] [CHECK] MadeNumbers
[00:39:0094] [CHECK] HasUnicode
[00:39:0094] [CHECK] SuspPath
[00:39:0109] [CHECK] ProcessResidue
[00:39:0109] [CHECK] Not found!
[00:39:0109] [Check DLLs] WS2_32.dll : C:\WINDOWS\system32\WS2_32.dll
[00:39:0109] [CHECK] WhiteDLL
[00:39:0109] [CHECK] Whitelist
[00:39:0109] [CHECK] WellKnown
[00:39:0109] [CHECK] WhitelistPath
[00:39:0109] [CHECK] HijackName
[00:39:0109] [CHECK] Signature
[00:39:0141] [PE] Mapping
[00:39:0141] [PE] Parsing
[00:39:0141] [PE] Dos header -> 0x1ee0000
[00:39:0141] [PE] Nt header (offset : 0xf0) file size 0x14200
[00:39:0141] [PE] pNtHeadersx86 -> 0x1ee00f0
[00:39:0141] [PE] Chars -> 0x210e
[00:39:0141] [PE] Optional header
[00:39:0141] [PE] Sections : 4
[00:39:0141] [PE] Section : 0 - .text
[00:39:0141] [PE] Section : 1 - .data
[00:39:0141] [PE] Section : 2 - .rsrc
[00:39:0141] [PE] Section : 3 - .reloc
[00:39:0141] [PE] File open : 1
[00:39:0141] [PE] Search sigs
[00:39:0141] [PE] Section[0/3] : 0x1ee0400
[00:39:0141] [PE] Init AhoCorasick
[00:39:0141] [PE] Start AhoCorasick
[00:39:0141] [PE] Looking results : 0
[00:39:0141] [PE] Section[1/3] : 0x1ef2600
[00:39:0141] [PE] Init AhoCorasick
[00:39:0141] [PE] Start AhoCorasick
[00:39:0141] [PE] Looking results : 0
[00:39:0141] [PE] Section[2/3] : 0x1ef3000
[00:39:0156] [PE] Init AhoCorasick
[00:39:0156] [PE] Start AhoCorasick
[00:39:0156] [PE] Looking results : 0
[00:39:0156] [PE] Section[3/3] : 0x1ef3400
[00:39:0156] [PE] Init AhoCorasick
[00:39:0156] [PE] Start AhoCorasick
[00:39:0156] [PE] Looking results : 0
[00:39:0156] [CHECK] Blacklist
[00:39:0156] [CHECK] BlacklistPath
[00:39:0156] [CHECK] BlacklistMD5
[00:39:0156] [CHECK] MadeNumbers
[00:39:0156] [CHECK] HasUnicode
[00:39:0156] [CHECK] SuspPath
[00:39:0156] [CHECK] ProcessResidue
[00:39:0156] [CHECK] Not found!
[00:39:0156] [Check DLLs] WS2HELP.dll : C:\WINDOWS\system32\WS2HELP.dll
[00:39:0156] [CHECK] WhiteDLL
[00:39:0156] [CHECK] Whitelist
[00:39:0156] [CHECK] WellKnown
[00:39:0156] [CHECK] WhitelistPath
[00:39:0156] [CHECK] HijackName
[00:39:0156] [CHECK] Signature
[00:39:0156] [PE] Mapping
[00:39:0156] [PE] Parsing
[00:39:0156] [PE] Dos header -> 0x1e50000
[00:39:0156] [PE] Nt header (offset : 0xd8) file size 0x4e00
[00:39:0156] [PE] pNtHeadersx86 -> 0x1e500d8
[00:39:0156] [PE] Chars -> 0x210e
[00:39:0156] [PE] Optional header
[00:39:0156] [PE] Sections : 4
[00:39:0156] [PE] Section : 0 - .text
[00:39:0156] [PE] Section : 1 - .data
[00:39:0156] [PE] Section : 2 - .rsrc
[00:39:0156] [PE] Section : 3 - .reloc
[00:39:0156] [PE] File open : 1
[00:39:0156] [PE] Search sigs
[00:39:0156] [PE] Section[0/3] : 0x1e50400
[00:39:0156] [PE] Init AhoCorasick
[00:39:0156] [PE] Start AhoCorasick
[00:39:0156] [PE] Looking results : 0
[00:39:0156] [PE] Section[1/3] : 0x1e54200
[00:39:0156] [PE] Init AhoCorasick
[00:39:0156] [PE] Start AhoCorasick
[00:39:0156] [PE] Looking results : 0
[00:39:0156] [PE] Section[2/3] : 0x1e54400
[00:39:0156] [PE] Init AhoCorasick
[00:39:0156] [PE] Start AhoCorasick
[00:39:0156] [PE] Looking results : 0
[00:39:0156] [PE] Section[3/3] : 0x1e54a00
[00:39:0156] [PE] Init AhoCorasick
[00:39:0156] [PE] Start AhoCorasick
[00:39:0156] [PE] Looking results : 0
[00:39:0156] [CHECK] Blacklist
[00:39:0156] [CHECK] BlacklistPath
[00:39:0156] [CHECK] BlacklistMD5
[00:39:0156] [CHECK] MadeNumbers
[00:39:0156] [CHECK] HasUnicode
[00:39:0156] [CHECK] SuspPath
[00:39:0156] [CHECK] ProcessResidue
[00:39:0156] [CHECK] Not found!
[00:39:0156] [Check DLLs] RASAPI32.dll : C:\WINDOWS\system32\RASAPI32.dll
[00:39:0156] [CHECK] WhiteDLL
[00:39:0172] [CHECK] Whitelist
[00:39:0172] [CHECK] WellKnown
[00:39:0172] [CHECK] WhitelistPath
[00:39:0172] [CHECK] HijackName
[00:39:0172] [CHECK] Signature
[00:39:0219] [PE] Mapping
[00:39:0219] [PE] Parsing
[00:39:0219] [PE] Dos header -> 0x1ee0000
[00:39:0219] [PE] Nt header (offset : 0xd8) file size 0x39e00
[00:39:0219] [PE] pNtHeadersx86 -> 0x1ee00d8
[00:39:0219] [PE] Chars -> 0x210e
[00:39:0219] [PE] Optional header
[00:39:0219] [PE] Sections : 4
[00:39:0219] [PE] Section : 0 - .text
[00:39:0219] [PE] Section : 1 - .data
[00:39:0219] [PE] Section : 2 - .rsrc
[00:39:0219] [PE] Section : 3 - .reloc
[00:39:0219] [PE] File open : 1
[00:39:0219] [PE] Search sigs
[00:39:0219] [PE] Section[0/3] : 0x1ee0400
[00:39:0219] [PE] Init AhoCorasick
[00:39:0219] [PE] Start AhoCorasick
[00:39:0219] [PE] Looking results : 0
[00:39:0219] [PE] Section[1/3] : 0x1f16000
[00:39:0219] [PE] Init AhoCorasick
[00:39:0219] [PE] Start AhoCorasick
[00:39:0219] [PE] Looking results : 0
[00:39:0219] [PE] Section[2/3] : 0x1f16400
[00:39:0219] [PE] Init AhoCorasick
[00:39:0219] [PE] Start AhoCorasick
[00:39:0219] [PE] Looking results : 0
[00:39:0219] [PE] Section[3/3] : 0x1f17200
[00:39:0219] [PE] Init AhoCorasick
[00:39:0219] [PE] Start AhoCorasick
[00:39:0219] [PE] Looking results : 0
[00:39:0219] [CHECK] Blacklist
[00:39:0219] [CHECK] BlacklistPath
[00:39:0219] [CHECK] BlacklistMD5
[00:39:0219] [CHECK] MadeNumbers
[00:39:0219] [CHECK] HasUnicode
[00:39:0219] [CHECK] SuspPath
[00:39:0219] [CHECK] ProcessResidue
[00:39:0219] [CHECK] Not found!
[00:39:0219] [Check DLLs] rasman.dll : C:\WINDOWS\system32\rasman.dll
[00:39:0219] [CHECK] WhiteDLL
[00:39:0219] [CHECK] Whitelist
[00:39:0219] [CHECK] WellKnown
[00:39:0219] [CHECK] WhitelistPath
[00:39:0219] [CHECK] HijackName
[00:39:0234] [CHECK] Signature
[00:39:0234] [PE] Mapping
[00:39:0234] [PE] Parsing
[00:39:0234] [PE] Dos header -> 0x1e50000
[00:39:0234] [PE] Nt header (offset : 0xe0) file size 0xf000
[00:39:0234] [PE] pNtHeadersx86 -> 0x1e500e0
[00:39:0234] [PE] Chars -> 0x210e
[00:39:0234] [PE] Optional header
[00:39:0234] [PE] Sections : 4
[00:39:0234] [PE] Section : 0 - .text
[00:39:0234] [PE] Section : 1 - .data
[00:39:0234] [PE] Section : 2 - .rsrc
[00:39:0234] [PE] Section : 3 - .reloc
[00:39:0234] [PE] File open : 1
[00:39:0234] [PE] Search sigs
[00:39:0234] [PE] Section[0/3] : 0x1e50400
[00:39:0234] [PE] Init AhoCorasick
[00:39:0234] [PE] Start AhoCorasick
[00:39:0234] [PE] Looking results : 0
[00:39:0234] [PE] Section[1/3] : 0x1e5de00
[00:39:0234] [PE] Init AhoCorasick
[00:39:0234] [PE] Start AhoCorasick
[00:39:0234] [PE] Looking results : 0
[00:39:0234] [PE] Section[2/3] : 0x1e5e000
[00:39:0234] [PE] Init AhoCorasick
[00:39:0234] [PE] Start AhoCorasick
[00:39:0234] [PE] Looking results : 0
[00:39:0234] [PE] Section[3/3] : 0x1e5e400
[00:39:0234] [PE] Init AhoCorasick
[00:39:0234] [PE] Start AhoCorasick
[00:39:0234] [PE] Looking results : 0
[00:39:0234] [CHECK] Blacklist
[00:39:0234] [CHECK] BlacklistPath
[00:39:0234] [CHECK] BlacklistMD5
[00:39:0234] [CHECK] MadeNumbers
[00:39:0234] [CHECK] HasUnicode
[00:39:0234] [CHECK] SuspPath
[00:39:0234] [CHECK] ProcessResidue
[00:39:0234] [CHECK] Not found!
[00:39:0234] [Check DLLs] TAPI32.dll : C:\WINDOWS\system32\TAPI32.dll
[00:39:0234] [CHECK] WhiteDLL
[00:39:0234] [CHECK] Whitelist
[00:39:0234] [CHECK] WellKnown
[00:39:0234] [CHECK] WhitelistPath
[00:39:0234] [CHECK] HijackName
[00:39:0234] [CHECK] Signature
[00:39:0281] [PE] Mapping
[00:39:0281] [PE] Parsing
[00:39:0281] [PE] Dos header -> 0x1ee0000
[00:39:0281] [PE] Nt header (offset : 0xe8) file size 0x2c600
[00:39:0281] [PE] pNtHeadersx86 -> 0x1ee00e8
[00:39:0281] [PE] Chars -> 0x210e
[00:39:0281] [PE] Optional header
[00:39:0281] [PE] Sections : 4
[00:39:0281] [PE] Section : 0 - .text
[00:39:0281] [PE] Section : 1 - .data
[00:39:0281] [PE] Section : 2 - .rsrc
[00:39:0281] [PE] Section : 3 - .reloc
[00:39:0281] [PE] File open : 1
[00:39:0281] [PE] Search sigs
[00:39:0281] [PE] Section[0/3] : 0x1ee0400
[00:39:0281] [PE] Init AhoCorasick
[00:39:0281] [PE] Start AhoCorasick
[00:39:0281] [PE] Looking results : 0
[00:39:0281] [PE] Section[1/3] : 0x1f09a00
[00:39:0281] [PE] Init AhoCorasick
[00:39:0281] [PE] Start AhoCorasick
[00:39:0281] [PE] Looking results : 0
[00:39:0281] [PE] Section[2/3] : 0x1f0a000
[00:39:0281] [PE] Init AhoCorasick
[00:39:0281] [PE] Start AhoCorasick
[00:39:0281] [PE] Looking results : 0
[00:39:0281] [PE] Section[3/3] : 0x1f0a800
[00:39:0281] [PE] Init AhoCorasick
[00:39:0281] [PE] Start AhoCorasick
[00:39:0281] [PE] Looking results : 0
[00:39:0281] [CHECK] Blacklist
[00:39:0281] [CHECK] BlacklistPath
[00:39:0281] [CHECK] BlacklistMD5
[00:39:0281] [CHECK] MadeNumbers
[00:39:0281] [CHECK] HasUnicode
[00:39:0281] [CHECK] SuspPath
[00:39:0281] [CHECK] ProcessResidue
[00:39:0281] [CHECK] Not found!
[00:39:0297] [Check DLLs] rtutils.dll : C:\WINDOWS\system32\rtutils.dll
[00:39:0297] [CHECK] WhiteDLL
[00:39:0297] [CHECK] Whitelist
[00:39:0297] [CHECK] WellKnown
[00:39:0297] [CHECK] WhitelistPath
[00:39:0297] [CHECK] HijackName
[00:39:0297] [CHECK] Signature
[00:39:0328] [PE] Mapping
[00:39:0328] [PE] Parsing
[00:39:0328] [PE] Dos header -> 0x1e50000
[00:39:0328] [PE] Nt header (offset : 0xd8) file size 0xac00
[00:39:0328] [PE] pNtHeadersx86 -> 0x1e500d8
[00:39:0328] [PE] Chars -> 0x210e
[00:39:0328] [PE] Optional header
[00:39:0328] [PE] Sections : 4
[00:39:0328] [PE] Section : 0 - .text
[00:39:0328] [PE] Section : 1 - .data
[00:39:0328] [PE] Section : 2 - .rsrc
[00:39:0328] [PE] Section : 3 - .reloc
[00:39:0328] [PE] File open : 1
[00:39:0328] [PE] Search sigs
[00:39:0328] [PE] Section[0/3] : 0x1e50400
[00:39:0328] [PE] Init AhoCorasick
[00:39:0328] [PE] Start AhoCorasick
[00:39:0328] [PE] Looking results : 0
[00:39:0328] [PE] Section[1/3] : 0x1e59c00
[00:39:0328] [PE] Init AhoCorasick
[00:39:0328] [PE] Start AhoCorasick
[00:39:0328] [PE] Looking results : 0
[00:39:0344] [PE] Section[2/3] : 0x1e59e00
[00:39:0344] [PE] Init AhoCorasick
[00:39:0344] [PE] Start AhoCorasick
[00:39:0344] [PE] Looking results : 0
[00:39:0344] [PE] Section[3/3] : 0x1e5a200
[00:39:0344] [PE] Init AhoCorasick
[00:39:0344] [PE] Start AhoCorasick
[00:39:0344] [PE] Looking results : 0
[00:39:0344] [CHECK] Blacklist
[00:39:0344] [CHECK] BlacklistPath
[00:39:0344] [CHECK] BlacklistMD5
[00:39:0344] [CHECK] MadeNumbers
[00:39:0344] [CHECK] HasUnicode
[00:39:0344] [CHECK] SuspPath
[00:39:0344] [CHECK] ProcessResidue
[00:39:0344] [CHECK] Not found!
[00:39:0344] [Check DLLs] msv1_0.dll : C:\WINDOWS\system32\msv1_0.dll
[00:39:0344] [CHECK] WhiteDLL
[00:39:0344] [CHECK] Whitelist
[00:39:0344] [CHECK] WellKnown
[00:39:0344] [CHECK] WhitelistPath
[00:39:0344] [CHECK] HijackName
[00:39:0344] [CHECK] Signature
[00:39:0391] [PE] Mapping
[00:39:0391] [PE] Parsing
[00:39:0391] [PE] Dos header -> 0x1ee0000
[00:39:0391] [PE] Nt header (offset : 0xf8) file size 0x21400
[00:39:0391] [PE] pNtHeadersx86 -> 0x1ee00f8
[00:39:0391] [PE] Chars -> 0x210e
[00:39:0391] [PE] Optional header
[00:39:0391] [PE] Sections : 4
[00:39:0391] [PE] Section : 0 - .text
[00:39:0391] [PE] Section : 1 - .data
[00:39:0391] [PE] Section : 2 - .rsrc
[00:39:0391] [PE] Section : 3 - .reloc
[00:39:0391] [PE] File open : 1
[00:39:0391] [PE] Search sigs
[00:39:0391] [PE] Section[0/3] : 0x1ee0400
[00:39:0391] [PE] Init AhoCorasick
[00:39:0391] [PE] Start AhoCorasick
[00:39:0391] [PE] Looking results : 0
[00:39:0391] [PE] Section[1/3] : 0x1efdc00
[00:39:0391] [PE] Init AhoCorasick
[00:39:0391] [PE] Start AhoCorasick
[00:39:0391] [PE] Looking results : 0
[00:39:0391] [PE] Section[2/3] : 0x1efee00
[00:39:0391] [PE] Init AhoCorasick
[00:39:0391] [PE] Start AhoCorasick
[00:39:0391] [PE] Looking results : 0
[00:39:0391] [PE] Section[3/3] : 0x1f00000
[00:39:0391] [PE] Init AhoCorasick
[00:39:0391] [PE] Start AhoCorasick
[00:39:0391] [PE] Looking results : 0
[00:39:0391] [CHECK] Blacklist
[00:39:0391] [CHECK] BlacklistPath
[00:39:0406] [CHECK] BlacklistMD5
[00:39:0406] [CHECK] MadeNumbers
[00:39:0406] [CHECK] HasUnicode
[00:39:0406] [CHECK] SuspPath
[00:39:0406] [CHECK] ProcessResidue
[00:39:0406] [CHECK] Not found!
[00:39:0406] [Check DLLs] cryptdll.dll : C:\WINDOWS\system32\cryptdll.dll
[00:39:0406] [CHECK] WhiteDLL
[00:39:0406] [CHECK] Whitelist
[00:39:0406] [CHECK] WellKnown
[00:39:0406] [CHECK] WhitelistPath
[00:39:0406] [CHECK] HijackName
[00:39:0406] [CHECK] Signature
[00:39:0438] [PE] Mapping
[00:39:0438] [PE] Parsing
[00:39:0438] [PE] Dos header -> 0x1e50000
[00:39:0438] [PE] Nt header (offset : 0xd8) file size 0x8200
[00:39:0438] [PE] pNtHeadersx86 -> 0x1e500d8
[00:39:0438] [PE] Chars -> 0x210e
[00:39:0438] [PE] Optional header
[00:39:0438] [PE] Sections : 4
[00:39:0438] [PE] Section : 0 - .text
[00:39:0438] [PE] Section : 1 - .data
[00:39:0438] [PE] Section : 2 - .rsrc
[00:39:0438] [PE] Section : 3 - .reloc
[00:39:0438] [PE] File open : 1
[00:39:0438] [PE] Search sigs
[00:39:0438] [PE] Section[0/3] : 0x1e50400
[00:39:0438] [PE] Init AhoCorasick
[00:39:0438] [PE] Start AhoCorasick
[00:39:0438] [PE] Looking results : 0
[00:39:0438] [PE] Section[1/3] : 0x1e56600
[00:39:0438] [PE] Init AhoCorasick
[00:39:0453] [PE] Start AhoCorasick
[00:39:0453] [PE] Looking results : 0
[00:39:0453] [PE] Section[2/3] : 0x1e57800
[00:39:0453] [PE] Init AhoCorasick
[00:39:0453] [PE] Start AhoCorasick
[00:39:0453] [PE] Looking results : 0
[00:39:0453] [PE] Section[3/3] : 0x1e57c00
[00:39:0453] [PE] Init AhoCorasick
[00:39:0453] [PE] Start AhoCorasick
[00:39:0453] [PE] Looking results : 0
[00:39:0453] [CHECK] Blacklist
[00:39:0453] [CHECK] BlacklistPath
[00:39:0453] [CHECK] BlacklistMD5
[00:39:0453] [CHECK] MadeNumbers
[00:39:0453] [CHECK] HasUnicode
[00:39:0453] [CHECK] SuspPath
[00:39:0453] [CHECK] ProcessResidue
[00:39:0453] [CHECK] Not found!
[00:39:0453] [Check DLLs] sensapi.dll : C:\WINDOWS\system32\sensapi.dll
[00:39:0453] [CHECK] WhiteDLL
[00:39:0453] [CHECK] Whitelist
[00:39:0453] [CHECK] WellKnown
[00:39:0453] [CHECK] WhitelistPath
[00:39:0453] [CHECK] HijackName
[00:39:0453] [CHECK] Signature
[00:39:0453] [PE] Mapping
[00:39:0453] [PE] Parsing
[00:39:0453] [PE] Dos header -> 0x1e50000
[00:39:0453] [PE] Nt header (offset : 0xd8) file size 0x1c00
[00:39:0453] [PE] pNtHeadersx86 -> 0x1e500d8
[00:39:0453] [PE] Chars -> 0x210e
[00:39:0453] [PE] Optional header
[00:39:0453] [PE] Sections : 4
[00:39:0453] [PE] Section : 0 - .text
[00:39:0453] [PE] Section : 1 - .data
[00:39:0453] [PE] Section : 2 - .rsrc
[00:39:0453] [PE] Section : 3 - .reloc
[00:39:0453] [PE] File open : 1
[00:39:0453] [PE] Search sigs
[00:39:0453] [PE] Section[0/3] : 0x1e50400
[00:39:0453] [PE] Init AhoCorasick
[00:39:0453] [PE] Start AhoCorasick
[00:39:0453] [PE] Looking results : 0
[00:39:0453] [PE] Section[1/3] : 0x1e51400
[00:39:0453] [PE] Init AhoCorasick
[00:39:0453] [PE] Start AhoCorasick
[00:39:0453] [PE] Looking results : 0
[00:39:0453] [PE] Section[2/3] : 0x1e51600
[00:39:0453] [PE] Init AhoCorasick
[00:39:0453] [PE] Start AhoCorasick
[00:39:0453] [PE] Looking results : 0
[00:39:0453] [PE] Section[3/3] : 0x1e51a00
[00:39:0453] [PE] Init AhoCorasick
[00:39:0453] [PE] Start AhoCorasick
[00:39:0453] [PE] Looking results : 0
[00:39:0453] [CHECK] Blacklist
[00:39:0453] [CHECK] BlacklistPath
[00:39:0453] [CHECK] BlacklistMD5
[00:39:0453] [CHECK] MadeNumbers
[00:39:0453] [CHECK] HasUnicode
[00:39:0453] [CHECK] SuspPath
[00:39:0453] [CHECK] ProcessResidue
[00:39:0453] [CHECK] Not found!
[00:39:0453] [Check DLLs] msi.dll : C:\WINDOWS\system32\msi.dll
[00:39:0453] [CHECK] WhiteDLL
[00:39:0469] [CHECK] Whitelist
[00:39:0469] [CHECK] WellKnown
[00:39:0469] [CHECK] WhitelistPath
[00:39:0469] [CHECK] HijackName
[00:39:0469] [CHECK] Signature
[00:39:0578] [PE] Mapping
[00:39:0578] [PE] Parsing
[00:39:0578] [PE] Dos header -> 0x2350000
[00:39:0578] [PE] Nt header (offset : 0xe8) file size 0x2b6200
[00:39:0578] [PE] pNtHeadersx86 -> 0x23500e8
[00:39:0578] [PE] Chars -> 0x210e
[00:39:0594] [PE] Optional header
[00:39:0594] [PE] Sections : 5
[00:39:0594] [PE] Section : 0 - .orpc
[00:39:0594] [PE] Section : 1 - .text
[00:39:0594] [PE] Section : 2 - .data
[00:39:0594] [PE] Section : 3 - .rsrc
[00:39:0594] [PE] Section : 4 - .reloc
[00:39:0594] [PE] File open : 1
[00:39:0594] [PE] Search sigs
[00:39:0594] [PE] Section[0/4] : 0x2350400
[00:39:0594] [PE] Init AhoCorasick
[00:39:0594] [PE] Start AhoCorasick
[00:39:0594] [PE] Looking results : 0
[00:39:0594] [PE] Section[1/4] : 0x2350600
[00:39:0594] [PE] Init AhoCorasick
[00:39:0594] [PE] Start AhoCorasick
[00:39:0625] [PE] Looking results : 0
[00:39:0625] [PE] Section[2/4] : 0x2501c00
[00:39:0625] [PE] Init AhoCorasick
[00:39:0625] [PE] Start AhoCorasick
[00:39:0625] [PE] Looking results : 0
[00:39:0625] [PE] Section[3/4] : 0x250b000
[00:39:0625] [PE] Init AhoCorasick
[00:39:0625] [PE] Start AhoCorasick
[00:39:0641] [PE] Looking results : 0
[00:39:0641] [PE] Section[4/4] : 0x25f9e00
[00:39:0641] [PE] Init AhoCorasick
[00:39:0641] [PE] Start AhoCorasick
[00:39:0641] [PE] Looking results : 0
[00:39:0641] [CHECK] Blacklist
[00:39:0656] [CHECK] BlacklistPath
[00:39:0656] [CHECK] BlacklistMD5
[00:39:0656] [CHECK] MadeNumbers
[00:39:0656] [CHECK] HasUnicode
[00:39:0656] [CHECK] SuspPath
[00:39:0656] [CHECK] ProcessResidue
[00:39:0656] [CHECK] Not found!
[00:39:0656] [Check DLLs] SETUPAPI.dll : C:\WINDOWS\system32\SETUPAPI.dll
[00:39:0656] [CHECK] WhiteDLL
[00:39:0656] [CHECK] Whitelist
[00:39:0656] [CHECK] WellKnown
[00:39:0656] [CHECK] WhitelistPath
[00:39:0656] [CHECK] HijackName
[00:39:0656] [CHECK] Signature
[00:39:0703] [PE] Mapping
[00:39:0703] [PE] Parsing
[00:39:0703] [PE] Dos header -> 0x2350000
[00:39:0703] [PE] Nt header (offset : 0xd8) file size 0xf0800
[00:39:0703] [PE] pNtHeadersx86 -> 0x23500d8
[00:39:0703] [PE] Chars -> 0x2d0e
[00:39:0703] [PE] Optional header
[00:39:0703] [PE] Sections : 4
[00:39:0703] [PE] Section : 0 - .text
[00:39:0703] [PE] Section : 1 - .data
[00:39:0703] [PE] Section : 2 - .rsrc
[00:39:0703] [PE] Section : 3 - .reloc
[00:39:0703] [PE] File open : 1
[00:39:0703] [PE] Search sigs
[00:39:0703] [PE] Section[0/3] : 0x2350400
[00:39:0719] [PE] Init AhoCorasick
[00:39:0719] [PE] Start AhoCorasick
[00:39:0719] [PE] Looking results : 0
[00:39:0719] [PE] Section[1/3] : 0x23cd400
[00:39:0719] [PE] Init AhoCorasick
[00:39:0719] [PE] Start AhoCorasick
[00:39:0719] [PE] Looking results : 0
[00:39:0719] [PE] Section[2/3] : 0x23cec00
[00:39:0719] [PE] Init AhoCorasick
[00:39:0719] [PE] Start AhoCorasick
[00:39:0734] [PE] Looking results : 0
[00:39:0734] [PE] Section[3/3] : 0x243c200
[00:39:0734] [PE] Init AhoCorasick
[00:39:0734] [PE] Start AhoCorasick
[00:39:0734] [PE] Looking results : 0
[00:39:0734] [CHECK] Blacklist
[00:39:0734] [CHECK] BlacklistPath
[00:39:0734] [CHECK] BlacklistMD5
[00:39:0734] [CHECK] MadeNumbers
[00:39:0734] [CHECK] HasUnicode
[00:39:0734] [CHECK] SuspPath
[00:39:0734] [CHECK] ProcessResidue
[00:39:0734] [CHECK] Not found!
[00:39:0734] [Check DLLs] netman.dll : C:\WINDOWS\system32\netman.dll
[00:39:0734] [CHECK] WhiteDLL
[00:39:0734] [CHECK] Whitelist
[00:39:0734] [CHECK] WellKnown
[00:39:0734] [CHECK] WhitelistPath
[00:39:0734] [CHECK] HijackName
[00:39:0734] [CHECK] Signature
[00:39:0750] [PE] Mapping
[00:39:0750] [PE] Parsing
[00:39:0750] [PE] Dos header -> 0x1ee0000
[00:39:0750] [PE] Nt header (offset : 0xe0) file size 0x30600
[00:39:0750] [PE] pNtHeadersx86 -> 0x1ee00e0
[00:39:0750] [PE] Chars -> 0x210e
[00:39:0750] [PE] Optional header
[00:39:0750] [PE] Sections : 4
[00:39:0750] [PE] Section : 0 - .text
[00:39:0750] [PE] Section : 1 - .data
[00:39:0750] [PE] Section : 2 - .rsrc
[00:39:0750] [PE] Section : 3 - .reloc
[00:39:0750] [PE] File open : 1
[00:39:0750] [PE] Search sigs
[00:39:0750] [PE] Section[0/3] : 0x1ee0600
[00:39:0750] [PE] Init AhoCorasick
[00:39:0750] [PE] Start AhoCorasick
[00:39:0750] [PE] Looking results : 0
[00:39:0750] [PE] Section[1/3] : 0x1f0ac00
[00:39:0750] [PE] Init AhoCorasick
[00:39:0750] [PE] Start AhoCorasick
[00:39:0750] [PE] Looking results : 0
[00:39:0750] [PE] Section[2/3] : 0x1f0b400
[00:39:0750] [PE] Init AhoCorasick
[00:39:0750] [PE] Start AhoCorasick
[00:39:0750] [PE] Looking results : 0
[00:39:0750] [PE] Section[3/3] : 0x1f0e200
[00:39:0750] [PE] Init AhoCorasick
[00:39:0750] [PE] Start AhoCorasick
[00:39:0750] [PE] Looking results : 0
[00:39:0750] [CHECK] Blacklist
[00:39:0750] [CHECK] BlacklistPath
[00:39:0750] [CHECK] BlacklistMD5
[00:39:0750] [CHECK] MadeNumbers
[00:39:0750] [CHECK] HasUnicode
[00:39:0750] [CHECK] SuspPath
[00:39:0750] [CHECK] ProcessResidue
[00:39:0750] [CHECK] Not found!
[00:39:0750] [Check DLLs] MPRAPI.dll : C:\WINDOWS\system32\MPRAPI.dll
[00:39:0766] [CHECK] WhiteDLL
[00:39:0766] [CHECK] Whitelist
[00:39:0766] [CHECK] WellKnown
[00:39:0766] [CHECK] WhitelistPath
[00:39:0766] [CHECK] HijackName
[00:39:0766] [CHECK] Signature
[00:39:0766] [PE] Mapping
[00:39:0766] [PE] Parsing
[00:39:0766] [PE] Dos header -> 0x1ee0000
[00:39:0766] [PE] Nt header (offset : 0xe0) file size 0x15400
[00:39:0766] [PE] pNtHeadersx86 -> 0x1ee00e0
[00:39:0766] [PE] Chars -> 0x210e
[00:39:0766] [PE] Optional header
[00:39:0766] [PE] Sections : 4
[00:39:0766] [PE] Section : 0 - .text
[00:39:0766] [PE] Section : 1 - .data
[00:39:0766] [PE] Section : 2 - .rsrc
[00:39:0766] [PE] Section : 3 - .reloc
[00:39:0766] [PE] File open : 1
[00:39:0766] [PE] Search sigs
[00:39:0766] [PE] Section[0/3] : 0x1ee0400
[00:39:0766] [PE] Init AhoCorasick
[00:39:0766] [PE] Start AhoCorasick
[00:39:0766] [PE] Looking results : 0
[00:39:0766] [PE] Section[1/3] : 0x1ef3e00
[00:39:0766] [PE] Init AhoCorasick
[00:39:0766] [PE] Start AhoCorasick
[00:39:0766] [PE] Looking results : 0
[00:39:0766] [PE] Section[2/3] : 0x1ef4000
[00:39:0766] [PE] Init AhoCorasick
[00:39:0766] [PE] Start AhoCorasick
[00:39:0766] [PE] Looking results : 0
[00:39:0766] [PE] Section[3/3] : 0x1ef4600
[00:39:0766] [PE] Init AhoCorasick
[00:39:0766] [PE] Start AhoCorasick
[00:39:0766] [PE] Looking results : 0
[00:39:0766] [CHECK] Blacklist
[00:39:0766] [CHECK] BlacklistPath
[00:39:0766] [CHECK] BlacklistMD5
[00:39:0781] [CHECK] MadeNumbers
[00:39:0781] [CHECK] HasUnicode
[00:39:0781] [CHECK] SuspPath
[00:39:0781] [CHECK] ProcessResidue
[00:39:0781] [CHECK] Not found!
[00:39:0781] [Check DLLs] ACTIVEDS.dll : C:\WINDOWS\system32\ACTIVEDS.dll
[00:39:0781] [CHECK] WhiteDLL
[00:39:0781] [CHECK] Whitelist
[00:39:0781] [CHECK] WellKnown
[00:39:0781] [CHECK] WhitelistPath
[00:39:0781] [CHECK] HijackName
[00:39:0781] [CHECK] Signature
[00:39:0781] [PE] Mapping
[00:39:0781] [PE] Parsing
[00:39:0781] [PE] Dos header -> 0x1ee0000
[00:39:0781] [PE] Nt header (offset : 0xe0) file size 0x2f400
[00:39:0781] [PE] pNtHeadersx86 -> 0x1ee00e0
[00:39:0781] [PE] Chars -> 0x210e
[00:39:0781] [PE] Optional header
[00:39:0781] [PE] Sections : 4
[00:39:0781] [PE] Section : 0 - .text
[00:39:0781] [PE] Section : 1 - .data
[00:39:0781] [PE] Section : 2 - .rsrc
[00:39:0781] [PE] Section : 3 - .reloc
[00:39:0781] [PE] File open : 1
[00:39:0781] [PE] Search sigs
[00:39:0781] [PE] Section[0/3] : 0x1ee0400
[00:39:0781] [PE] Init AhoCorasick
[00:39:0781] [PE] Start AhoCorasick
[00:39:0797] [PE] Looking results : 0
[00:39:0797] [PE] Section[1/3] : 0x1f05c00
[00:39:0797] [PE] Init AhoCorasick
[00:39:0797] [PE] Start AhoCorasick
[00:39:0797] [PE] Looking results : 0
[00:39:0797] [PE] Section[2/3] : 0x1f0ca00
[00:39:0797] [PE] Init AhoCorasick
[00:39:0797] [PE] Start AhoCorasick
[00:39:0797] [PE] Looking results : 0
[00:39:0797] [PE] Section[3/3] : 0x1f0da00
[00:39:0797] [PE] Init AhoCorasick
[00:39:0797] [PE] Start AhoCorasick
[00:39:0797] [PE] Looking results : 0
[00:39:0797] [CHECK] Blacklist
[00:39:0797] [CHECK] BlacklistPath
[00:39:0797] [CHECK] BlacklistMD5
[00:39:0797] [CHECK] MadeNumbers
[00:39:0797] [CHECK] HasUnicode
[00:39:0797] [CHECK] SuspPath
[00:39:0797] [CHECK] ProcessResidue
[00:39:0797] [CHECK] Not found!
[00:39:0797] [Check DLLs] adsldpc.dll : C:\WINDOWS\system32\adsldpc.dll
[00:39:0797] [CHECK] WhiteDLL
[00:39:0797] [CHECK] Whitelist
[00:39:0797] [CHECK] WellKnown
[00:39:0797] [CHECK] WhitelistPath
[00:39:0797] [CHECK] HijackName
[00:39:0797] [CHECK] Signature
[00:39:0797] [PE] Mapping
[00:39:0797] [PE] Parsing
[00:39:0797] [PE] Dos header -> 0x1ee0000
[00:39:0797] [PE] Nt header (offset : 0xf0) file size 0x23000
[00:39:0797] [PE] pNtHeadersx86 -> 0x1ee00f0
[00:39:0797] [PE] Chars -> 0x210e
[00:39:0797] [PE] Optional header
[00:39:0797] [PE] Sections : 4
[00:39:0797] [PE] Section : 0 - .text
[00:39:0797] [PE] Section : 1 - .data
[00:39:0797] [PE] Section : 2 - .rsrc
[00:39:0797] [PE] Section : 3 - .reloc
[00:39:0797] [PE] File open : 1
[00:39:0797] [PE] Search sigs
[00:39:0813] [PE] Section[0/3] : 0x1ee0400
[00:39:0813] [PE] Init AhoCorasick
[00:39:0813] [PE] Start AhoCorasick
[00:39:0813] [PE] Looking results : 0
[00:39:0813] [PE] Section[1/3] : 0x1f01400
[00:39:0813] [PE] Init AhoCorasick
[00:39:0813] [PE] Start AhoCorasick
[00:39:0813] [PE] Looking results : 0
[00:39:0813] [PE] Section[2/3] : 0x1f01e00
[00:39:0813] [PE] Init AhoCorasick
[00:39:0813] [PE] Start AhoCorasick
[00:39:0813] [PE] Looking results : 0
[00:39:0813] [PE] Section[3/3] : 0x1f02400
[00:39:0813] [PE] Init AhoCorasick
[00:39:0813] [PE] Start AhoCorasick
[00:39:0813] [PE] Looking results : 0
[00:39:0813] [CHECK] Blacklist
[00:39:0813] [CHECK] BlacklistPath
[00:39:0813] [CHECK] BlacklistMD5
[00:39:0813] [CHECK] MadeNumbers
[00:39:0813] [CHECK] HasUnicode
[00:39:0813] [CHECK] SuspPath
[00:39:0813] [CHECK] ProcessResidue
[00:39:0813] [CHECK] Not found!
[00:39:0813] [Check DLLs] netshell.dll : C:\WINDOWS\system32\netshell.dll
[00:39:0813] [CHECK] WhiteDLL
[00:39:0813] [CHECK] Whitelist
[00:39:0813] [CHECK] WellKnown
[00:39:0813] [CHECK] WhitelistPath
[00:39:0813] [CHECK] HijackName
[00:39:0813] [CHECK] Signature
[00:39:0859] [PE] Mapping
[00:39:0859] [PE] Parsing
[00:39:0859] [PE] Dos header -> 0x2350000
[00:39:0859] [PE] Nt header (offset : 0xf0) file size 0x1a0000
[00:39:0859] [PE] pNtHeadersx86 -> 0x23500f0
[00:39:0859] [PE] Chars -> 0x210e
[00:39:0859] [PE] Optional header
[00:39:0875] [PE] Sections : 5
[00:39:0875] [PE] Section : 0 - .text
[00:39:0875] [PE] Section : 1 - .orpc
[00:39:0875] [PE] Section : 2 - .data
[00:39:0875] [PE] Section : 3 - .rsrc
[00:39:0875] [PE] Section : 4 - .reloc
[00:39:0875] [PE] File open : 1
[00:39:0875] [PE] Search sigs
[00:39:0875] [PE] Section[0/4] : 0x2350600
[00:39:0875] [PE] Init AhoCorasick
[00:39:0875] [PE] Start AhoCorasick
[00:39:0875] [PE] Looking results : 0
[00:39:0875] [PE] Section[1/4] : 0x23c2800
[00:39:0875] [PE] Init AhoCorasick
[00:39:0875] [PE] Start AhoCorasick
[00:39:0875] [PE] Looking results : 0
[00:39:0875] [PE] Section[2/4] : 0x23c2a00
[00:39:0875] [PE] Init AhoCorasick
[00:39:0875] [PE] Start AhoCorasick
[00:39:0875] [PE] Looking results : 0
[00:39:0875] [PE] Section[3/4] : 0x23c4c00
[00:39:0875] [PE] Init AhoCorasick
[00:39:0875] [PE] Start AhoCorasick
[00:39:0906] [PE] Looking results : 0
[00:39:0906] [PE] Section[4/4] : 0x24eaa00
[00:39:0906] [PE] Init AhoCorasick
[00:39:0906] [PE] Start AhoCorasick
[00:39:0906] [PE] Looking results : 0
[00:39:0906] [CHECK] Blacklist
[00:39:0906] [CHECK] BlacklistPath
[00:39:0906] [CHECK] BlacklistMD5
[00:39:0906] [CHECK] MadeNumbers
[00:39:0906] [CHECK] HasUnicode
[00:39:0906] [CHECK] SuspPath
[00:39:0906] [CHECK] ProcessResidue
[00:39:0906] [CHECK] Not found!
[00:39:0906] [Check DLLs] credui.dll : C:\WINDOWS\system32\credui.dll
[00:39:0906] [CHECK] WhiteDLL
[00:39:0906] [CHECK] Whitelist
[00:39:0906] [CHECK] WellKnown
[00:39:0906] [CHECK] WhitelistPath
[00:39:0906] [CHECK] HijackName
[00:39:0906] [CHECK] Signature
[00:39:0906] [PE] Mapping
[00:39:0906] [PE] Parsing
[00:39:0906] [PE] Dos header -> 0x1ee0000
[00:39:0906] [PE] Nt header (offset : 0xe0) file size 0x28000
[00:39:0906] [PE] pNtHeadersx86 -> 0x1ee00e0
[00:39:0906] [PE] Chars -> 0x210e
[00:39:0906] [PE] Optional header
[00:39:0906] [PE] Sections : 4
[00:39:0906] [PE] Section : 0 - .text
[00:39:0906] [PE] Section : 1 - .data
[00:39:0906] [PE] Section : 2 - .rsrc
[00:39:0906] [PE] Section : 3 - .reloc
[00:39:0906] [PE] File open : 1
[00:39:0906] [PE] Search sigs
[00:39:0906] [PE] Section[0/3] : 0x1ee0400
[00:39:0906] [PE] Init AhoCorasick
[00:39:0906] [PE] Start AhoCorasick
[00:39:0922] [PE] Looking results : 0
[00:39:0922] [PE] Section[1/3] : 0x1eeea00
[00:39:0922] [PE] Init AhoCorasick
[00:39:0922] [PE] Start AhoCorasick
[00:39:0922] [PE] Looking results : 0
[00:39:0922] [PE] Section[2/3] : 0x1eef000
[00:39:0922] [PE] Init AhoCorasick
[00:39:0922] [PE] Start AhoCorasick
[00:39:0922] [PE] Looking results : 0
[00:39:0922] [PE] Section[3/3] : 0x1f06c00
[00:39:0922] [PE] Init AhoCorasick
[00:39:0922] [PE] Start AhoCorasick
[00:39:0922] [PE] Looking results : 0
[00:39:0922] [CHECK] Blacklist
[00:39:0922] [CHECK] BlacklistPath
[00:39:0922] [CHECK] BlacklistMD5
[00:39:0922] [CHECK] MadeNumbers
[00:39:0922] [CHECK] HasUnicode
[00:39:0922] [CHECK] SuspPath
[00:39:0922] [CHECK] ProcessResidue
[00:39:0922] [CHECK] Not found!
[00:39:0922] [Check DLLs] dot3api.dll : C:\WINDOWS\system32\dot3api.dll
[00:39:0922] [CHECK] WhiteDLL
[00:39:0922] [CHECK] Whitelist
[00:39:0922] [CHECK] WellKnown
[00:39:0922] [CHECK] WhitelistPath
[00:39:0922] [CHECK] HijackName
[00:39:0922] [CHECK] Signature
[00:39:0922] [PE] Mapping
[00:39:0922] [PE] Parsing
[00:39:0922] [PE] Dos header -> 0x1e50000
[00:39:0922] [PE] Nt header (offset : 0xe8) file size 0x6600
[00:39:0922] [PE] pNtHeadersx86 -> 0x1e500e8
[00:39:0922] [PE] Chars -> 0x210e
[00:39:0922] [PE] Optional header
[00:39:0922] [PE] Sections : 4
[00:39:0922] [PE] Section : 0 - .text
[00:39:0922] [PE] Section : 1 - .data
[00:39:0922] [PE] Section : 2 - .rsrc
[00:39:0922] [PE] Section : 3 - .reloc
[00:39:0922] [PE] File open : 1
[00:39:0922] [PE] Search sigs
[00:39:0922] [PE] Section[0/3] : 0x1e50400
[00:39:0922] [PE] Init AhoCorasick
[00:39:0922] [PE] Start AhoCorasick
[00:39:0922] [PE] Looking results : 0
[00:39:0922] [PE] Section[1/3] : 0x1e55600
[00:39:0922] [PE] Init AhoCorasick
[00:39:0922] [PE] Start AhoCorasick
[00:39:0922] [PE] Looking results : 0
[00:39:0922] [PE] Section[2/3] : 0x1e55800
[00:39:0938] [PE] Init AhoCorasick
[00:39:0938] [PE] Start AhoCorasick
[00:39:0938] [PE] Looking results : 0
[00:39:0938] [PE] Section[3/3] : 0x1e56000
[00:39:0938] [PE] Init AhoCorasick
[00:39:0938] [PE] Start AhoCorasick
[00:39:0938] [PE] Looking results : 0
[00:39:0938] [CHECK] Blacklist
[00:39:0938] [CHECK] BlacklistPath
[00:39:0938] [CHECK] BlacklistMD5
[00:39:0938] [CHECK] MadeNumbers
[00:39:0938] [CHECK] HasUnicode
[00:39:0938] [CHECK] SuspPath
[00:39:0938] [CHECK] ProcessResidue
[00:39:0938] [CHECK] Not found!
[00:39:0938] [Check DLLs] dot3dlg.dll : C:\WINDOWS\system32\dot3dlg.dll
[00:39:0938] [CHECK] WhiteDLL
[00:39:0938] [CHECK] Whitelist
[00:39:0938] [CHECK] WellKnown
[00:39:0938] [CHECK] WhitelistPath
[00:39:0938] [CHECK] HijackName
[00:39:0938] [CHECK] Signature
[00:39:0938] [PE] Mapping
[00:39:0938] [PE] Parsing
[00:39:0938] [PE] Dos header -> 0x1e50000
[00:39:0938] [PE] Nt header (offset : 0xe0) file size 0x2400
[00:39:0938] [PE] pNtHeadersx86 -> 0x1e500e0
[00:39:0938] [PE] Chars -> 0x210e
[00:39:0938] [PE] Optional header
[00:39:0938] [PE] Sections : 4
[00:39:0938] [PE] Section : 0 - .text
[00:39:0938] [PE] Section : 1 - .data
[00:39:0938] [PE] Section : 2 - .rsrc
[00:39:0938] [PE] Section : 3 - .reloc
[00:39:0938] [PE] File open : 1
[00:39:0938] [PE] Search sigs
[00:39:0938] [PE] Section[0/3] : 0x1e50400
[00:39:0938] [PE] Init AhoCorasick
[00:39:0938] [PE] Start AhoCorasick
[00:39:0938] [PE] Looking results : 0
[00:39:0938] [PE] Section[1/3] : 0x1e51a00
[00:39:0938] [PE] Init AhoCorasick
[00:39:0938] [PE] Start AhoCorasick
[00:39:0938] [PE] Looking results : 0
[00:39:0938] [PE] Section[2/3] : 0x1e51c00
[00:39:0938] [PE] Init AhoCorasick
[00:39:0938] [PE] Start AhoCorasick
[00:39:0938] [PE] Looking results : 0
[00:39:0938] [PE] Section[3/3] : 0x1e52200
[00:39:0938] [PE] Init AhoCorasick
[00:39:0938] [PE] Start AhoCorasick
[00:39:0938] [PE] Looking results : 0
[00:39:0938] [CHECK] Blacklist
[00:39:0938] [CHECK] BlacklistPath
[00:39:0938] [CHECK] BlacklistMD5
[00:39:0938] [CHECK] MadeNumbers
[00:39:0938] [CHECK] HasUnicode
[00:39:0938] [CHECK] SuspPath
[00:39:0938] [CHECK] ProcessResidue
[00:39:0938] [CHECK] Not found!
[00:39:0938] [Check DLLs] OneX.DLL : C:\WINDOWS\system32\OneX.DLL
[00:39:0938] [CHECK] WhiteDLL
[00:39:0938] [CHECK] Whitelist
[00:39:0938] [CHECK] WellKnown
[00:39:0953] [CHECK] WhitelistPath
[00:39:0953] [CHECK] HijackName
[00:39:0953] [CHECK] Signature
[00:40:0000] [PE] Mapping
[00:40:0000] [PE] Parsing
[00:40:0000] [PE] Dos header -> 0x16d0000
[00:40:0000] [PE] Nt header (offset : 0xe0) file size 0x23400
[00:40:0000] [PE] pNtHeadersx86 -> 0x16d00e0
[00:40:0000] [PE] Chars -> 0x210e
[00:40:0000] [PE] Optional header
[00:40:0000] [PE] Sections : 4
[00:40:0000] [PE] Section : 0 - .text
[00:40:0000] [PE] Section : 1 - .data
[00:40:0000] [PE] Section : 2 - .rsrc
[00:40:0000] [PE] Section : 3 - .reloc
[00:40:0000] [PE] File open : 1
[00:40:0000] [PE] Search sigs
[00:40:0000] [PE] Section[0/3] : 0x16d0400
[00:40:0000] [PE] Init AhoCorasick
[00:40:0000] [PE] Start AhoCorasick
[00:40:0000] [PE] Looking results : 0
[00:40:0000] [PE] Section[1/3] : 0x16eb400
[00:40:0000] [PE] Init AhoCorasick
[00:40:0000] [PE] Start AhoCorasick
[00:40:0000] [PE] Looking results : 0
[00:40:0000] [PE] Section[2/3] : 0x16eb800
[00:40:0000] [PE] Init AhoCorasick
[00:40:0000] [PE] Start AhoCorasick
[00:40:0000] [PE] Looking results : 0
[00:40:0000] [PE] Section[3/3] : 0x16f2200
[00:40:0000] [PE] Init AhoCorasick
[00:40:0000] [PE] Start AhoCorasick
[00:40:0000] [PE] Looking results : 0
[00:40:0000] [CHECK] Blacklist
[00:40:0000] [CHECK] BlacklistPath
[00:40:0000] [CHECK] BlacklistMD5
[00:40:0000] [CHECK] MadeNumbers
[00:40:0000] [CHECK] HasUnicode
[00:40:0000] [CHECK] SuspPath
[00:40:0000] [CHECK] ProcessResidue
[00:40:0000] [CHECK] Not found!
[00:40:0000] [Check DLLs] WTSAPI32.dll : C:\WINDOWS\system32\WTSAPI32.dll
[00:40:0000] [CHECK] WhiteDLL
[00:40:0000] [CHECK] Whitelist
[00:40:0000] [CHECK] WellKnown
[00:40:0000] [CHECK] WhitelistPath
[00:40:0000] [CHECK] HijackName
[00:40:0000] [CHECK] Signature
[00:40:0063] [PE] Mapping
[00:40:0063] [PE] Parsing
[00:40:0063] [PE] Dos header -> 0x16d0000
[00:40:0063] [PE] Nt header (offset : 0xe8) file size 0x4800
[00:40:0063] [PE] pNtHeadersx86 -> 0x16d00e8
[00:40:0063] [PE] Chars -> 0x210e
[00:40:0063] [PE] Optional header
[00:40:0063] [PE] Sections : 4
[00:40:0063] [PE] Section : 0 - .text
[00:40:0063] [PE] Section : 1 - .data
[00:40:0063] [PE] Section : 2 - .rsrc
[00:40:0063] [PE] Section : 3 - .reloc
[00:40:0063] [PE] File open : 1
[00:40:0063] [PE] Search sigs
[00:40:0063] [PE] Section[0/3] : 0x16d0400
[00:40:0063] [PE] Init AhoCorasick
[00:40:0063] [PE] Start AhoCorasick
[00:40:0063] [PE] Looking results : 0
[00:40:0063] [PE] Section[1/3] : 0x16d3c00
[00:40:0063] [PE] Init AhoCorasick
[00:40:0063] [PE] Start AhoCorasick
[00:40:0063] [PE] Looking results : 0
[00:40:0063] [PE] Section[2/3] : 0x16d3e00
[00:40:0063] [PE] Init AhoCorasick
[00:40:0063] [PE] Start AhoCorasick
[00:40:0063] [PE] Looking results : 0
[00:40:0063] [PE] Section[3/3] : 0x16d4400
[00:40:0063] [PE] Init AhoCorasick
[00:40:0063] [PE] Start AhoCorasick
[00:40:0063] [PE] Looking results : 0
[00:40:0063] [CHECK] Blacklist
[00:40:0063] [CHECK] BlacklistPath
[00:40:0063] [CHECK] BlacklistMD5
[00:40:0063] [CHECK] MadeNumbers
[00:40:0078] [CHECK] HasUnicode
[00:40:0078] [CHECK] SuspPath
[00:40:0078] [CHECK] ProcessResidue
[00:40:0078] [CHECK] Not found!
[00:40:0078] [Check DLLs] WINSTA.dll : C:\WINDOWS\system32\WINSTA.dll
[00:40:0078] [CHECK] WhiteDLL
[00:40:0078] [CHECK] Whitelist
[00:40:0078] [CHECK] WellKnown
[00:40:0078] [CHECK] WhitelistPath
[00:40:0078] [CHECK] HijackName
[00:40:0078] [CHECK] Signature
[00:40:0078] [PE] Mapping
[00:40:0078] [PE] Parsing
[00:40:0078] [PE] Dos header -> 0x16d0000
[00:40:0078] [PE] Nt header (offset : 0xe8) file size 0xd200
[00:40:0078] [PE] pNtHeadersx86 -> 0x16d00e8
[00:40:0078] [PE] Chars -> 0x210e
[00:40:0078] [PE] Optional header
[00:40:0078] [PE] Sections : 4
[00:40:0078] [PE] Section : 0 - .text
[00:40:0078] [PE] Section : 1 - .data
[00:40:0078] [PE] Section : 2 - .rsrc
[00:40:0078] [PE] Section : 3 - .reloc
[00:40:0078] [PE] File open : 1
[00:40:0078] [PE] Search sigs
[00:40:0078] [PE] Section[0/3] : 0x16d0400
[00:40:0078] [PE] Init AhoCorasick
[00:40:0078] [PE] Start AhoCorasick
[00:40:0078] [PE] Looking results : 0
[00:40:0078] [PE] Section[1/3] : 0x16dc200
[00:40:0078] [PE] Init AhoCorasick
[00:40:0078] [PE] Start AhoCorasick
[00:40:0078] [PE] Looking results : 0
[00:40:0078] [PE] Section[2/3] : 0x16dc400
[00:40:0078] [PE] Init AhoCorasick
[00:40:0078] [PE] Start AhoCorasick
[00:40:0078] [PE] Looking results : 0
[00:40:0078] [PE] Section[3/3] : 0x16dc800
[00:40:0078] [PE] Init AhoCorasick
[00:40:0078] [PE] Start AhoCorasick
[00:40:0078] [PE] Looking results : 0
[00:40:0078] [CHECK] Blacklist
[00:40:0078] [CHECK] BlacklistPath
[00:40:0078] [CHECK] BlacklistMD5
[00:40:0078] [CHECK] MadeNumbers
[00:40:0078] [CHECK] HasUnicode
[00:40:0078] [CHECK] SuspPath
[00:40:0078] [CHECK] ProcessResidue
[00:40:0078] [CHECK] Not found!
[00:40:0078] [Check DLLs] eappcfg.dll : C:\WINDOWS\system32\eappcfg.dll
[00:40:0078] [CHECK] WhiteDLL
[00:40:0078] [CHECK] Whitelist
[00:40:0094] [CHECK] WellKnown
[00:40:0094] [CHECK] WhitelistPath
[00:40:0094] [CHECK] HijackName
[00:40:0094] [CHECK] Signature
[00:40:0094] [PE] Mapping
[00:40:0094] [PE] Parsing
[00:40:0094] [PE] Dos header -> 0x16d0000
[00:40:0094] [PE] Nt header (offset : 0xe8) file size 0x1f000
[00:40:0094] [PE] pNtHeadersx86 -> 0x16d00e8
[00:40:0094] [PE] Chars -> 0x210e
[00:40:0094] [PE] Optional header
[00:40:0094] [PE] Sections : 4
[00:40:0094] [PE] Section : 0 - .text
[00:40:0094] [PE] Section : 1 - .data
[00:40:0094] [PE] Section : 2 - .rsrc
[00:40:0094] [PE] Section : 3 - .reloc
[00:40:0094] [PE] File open : 1
[00:40:0094] [PE] Search sigs
[00:40:0094] [PE] Section[0/3] : 0x16d0400
[00:40:0094] [PE] Init AhoCorasick
[00:40:0094] [PE] Start AhoCorasick
[00:40:0094] [PE] Looking results : 0
[00:40:0094] [PE] Section[1/3] : 0x16eb400
[00:40:0094] [PE] Init AhoCorasick
[00:40:0094] [PE] Start AhoCorasick
[00:40:0094] [PE] Looking results : 0
[00:40:0094] [PE] Section[2/3] : 0x16ec200
[00:40:0094] [PE] Init AhoCorasick
[00:40:0094] [PE] Start AhoCorasick
[00:40:0094] [PE] Looking results : 0
[00:40:0094] [PE] Section[3/3] : 0x16ec800
[00:40:0094] [PE] Init AhoCorasick
[00:40:0094] [PE] Start AhoCorasick
[00:40:0094] [PE] Looking results : 0
[00:40:0094] [CHECK] Blacklist
[00:40:0094] [CHECK] BlacklistPath
[00:40:0094] [CHECK] BlacklistMD5
[00:40:0094] [CHECK] MadeNumbers
[00:40:0094] [CHECK] HasUnicode
[00:40:0094] [CHECK] SuspPath
[00:40:0094] [CHECK] ProcessResidue
[00:40:0094] [CHECK] Not found!
[00:40:0094] [Check DLLs] MSVCP60.dll : C:\WINDOWS\system32\MSVCP60.dll
[00:40:0094] [CHECK] WhiteDLL
[00:40:0094] [Check DLLs] eappprxy.dll : C:\WINDOWS\system32\eappprxy.dll
[00:40:0109] [CHECK] WhiteDLL
[00:40:0109] [CHECK] Whitelist
[00:40:0109] [CHECK] WellKnown
[00:40:0109] [CHECK] WhitelistPath
[00:40:0109] [CHECK] HijackName
[00:40:0109] [CHECK] Signature
[00:40:0109] [PE] Mapping
[00:40:0109] [PE] Parsing
[00:40:0109] [PE] Dos header -> 0x16d0000
[00:40:0109] [PE] Nt header (offset : 0xf8) file size 0xa000
[00:40:0109] [PE] pNtHeadersx86 -> 0x16d00f8
[00:40:0109] [PE] Chars -> 0x210e
[00:40:0109] [PE] Optional header
[00:40:0109] [PE] Sections : 4
[00:40:0109] [PE] Section : 0 - .text
[00:40:0109] [PE] Section : 1 - .data
[00:40:0109] [PE] Section : 2 - .rsrc
[00:40:0109] [PE] Section : 3 - .reloc
[00:40:0109] [PE] File open : 1
[00:40:0109] [PE] Search sigs
[00:40:0109] [PE] Section[0/3] : 0x16d0400
[00:40:0109] [PE] Init AhoCorasick
[00:40:0109] [PE] Start AhoCorasick
[00:40:0109] [PE] Looking results : 0
[00:40:0109] [PE] Section[1/3] : 0x16d7a00
[00:40:0109] [PE] Init AhoCorasick
[00:40:0109] [PE] Start AhoCorasick
[00:40:0109] [PE] Looking results : 0
[00:40:0109] [PE] Section[2/3] : 0x16d8600
[00:40:0109] [PE] Init AhoCorasick
[00:40:0109] [PE] Start AhoCorasick
[00:40:0109] [PE] Looking results : 0
[00:40:0109] [PE] Section[3/3] : 0x16d8c00
[00:40:0109] [PE] Init AhoCorasick
[00:40:0109] [PE] Start AhoCorasick
[00:40:0109] [PE] Looking results : 0
[00:40:0109] [CHECK] Blacklist
[00:40:0109] [CHECK] BlacklistPath
[00:40:0109] [CHECK] BlacklistMD5
[00:40:0109] [CHECK] MadeNumbers
[00:40:0109] [CHECK] HasUnicode
[00:40:0109] [CHECK] SuspPath
[00:40:0109] [CHECK] ProcessResidue
[00:40:0109] [CHECK] Not found!
[00:40:0109] [Check DLLs] WZCSAPI.DLL : C:\WINDOWS\system32\WZCSAPI.DLL
[00:40:0109] [CHECK] WhiteDLL
[00:40:0109] [CHECK] Whitelist
[00:40:0109] [CHECK] WellKnown
[00:40:0109] [CHECK] WhitelistPath
[00:40:0109] [CHECK] HijackName
[00:40:0109] [CHECK] Signature
[00:40:0125] [PE] Mapping
[00:40:0125] [PE] Parsing
[00:40:0125] [PE] Dos header -> 0x16d0000
[00:40:0125] [PE] Nt header (offset : 0xf0) file size 0xce00
[00:40:0125] [PE] pNtHeadersx86 -> 0x16d00f0
[00:40:0125] [PE] Chars -> 0x210e
[00:40:0125] [PE] Optional header
[00:40:0125] [PE] Sections : 4
[00:40:0125] [PE] Section : 0 - .text
[00:40:0125] [PE] Section : 1 - .data
[00:40:0125] [PE] Section : 2 - .rsrc
[00:40:0125] [PE] Section : 3 - .reloc
[00:40:0125] [PE] File open : 1
[00:40:0125] [PE] Search sigs
[00:40:0125] [PE] Section[0/3] : 0x16d0400
[00:40:0125] [PE] Init AhoCorasick
[00:40:0125] [PE] Start AhoCorasick
[00:40:0125] [PE] Looking results : 0
[00:40:0125] [PE] Section[1/3] : 0x16dba00
[00:40:0125] [PE] Init AhoCorasick
[00:40:0125] [PE] Start AhoCorasick
[00:40:0125] [PE] Looking results : 0
[00:40:0125] [PE] Section[2/3] : 0x16dc000
[00:40:0141] [PE] Init AhoCorasick
[00:40:0141] [PE] Start AhoCorasick
[00:40:0141] [PE] Looking results : 0
[00:40:0141] [PE] Section[3/3] : 0x16dc600
[00:40:0141] [PE] Init AhoCorasick
[00:40:0141] [PE] Start AhoCorasick
[00:40:0141] [PE] Looking results : 0
[00:40:0141] [CHECK] Blacklist
[00:40:0141] [CHECK] BlacklistPath
[00:40:0141] [CHECK] BlacklistMD5
[00:40:0141] [CHECK] MadeNumbers
[00:40:0141] [CHECK] HasUnicode
[00:40:0141] [CHECK] SuspPath
[00:40:0141] [CHECK] ProcessResidue
[00:40:0141] [CHECK] Not found!
[00:40:0141] [Check DLLs] WZCSvc.DLL : C:\WINDOWS\system32\WZCSvc.DLL
[00:40:0141] [CHECK] WhiteDLL
[00:40:0141] [CHECK] Whitelist
[00:40:0141] [CHECK] WellKnown
[00:40:0141] [CHECK] WhitelistPath
[00:40:0141] [CHECK] HijackName
[00:40:0141] [CHECK] Signature
[00:40:0156] [PE] Mapping
[00:40:0156] [PE] Parsing
[00:40:0156] [PE] Dos header -> 0x16d0000
[00:40:0156] [PE] Nt header (offset : 0xe0) file size 0x76200
[00:40:0156] [PE] pNtHeadersx86 -> 0x16d00e0
[00:40:0156] [PE] Chars -> 0x210e
[00:40:0156] [PE] Optional header
[00:40:0156] [PE] Sections : 4
[00:40:0156] [PE] Section : 0 - .text
[00:40:0156] [PE] Section : 1 - .data
[00:40:0156] [PE] Section : 2 - .rsrc
[00:40:0156] [PE] Section : 3 - .reloc
[00:40:0172] [PE] File open : 1
[00:40:0172] [PE] Search sigs
[00:40:0172] [PE] Section[0/3] : 0x16d0600
[00:40:0172] [PE] Init AhoCorasick
[00:40:0172] [PE] Start AhoCorasick
[00:40:0172] [PE] Looking results : 0
[00:40:0172] [PE] Section[1/3] : 0x173a600
[00:40:0172] [PE] Init AhoCorasick
[00:40:0172] [PE] Start AhoCorasick
[00:40:0172] [PE] Looking results : 0
[00:40:0172] [PE] Section[2/3] : 0x173ae00
[00:40:0172] [PE] Init AhoCorasick
[00:40:0172] [PE] Start AhoCorasick
[00:40:0172] [PE] Looking results : 0
[00:40:0172] [PE] Section[3/3] : 0x1740c00
[00:40:0172] [PE] Init AhoCorasick
[00:40:0172] [PE] Start AhoCorasick
[00:40:0172] [PE] Looking results : 0
[00:40:0172] [CHECK] Blacklist
[00:40:0172] [CHECK] BlacklistPath
[00:40:0172] [CHECK] BlacklistMD5
[00:40:0172] [CHECK] MadeNumbers
[00:40:0172] [CHECK] HasUnicode
[00:40:0172] [CHECK] SuspPath
[00:40:0172] [CHECK] ProcessResidue
[00:40:0188] [CHECK] Not found!
[00:40:0188] [Check DLLs] WMI.dll : C:\WINDOWS\system32\WMI.dll
[00:40:0188] [CHECK] WhiteDLL
[00:40:0188] [CHECK] Whitelist
[00:40:0188] [CHECK] WellKnown
[00:40:0188] [CHECK] WhitelistPath
[00:40:0188] [CHECK] HijackName
[00:40:0188] [CHECK] Signature
[00:40:0188] [PE] Mapping
[00:40:0188] [PE] Parsing
[00:40:0188] [PE] Dos header -> 0x16d0000
[00:40:0188] [PE] Nt header (offset : 0xc0) file size 0x1600
[00:40:0188] [PE] pNtHeadersx86 -> 0x16d00c0
[00:40:0188] [PE] Chars -> 0x210e
[00:40:0188] [PE] Optional header
[00:40:0188] [PE] Sections : 3
[00:40:0188] [PE] Section : 0 - .text
[00:40:0188] [PE] Section : 1 - .rsrc
[00:40:0188] [PE] Section : 2 - .reloc
[00:40:0188] [PE] File open : 1
[00:40:0188] [PE] Search sigs
[00:40:0188] [PE] Section[0/2] : 0x16d0400
[00:40:0188] [PE] Init AhoCorasick
[00:40:0188] [PE] Start AhoCorasick
[00:40:0188] [PE] Looking results : 0
[00:40:0188] [PE] Section[1/2] : 0x16d1000
[00:40:0188] [PE] Init AhoCorasick
[00:40:0188] [PE] Start AhoCorasick
[00:40:0188] [PE] Looking results : 0
[00:40:0188] [PE] Section[2/2] : 0x16d1400
[00:40:0188] [PE] Init AhoCorasick
[00:40:0188] [PE] Start AhoCorasick
[00:40:0188] [PE] Looking results : 0
