Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- --------------------------------------------------------------------------------
- Starting profile on 15-02-25 at 12:58:05
- Operating System: Microsoft Windows 98 (32-bit), version 4.10.2222 A (Second Edition)
- Program Executable: c:\windows\WELCOME.EXE
- Program Arguments:
- Starting Directory: C:\WINDOWS\
- Search Path: C:\WINDOWS;C:\WINDOWS\COMMAND
- Options Selected:
- Simulate ShellExecute by inserting any App Paths directories into the PATH environment variable.
- Log DllMain calls for process attach and process detach messages.
- Log DllMain calls for all other messages, including thread attach and thread detach.
- Hook the process to gather more detailed dependency information.
- Log LoadLibrary function calls.
- Log GetProcAddress function calls.
- Log thread information.
- Use simple thread numbers instead of actual thread IDs.
- Log first chance exceptions.
- Log debug output messages.
- Use full paths when logging file names.
- Log a time stamp with each line of log.
- Automatically open and profile child processes.
- --------------------------------------------------------------------------------
- 00:00:00.000: Started "c:\windows\WELCOME.EXE" (process 0xFFFD942B) at address 0x00400000 by thread 1. Successfully hooked module.
- 00:00:00.007: Loaded "c:\windows\system\WINMM.DLL" at address 0xBFDF0000 by thread 1. Shared module not hooked.
- 00:00:00.009: Loaded "c:\windows\system\COMCTL32.DLL" at address 0xBFE90000 by thread 1. Shared module not hooked.
- 00:00:00.013: Loaded "c:\windows\system\SHLWAPI.DLL" at address 0x70BD0000 by thread 1. Successfully hooked module.
- 00:00:00.018: Loaded "c:\windows\system\SHELL32.DLL" at address 0x7FCB0000 by thread 1. Successfully hooked module.
- 00:00:00.020: Loaded "c:\windows\system\ADVAPI32.DLL" at address 0xBFE80000 by thread 1. Shared module not hooked.
- 00:00:00.026: Loaded "c:\windows\system\GDI32.DLL" at address 0xBFF20000 by thread 1. Shared module not hooked.
- 00:00:00.028: Loaded "c:\windows\system\USER32.DLL" at address 0xBFF50000 by thread 1. Shared module not hooked.
- 00:00:00.417: Loaded "c:\windows\system\KERNEL32.DLL" at address 0xBFF70000 by thread 1. Shared module not hooked.
- 00:00:00.417: Entrypoint reached. All implicit modules have been loaded.
- 00:00:00.421: Injected "c:\windows\pulpit\depends22_x86\DEPENDS.DLL" at address 0x08370000 by thread 1.
- 00:00:00.422: DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\pulpit\depends22_x86\DEPENDS.DLL" called by thread 1.
- 00:00:00.429: DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\pulpit\depends22_x86\DEPENDS.DLL" returned 1 (0x1) by thread 1.
- 00:00:00.906: DllMain(0x70BD0000, DLL_PROCESS_ATTACH, 0x00000001) in "c:\windows\system\SHLWAPI.DLL" called by thread 1.
- 00:00:00.907: DllMain(0x70BD0000, DLL_PROCESS_ATTACH, 0x00000001) in "c:\windows\system\SHLWAPI.DLL" returned 1 (0x1) by thread 1.
- 00:00:00.912: DllMain(0x7FCB0000, DLL_PROCESS_ATTACH, 0x00000001) in "c:\windows\system\SHELL32.DLL" called by thread 1.
- 00:00:00.916: DllMain(0x7FCB0000, DLL_PROCESS_ATTACH, 0x00000001) in "c:\windows\system\SHELL32.DLL" returned 1 (0x1) by thread 1.
- 00:00:00.922: GetProcAddress(0xBFF70000 [c:\windows\system\KERNEL32.DLL], "IsProcessorFeaturePresent") called from "c:\windows\WELCOME.EXE" at address 0x0040766B and returned 0x835E5A18 by thread 1.
- 00:00:00.941: Thread 2 started in "c:\windows\system\WINMM.DLL" at address 0xBFDF3547.
- 00:00:00.943: DllMain(0x7FCB0000, DLL_THREAD_ATTACH, 0x00000000) in "c:\windows\system\SHELL32.DLL" called by thread 2.
- 00:00:00.944: DllMain(0x7FCB0000, DLL_THREAD_ATTACH, 0x00000000) in "c:\windows\system\SHELL32.DLL" returned 1 (0x1) by thread 2.
- 00:00:01.039: Loaded "c:\windows\system\MSACM32.DLL" at address 0x7B680000 by thread 1. Successfully hooked module.
- 00:00:01.053: DllMain(0x7B680000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\system\MSACM32.DLL" called by thread 1.
- 00:00:01.056: LoadLibraryA("WINMM") called from "c:\windows\system\MSACM32.DLL" at address 0x7B683DEB by thread 1.
- 00:00:01.059: LoadLibraryA("WINMM") returned 0xBFDF0000 by thread 1.
- 00:00:01.071: DllMain(0x7B680000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\system\MSACM32.DLL" returned 1 (0x1) by thread 1.
- 00:00:01.087: Loaded "c:\windows\system\MSADP32.ACM" at address 0x75C10000 by thread 1. Successfully hooked module.
- 00:00:09.907: Thread 2 exited with code -1 (0xFFFFFFFF).
- 00:00:09.909: DllMain(0x7B680000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\system\MSACM32.DLL" called by thread 1.
- 00:00:09.911: DllMain(0x7B680000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\system\MSACM32.DLL" returned 1 (0x1) by thread 1.
- 00:00:09.913: DllMain(0x7FCB0000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\system\SHELL32.DLL" called by thread 1.
- 00:00:09.915: DllMain(0x7FCB0000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\system\SHELL32.DLL" returned 1 (0x1) by thread 1.
- 00:00:09.916: DllMain(0x70BD0000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\system\SHLWAPI.DLL" called by thread 1.
- 00:00:09.918: DllMain(0x70BD0000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\system\SHLWAPI.DLL" returned 1 (0x1) by thread 1.
- 00:00:09.920: DllMain(0x08370000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\pulpit\depends22_x86\DEPENDS.DLL" called by thread 1.
- 00:00:09.922: DllMain(0x08370000, DLL_PROCESS_DETACH, 0x00000001) in "c:\windows\pulpit\depends22_x86\DEPENDS.DLL" returned 1 (0x1) by thread 1.
- 00:00:09.923: Exited "c:\windows\WELCOME.EXE" (process 0xFFFD942B) with code 0 (0x0) by thread 1.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement