samegin
Newbie | Редактировать | Профиль | Сообщение | ICQ | Цитировать | Сообщить модератору
Log data
Address Message
OllyDbg v2.01 (preliminary version - under development!)
Attached to 'C:\Инструменты\Soft\USDownloader135\USDownloader.exe'
New process (ID 00000DF8) created
Main thread (ID 00000DFC) created
7C8106E9 New thread 2. (ID 00000E00) created
00400000 Module C:\Инструменты\Soft\USDownloader135\USDownloader.exe
Probably SFX file, code area extended to cover SFX placeholder 'UPX0'
Code sections 'UPX0' and 'UPX1' will be merged to a single memory block
00340000 Module C:\WINDOWS\system32\Normaliz.dll
010B0000 Module C:\Инструменты\Soft\USDownloader135\plugins\Rapidfilefr.plg
Probably SFX file, code area extended to cover SFX placeholder 'UPX0'
Code sections 'UPX0' and 'UPX1' will be merged to a single memory block
011D0000 Module C:\Инструменты\Soft\USDownloader135\plugins\RapidShare.plg
Probably SFX file, code area extended to cover SFX placeholder 'UPX0'
Code sections 'UPX0' and 'UPX1' will be merged to a single memory block
012F0000 Module C:\Инструменты\Soft\USDownloader135\plugins\RapidShareCom.plg
Probably SFX file, code area extended to cover SFX placeholder 'UPX0'
Code sections 'UPX0' and 'UPX1' will be merged to a single memory block
01410000 Module C:\Инструменты\Soft\USDownloader135\plugins\RapidSharkPl.plg
Probably SFX file, code area extended to cover SFX placeholder 'UPX0'
Code sections 'UPX0' and 'UPX1' will be merged to a single memory block
01530000 Module C:\Инструменты\Soft\USDownloader135\plugins\RapidSpread.plg
Probably SFX file, code area extended to cover SFX placeholder 'UPX0'
Code sections 'UPX0' and 'UPX1' will be merged to a single memory block
01650000 Module C:\Инструменты\Soft\USDownloader135\plugins\RapidUpload.plg
Probably SFX file, code area extended to cover SFX placeholder 'UPX0'
Code sections 'UPX0' and 'UPX1' will be merged to a single memory block
10000000 Module c:\progra~1\agnitum\outpos~1\wl_hook.dll
1A400000 Module C:\WINDOWS\system32\urlmon.dll
Code size in header is 000C6A00, extended to end of section '.orpc'
Code sections '.text' and '.orpc' will be merged to a single memory block
5B260000 Module C:\WINDOWS\system32\uxtheme.dll
5DCA0000 Module C:\WINDOWS\system32\iertutil.dll
63000000 Module C:\WINDOWS\system32\wininet.dll
71A80000 Module C:\WINDOWS\system32\WS2HELP.dll
71A90000 Module C:\WINDOWS\system32\ws2_32.dll
71B00000 Module C:\WINDOWS\system32\mpr.dll
72FC0000 Module C:\WINDOWS\system32\winspool.drv
746E0000 Module C:\WINDOWS\system32\MSCTF.dll
75310000 Module C:\WINDOWS\system32\msctfime.ime
76360000 Module C:\WINDOWS\system32\IMM32.DLL
76380000 Module C:\WINDOWS\system32\comdlg32.dll
76B20000 Module C:\WINDOWS\system32\winmm.dll
77110000 Module C:\WINDOWS\system32\oleaut32.dll
773C0000 Module C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
774D0000 Module C:\WINDOWS\system32\ole32.dll
Code sections '.text' and '.orpc' will be merged to a single memory block
77C00000 Module C:\WINDOWS\system32\msvcrt.dll
77DC0000 Module C:\WINDOWS\system32\advapi32.dll
77E70000 Module C:\WINDOWS\system32\RPCRT4.dll
Code sections '.text' and '.orpc' will be merged to a single memory block
77F10000 Module C:\WINDOWS\system32\GDI32.dll
77F60000 Module C:\WINDOWS\system32\SHLWAPI.dll
77FE0000 Module C:\WINDOWS\system32\Secur32.dll
7C800000 Module C:\WINDOWS\system32\kernel32.dll
7C900000 Module C:\WINDOWS\system32\ntdll.dll
7C9C0000 Module C:\WINDOWS\system32\SHELL32.dll
7E360000 Module C:\WINDOWS\system32\USER32.dll
Analysing USDownloader
9219 fuzzy procedures
2590 calls to known, 11732 calls to guessed functions
516 switches, 1859 loops
Thread 2. (ID 00000E00) terminated, exit code 0
7C8106E9 New thread 3. (ID 00000CA4) created
71A30000 Module C:\WINDOWS\System32\mswsock.dll
Code sections '.text' and 'SANONTCP' will be merged to a single memory block
71AB0000 Module C:\WINDOWS\system32\wsock32.dll
76D50000 Module C:\WINDOWS\system32\iphlpapi.dll
76F10000 Module C:\WINDOWS\system32\DNSAPI.dll
76F50000 Module C:\WINDOWS\system32\WLDAP32.dll
76FA0000 Module C:\WINDOWS\System32\winrnr.dll
76FB0000 Module C:\WINDOWS\system32\rasadhlp.dll
7C812AEB Exception 0EEDFADE - exception is non-continuable
00E5A608 Access violation when writing to [00000000] - Shift+Run/Step to pass exception to the program
|
Всего записей: 20 | Зарегистр. 23-03-2009 | Отправлено: 21:34 12-05-2011 | Исправлено: samegin, 21:35 12-05-2011 |
|
