Volatility never finishes on 8 gig Win7SP1x64 - Vol-users

Andrew Case

1 Mar 1 Mar

4:01 p.m.

Hello, Which tool and version was used to acquire memory? Certain tools have issues with the machines at and above the 8GB limit. Thanks, Andrew (@attrc) On 3/1/2014 10:55 AM, Smelkovs, Konrads (London) wrote:

...

Hello, C:\ >volatility-2.3.1.standalone.exe -f C:\image.raw kdbgscan --profile=Win7SP1x64 Volatility Foundation Volatility Framework 2.3.1 ..... Never finishes - analysing 8 gig dump, CPU max. Help? This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together, "KPMG"). ELLP does not provide services to clients and none of its subsidiaries has authority to bind it. This email, and any attachments, is confidential and may be privileged or otherwise protected from disclosure. It is intended solely for the stated addressee(s) and access to it by any other person is unauthorised. If you are not the intended recipient, you must not disclose, copy, circulate or in any other way use or rely on the information contained herein. If you have received this email in error, please inform us immediately and delete all copies of it. Any communications made with KPMG may be monitored and a record may be kept of any communication. Any opinion or advice contained herein is subject to the terms and conditions set out in your KPMG LLP client engagement letter. A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered office. KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited (registered no. 03580549) are companies registered in England and Wales. Each entity's registered office is at 15 Canada Square, London, E14 5GL. _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

Reply

Smelkovs, Konrads (London)

6:35 p.m.

Hi Michael, I had to run it eventually on Linux 2.3.1 as there is no way to redirect stderr on Windows to a file. Output is as follows: Volatility Foundation Volatility Framework 2.3.1 DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls DEBUG : volatility.obj : Applying modification from Win7SP1x64GuiVTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Win7GuiOverlay DEBUG : volatility.obj : Applying modification from Win7x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7 DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7x64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Vista2008Tcpip DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from HiberVistaSP01x86 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP1x86Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Vistax86DTB DEBUG : volatility.obj : Applying modification from Win7Pointer64 DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax86 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls DEBUG : volatility.obj : Applying modification from Win7SP1x64GuiVTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Win7GuiOverlay DEBUG : volatility.obj : Applying modification from Win7x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7 DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7x64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win2003SP12Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType DEBUG : volatility.obj : Applying modification from Win2003x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win2003SP12Tcpip DEBUG : volatility.obj : Applying modification from Win2003SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from Win2003KDBG DEBUG : volatility.obj : Applying modification from Win2003x86DTB DEBUG : volatility.obj : Applying modification from Win2003x86Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x86 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls DEBUG : volatility.obj : Applying modification from Win7SP1x64GuiVTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Win7GuiOverlay DEBUG : volatility.obj : Applying modification from Win7x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7 DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7x64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from WinXPSyscalls DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from XPOverlay DEBUG : volatility.obj : Applying modification from XPx86SessionOverlay DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypesXPx86 DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberVistaSP2x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP2x64Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Vistax64DTB DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberVistaSP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP1x64Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Vistax64DTB DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberVistaSP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP1x64Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Vistax64DTB DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls DEBUG : volatility.obj : Applying modification from Win7SP0x64GuiVTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Win7GuiOverlay DEBUG : volatility.obj : Applying modification from Win7x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7 DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7x64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Vista2008Tcpip DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from Win7SP01Syscalls DEBUG : volatility.obj : Applying modification from Win7SP1x86GuiVTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Win7GuiOverlay DEBUG : volatility.obj : Applying modification from Win7Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from HiberWin7SP01x86 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7Pointer64 DEBUG : volatility.obj : Applying modification from Win7x86DTB DEBUG : volatility.obj : Applying modification from Win7x86Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7 DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x86 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax86 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Vista2008Tcpip DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from HiberVistaSP01x86 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP1x86Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Vistax86DTB DEBUG : volatility.obj : Applying modification from Win7Pointer64 DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax86 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberVistaSP2x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP2x64Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Vistax64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Vista2008Tcpip DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from HiberVistaSP2x86 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP2x86Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Vistax86DTB DEBUG : volatility.obj : Applying modification from Win7Pointer64 DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax86 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Vista2008Tcpip DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from HiberVistaSP2x86 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP2x86Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Vistax86DTB DEBUG : volatility.obj : Applying modification from Win7Pointer64 DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86 DEBUG : volatility.obj : Applying modification from VistaSP1KDBG DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax86 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win2003SP12Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType DEBUG : volatility.obj : Applying modification from Win2003x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win2003SP12Tcpip DEBUG : volatility.obj : Applying modification from Win2003SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from Win2003KDBG DEBUG : volatility.obj : Applying modification from Win2003x86DTB DEBUG : volatility.obj : Applying modification from Win2003x86Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x86 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from HiberWin2003x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64 DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from Win2003KDBG DEBUG : volatility.obj : Applying modification from Win2003x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from Win2003x64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Vista2008Tcpip DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from Win7SP01Syscalls DEBUG : volatility.obj : Applying modification from Win7SP0x86GuiVTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Win7GuiOverlay DEBUG : volatility.obj : Applying modification from Win7Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from HiberWin7SP01x86 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7Pointer64 DEBUG : volatility.obj : Applying modification from Win7x86DTB DEBUG : volatility.obj : Applying modification from Win7x86Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7 DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x86 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax86 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from VistaSP0x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberVistaSP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP0x64Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Vistax64DTB DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls DEBUG : volatility.obj : Applying modification from Win7SP0x64GuiVTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from Win7GuiOverlay DEBUG : volatility.obj : Applying modification from Win7x64Tcpip DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Win7x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7 DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64 DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7KDBG DEBUG : volatility.obj : Applying modification from Win7ObjectClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax64 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses DEBUG : volatility.obj : Applying modification from Win7x64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Vista2008Tcpip DEBUG : volatility.obj : Applying modification from VistaSP0Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from HiberVistaSP01x86 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from VistaKDBG DEBUG : volatility.obj : Applying modification from VistaSP0x86Hiber DEBUG : volatility.obj : Applying modification from VistaWin7KPCR DEBUG : volatility.obj : Applying modification from Vistax86DTB DEBUG : volatility.obj : Applying modification from Win7Pointer64 DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from NetscanObjectClasses DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from ServiceVista DEBUG : volatility.obj : Applying modification from ServiceVistax86 DEBUG : volatility.obj : Applying modification from VistaMMVAD DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win2003SP12Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType DEBUG : volatility.obj : Applying modification from Win2003SP0Syscalls DEBUG : volatility.obj : Applying modification from Win2003x86GuiVTypes DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win2003SyscallVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from Win2003KDBG DEBUG : volatility.obj : Applying modification from Win2003x86DTB DEBUG : volatility.obj : Applying modification from Win2003x86Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x86 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win2003SP0x86DTB DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from HiberWin2003x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64 DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from Win2003KDBG DEBUG : volatility.obj : Applying modification from Win2003x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from Win2003x64DTB DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from HiberWin2003x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64 DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from Win2003KDBG DEBUG : volatility.obj : Applying modification from Win2003x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from Win2003x64DTB DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from HiberWin2003x64 DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64 DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from EThreadCreateTime DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from Win2003KDBG DEBUG : volatility.obj : Applying modification from Win2003x64Hiber DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from ExFastRefx64 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64 DEBUG : volatility.obj : Applying modification from Win2003MMVad DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.obj : Applying modification from WinPEx64VTypes DEBUG : volatility.obj : Applying modification from Windows64Overlay DEBUG : volatility.obj : Applying modification from ServiceBasex64 DEBUG : volatility.obj : Applying modification from Win2003x64DTB DEBUG : volatility.obj : Applying modification from BasicObjectClasses DEBUG : volatility.obj : Applying modification from ControlAreaModification DEBUG : volatility.obj : Applying modification from ELF64Modification DEBUG : volatility.obj : Applying modification from HPAKVTypes DEBUG : volatility.obj : Applying modification from IEHistoryVTypes DEBUG : volatility.obj : Applying modification from LimeTypes DEBUG : volatility.obj : Applying modification from MachoTypes DEBUG : volatility.obj : Applying modification from MbrObjectTypes DEBUG : volatility.obj : Applying modification from SSLKeyModification DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes DEBUG : volatility.obj : Applying modification from VMwareVTypesModification DEBUG : volatility.obj : Applying modification from VirtualBoxModification DEBUG : volatility.obj : Applying modification from Win32KGahtiVType DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute DEBUG : volatility.obj : Applying modification from WinXPSyscalls DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType DEBUG : volatility.obj : Applying modification from WindowsVTypes DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay DEBUG : volatility.obj : Applying modification from EVTObjectTypes DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes DEBUG : volatility.obj : Applying modification from WindowsOverlay DEBUG : volatility.obj : Applying modification from MalwareCallbackMods DEBUG : volatility.obj : Applying modification from MalwarePspCid DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes DEBUG : volatility.obj : Applying modification from TokenXP2003 DEBUG : volatility.obj : Applying modification from UserAssistVTypes DEBUG : volatility.obj : Applying modification from WinPEObjectClasses DEBUG : volatility.obj : Applying modification from WinPEVTypes DEBUG : volatility.obj : Applying modification from WindowsObjectClasses DEBUG : volatility.obj : Applying modification from XPOverlay DEBUG : volatility.obj : Applying modification from XPx86SessionOverlay DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86 DEBUG : volatility.obj : Applying modification from CrashInfoModification DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86 DEBUG : volatility.obj : Applying modification from KDBGObjectClass DEBUG : volatility.obj : Applying modification from KPCRProfileModification DEBUG : volatility.obj : Applying modification from MFTTYPES DEBUG : volatility.obj : Applying modification from MalwareDrivers DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86 DEBUG : volatility.obj : Applying modification from MalwareKthread DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP DEBUG : volatility.obj : Applying modification from ServiceBase DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP DEBUG : volatility.obj : Applying modification from ShimCacheTypesXPx86 DEBUG : volatility.obj : Applying modification from Win32KCoreClasses DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: mac: need base DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: lime: need base DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'> DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: No base Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.standard.FileAddressSpace object at 0xf0e33d0> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: MachO Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: Invalid Lime header signature DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG1 : volatility.obj : None object instantiated: Invalid hibernation header DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No xpress signature found DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: Invalid magic found DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'> DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: ELF64 Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: Invalid VMware signature: 0x0 DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG : volatility.utils : Succeeded instantiating <volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0xf0e3490> DEBUG : volatility.utils : Voting round DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.macho.MachOAddressSpace'> DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x0 of size 0x4 DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: MachO Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.lime.LimeAddressSpace'> DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x0 of size 0x4 DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: Invalid Lime header signature DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'> DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000, instantiating PO_MEMORY_IMAGE DEBUG1 : volatility.obj : None object instantiated: Invalid hibernation header DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x0 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x1000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x2000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x3000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x4000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x5000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x6000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x7000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x8000 of size 0x8 DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x9000 of size 0x8 DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No xpress signature found DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'> DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x0 of size 0x8 DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'> DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000, instantiating HPAK_HEADER DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: Invalid magic found DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'> DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x0 of size 0x6 DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: ELF64 Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'> DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000, instantiating _VMWARE_HEADER DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: Invalid VMware signature: - DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'> DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr 0x0 of size 0x8 DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: Header signature invalid DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'> DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: Can not stack over another paging address space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: Incompatible profile Win7SP1x64 selected DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.intel.IA32PagedMemory'> DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: Incompatible profile Win7SP1x64 selected DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.standard.FileAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating FileAddressSpace: Must be first Address Space DEBUG : volatility.utils : Trying <class 'volatility.plugins.addrspaces.arm.ArmAddressSpace'> DEBUG1 : volatility.utils : Failed instantiating ArmAddressSpace: Can not stack over another paging address space DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d000L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d008L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d010L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d018L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d020L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d028L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d030L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d038L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d040L DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at 0xf8b4c0575d048L -- Konrads Smelkovs KPMG LLP www.kpmg.com/uk/cyber | Love challenge? Work for us: www.kpmgcareers.co.uk 15 Canada Square London, E14 5GL ☎ Mobile +44 (0) 7990 987 057 ☎ Direct +44 (0) 2076 945 519 ✉ E-mail konrads.smelkovs(a)kpmg.co.uk -----Original Message----- From: Michael Ligh [mailto:michael.ligh@mnin.org] Sent: 01 March 2014 21:22 To: Smelkovs, Konrads (London) Cc: vol-users(a)volatilesystems.com Subject: Re: [Vol-users] Volatility never finishes on 8 gig Win7SP1x64 Hi Konrads, Could you paste us the output of: volatility-2.3.1.standalone.exe -d -d -d -f C:\image.raw kdbgscan --profile=Win7SP1x64 Notice the 3 -d options after the program name. This will enable some extra debugging that might help us figure out what's going on. Thanks! Michael -------------------------------------------------- Michael Ligh (@iMHLv2) GPG: http://mnin.org/gpg.pubkey.txt Blog: http://volatility-labs.blogspot.com Training: http://memoryanalysis.net On Mar 1, 2014, at 10:55 AM, "Smelkovs, Konrads (London)" <Konrads.Smelkovs(a)KPMG.co.uk> wrote:

...

Hello, C:\ >volatility-2.3.1.standalone.exe -f C:\image.raw kdbgscan --profile=Win7SP1x64 Volatility Foundation Volatility Framework 2.3.1 ..... Never finishes - analysing 8 gig dump, CPU max. Help? This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together, "KPMG"). ELLP does not provide services to clients and none of its subsidiaries has authority to bind it. This email, and any attachments, is confidential and may be privileged or otherwise protected from disclosure. It is intended solely for the stated addressee(s) and access to it by any other person is unauthorised. If you are not the intended recipient, you must not disclose, copy, circulate or in any other way use or rely on the information contained herein. If you have received this email in error, please inform us immediately and delete all copies of it. Any communications made with KPMG may be monitored and a record may be kept of any communication. Any opinion or advice contained herein is subject to the terms and conditions set out in your KPMG LLP client engagement letter. A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered office. KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited (registered no. 03580549) are companies registered in England and Wales. Each entity's registered office is at 15 Canada Square, London, E14 5GL. _______________________________________________ Vol-users mailing list Vol-users(a)volatilesystems.com http://lists.volatilesystems.com/mailman/listinfo/vol-users

This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together, "KPMG"). ELLP does not provide services to clients and none of its subsidiaries has authority to bind it. This email, and any attachments, is confidential and may be privileged or otherwise protected from disclosure. It is intended solely for the stated addressee(s) and access to it by any other person is unauthorised. If you are not the intended recipient, you must not disclose, copy, circulate or in any other way use or rely on the information contained herein. If you have received this email in error, please inform us immediately and delete all copies of it. Any communications made with KPMG may be monitored and a record may be kept of any communication. Any opinion or advice contained herein is subject to the terms and conditions set out in your KPMG LLP client engagement letter. A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered office. KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited (registered no. 03580549) are companies registered in England and Wales. Each entity's registered office is at 15 Canada Square, London, E14 5GL.

Reply

Smelkovs, Konrads (London)

11:26 a.m.

Hi, Hangs on both Linux and Windows. I used MoonSol's memory acquisition tools. What tools would you suggest to use instead? -----Original Message----- From: Michael Ligh [mailto:michael.ligh@mnin.org] Sent: 02 March 2014 16:25 To: Smelkovs, Konrads (London) Cc: vol-users(a)volatilesystems.com Subject: Re: [Vol-users] Volatility never finishes on 8 gig Win7SP1x64 Hi Konrads, Thanks for the output. At the moment, its looks like the page table is corrupt (based on the errors trying to read physical addresses in the range 0xf8b4c0575d000, which is way outside the size of your file). Whether the acquisition tool or Volatility's address space parser is to blame, I'm not currently sure. Can you answer a few additional questions, please: * Does it also hang on Linux also, or does it complete sometime after printing those "None object instantiated: Unable to read_long_long_phys" messages? * What tool did you acquire memory with? Is it possible to re-acquire in a different format, such as a Windows crash dump? Thanks, Michael This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together, "KPMG"). ELLP does not provide services to clients and none of its subsidiaries has authority to bind it. This email, and any attachments, is confidential and may be privileged or otherwise protected from disclosure. It is intended solely for the stated addressee(s) and access to it by any other person is unauthorised. If you are not the intended recipient, you must not disclose, copy, circulate or in any other way use or rely on the information contained herein. If you have received this email in error, please inform us immediately and delete all copies of it. Any communications made with KPMG may be monitored and a record may be kept of any communication. Any opinion or advice contained herein is subject to the terms and conditions set out in your KPMG LLP client engagement letter. A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered office. KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited (registered no. 03580549) are companies registered in England and Wales. Each entity's registered office is at 15 Canada Square, London, E14 5GL.

Reply