mirror of
https://github.com/DxWnd/DxWnd.reloaded
synced 2024-12-30 09:25:35 +01:00
229 lines
10 KiB
Plaintext
229 lines
10 KiB
Plaintext
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=7 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=7 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe.noshim" dir="F:\RhemE\RhemE"
|
|
Target handle=67c
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe.noshim" dir="F:\RhemE\RhemE"
|
|
Target handle=908
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
debugger mode
|
|
create process: path="F:\RhemE\RhemE"
|
|
create process: base=0x20000000 path="F:\RhemE\RhemE\RHEM1(scalable).exe"
|
|
create thread: th=0xA18 base=0x2F1000 start=0x76C68500
|
|
load dll: base=0x77BD0000 path="C:\Windows\SysWOW64\ntdll.dll"
|
|
unload dll: base=0x540000
|
|
load dll: base=0x76C40000 path="C:\Windows\SysWOW64\kernel32.dll"
|
|
unload dll: base=0x76C40000
|
|
unload dll: base=0x540000
|
|
unload dll: base=0x6A0000
|
|
load dll: base=0x76C40000 path="C:\Windows\SysWOW64\kernel32.dll"
|
|
load dll: base=0x74830000 path="C:\Windows\SysWOW64\KernelBase.dll"
|
|
load dll: base=0x6E490000 path="C:\Windows\SysWOW64\apphelp.dll"
|
|
load dll: base=0x78E50000 path="C:\Windows\AppPatch\AcLayers.dll"
|
|
load dll: base=0x773E0000 path="C:\Windows\SysWOW64\msvcrt.dll"
|
|
load dll: base=0x74C00000 path="C:\Windows\SysWOW64\user32.dll"
|
|
load dll: base=0x774A0000 path="C:\Windows\SysWOW64\win32u.dll"
|
|
load dll: base=0x75600000 path="C:\Windows\SysWOW64\gdi32.dll"
|
|
load dll: base=0x75450000 path="C:\Windows\SysWOW64\gdi32full.dll"
|
|
load dll: base=0x75850000 path="C:\Windows\SysWOW64\shell32.dll"
|
|
load dll: base=0x75800000 path="C:\Windows\SysWOW64\cfgmgr32.dll"
|
|
load dll: base=0x76DD0000 path="C:\Windows\SysWOW64\windows.storage.dll"
|
|
load dll: base=0x749E0000 path="C:\Windows\SysWOW64\combase.dll"
|
|
load dll: base=0x75630000 path="C:\Windows\SysWOW64\ucrtbase.dll"
|
|
load dll: base=0x75300000 path="C:\Windows\SysWOW64\rpcrt4.dll"
|
|
load dll: base=0x74690000 path="C:\Windows\SysWOW64\sspicli.dll"
|
|
load dll: base=0x74680000 path="C:\Windows\SysWOW64\cryptbase.dll"
|
|
load dll: base=0x76D70000 path="C:\Windows\SysWOW64\bcryptprimitives.dll"
|
|
load dll: base=0x77980000 path="C:\Windows\SysWOW64\sechost.dll"
|
|
load dll: base=0x777F0000 path="C:\Windows\SysWOW64\powrprof.dll"
|
|
load dll: base=0x779D0000 path="C:\Windows\SysWOW64\advapi32.dll"
|
|
load dll: base=0x76D20000 path="C:\Windows\SysWOW64\shlwapi.dll"
|
|
load dll: base=0x77BC0000 path="C:\Windows\SysWOW64\kernel.appcore.dll"
|
|
load dll: base=0x776F0000 path="C:\Windows\SysWOW64\SHCore.dll"
|
|
load dll: base=0x773A0000 path="C:\Windows\SysWOW64\profapi.dll"
|
|
load dll: base=0x77650000 path="C:\Windows\SysWOW64\oleaut32.dll"
|
|
load dll: base=0x74D60000 path="C:\Windows\SysWOW64\msvcp_win.dll"
|
|
load dll: base=0x74E40000 path="C:\Windows\SysWOW64\setupapi.dll"
|
|
load dll: base=0x74000000 path="C:\Windows\SysWOW64\mpr.dll"
|
|
load dll: base=0x66680000 path="C:\Windows\SysWOW64\sfc.dll"
|
|
load dll: base=0x73930000 path="C:\Windows\SysWOW64\winspool.drv"
|
|
load dll: base=0x72FA0000 path="C:\Windows\SysWOW64\bcrypt.dll"
|
|
load dll: base=0x640C0000 path="C:\Windows\SysWOW64\sfc_os.dll"
|
|
output debug: len=115 unicode=0
|
|
output debug: len=115 unicode=0
|
|
load dll: base=0x67100000 path="C:\Windows\SysWOW64\SortServer2003Compat.dll"
|
|
load dll: base=0x773B0000 path="C:\Windows\SysWOW64\imm32.dll"
|
|
exception: code=0x80000003(Breakpoint) addr=0x77C7748C first=1
|
|
exit thread: exitcode=0x0
|
|
load dll: base=0x10000000 path="C:\Users\user\AppData\Local\Temp\TempFolder.aad\proj.dll"
|
|
create thread: th=0x414 base=0x2F4000 start=0x77C067C0
|
|
create thread: th=0x670 base=0x2F7000 start=0x77C067C0
|
|
load dll: base=0x69000000 path="C:\Users\user\AppData\Local\Temp\TempFolder.aad\iml32.dll"
|
|
load dll: base=0x774C0000 path="C:\Windows\SysWOW64\comdlg32.dll"
|
|
create thread: th=0x670 base=0x2FA000 start=0x77C067C0
|
|
load dll: base=0x72DE0000 path="C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.14393.447_none_5507ded2cb4f7f4c\comctl32.dll"
|
|
load dll: base=0x75710000 path="C:\Windows\SysWOW64\ole32.dll"
|
|
load dll: base=0x68000000 path="C:\Users\user\AppData\Local\Temp\TempFolder.aad\dirapi.dll"
|
|
load dll: base=0x73050000 path="C:\Windows\SysWOW64\winmm.dll"
|
|
load dll: base=0x740F0000 path="C:\Windows\SysWOW64\version.dll"
|
|
load dll: base=0x72F70000 path="C:\Windows\SysWOW64\winmmbase.dll"
|
|
load dll: base=0x720000 path="C:\Windows\SysWOW64\winmmbase.dll"
|
|
load dll: base=0x2180000 path="C:\Windows\SysWOW64\winmmbase.dll"
|
|
unload dll: base=0x72F70000
|
|
unload dll: base=0x720000
|
|
load dll: base=0x6C670000 path="C:\Windows\SysWOW64\uxtheme.dll"
|
|
create thread: th=0x414 base=0x2FD000 start=0x78E7C3C0
|
|
load dll: base=0x77840000 path="C:\Windows\SysWOW64\msctf.dll"
|
|
load dll: base=0x92E0000 path="D:\DxWnd.develop\v2_04_07_beta\Release\dxwnd.dll"
|
|
create thread: th=0xC88 base=0x300000 start=0x73953B70
|
|
load dll: base=0x64080000 path="C:\Windows\SysWOW64\msvfw32.dll"
|
|
load dll: base=0x755B0000 path="C:\Windows\SysWOW64\wintrust.dll"
|
|
load dll: base=0x9400000 path="C:\Windows\SysWOW64\msasn1.dll"
|
|
load dll: base=0x746B0000 path="C:\Windows\SysWOW64\crypt32.dll"
|
|
load dll: base=0x64590000 path="C:\Windows\SysWOW64\avifil32.dll"
|
|
load dll: base=0x72FD0000 path="C:\Windows\SysWOW64\msacm32.dll"
|
|
exit thread: exitcode=0x1
|
|
exit thread: exitcode=0x1
|
|
exit thread: exitcode=0x1
|
|
exit thread: exitcode=0x1
|
|
exit thread: exitcode=0x1
|
|
exit process
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=6 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe" dir="F:\RhemE\RhemE"
|
|
Target handle=888
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
self elevation
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe" dir="F:\RhemE\RhemE"
|
|
Target handle=828
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
self elevation
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe" dir="F:\RhemE\RhemE"
|
|
Target handle=a04
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
self elevation
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe" dir="F:\RhemE\RhemE"
|
|
Target handle=6bc
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
self elevation
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe" dir="F:\RhemE\RhemE"
|
|
Target handle=878
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM1(scalable).exe" unhooked=0
|
|
self elevation
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM1(scalable).exe" dir="F:\RhemE\RhemE"
|
|
Target handle=86c
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
self elevation
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM.noshim.exe" dir="F:\RhemE\RhemE"
|
|
Target handle=8a0
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
self elevation
|
|
injectsuspended mode
|
|
InjectSuspended: exe="F:\RhemE\RhemE\RHEM.noshim.exe" dir="F:\RhemE\RhemE"
|
|
Target handle=cb0
|
|
NT Header offset=E8
|
|
AddressOfEntryPoint=3D84 ImageBase=20000000
|
|
Thread start address=20003d84
|
|
wait cycle 0 eip=20003d84
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
self elevation
|
|
setwindowshook mode
|
|
OnRun idx=8 prog="F:\RhemE\RhemE\RHEM.noshim.exe" unhooked=0
|
|
self elevation
|
|
setwindowshook mode
|