search

hzqst / unicorn_pe

Unicorn PE is an unicorn based instrumentation project designed to emulate code execution for windows PE files.
MIT License
781 stars 199 forks source link

ManualMap failed #37

Open stdhu opened 2 years ago

stdhu commented 2 years ago

After I compiled it myself, I used the compiled program to analyze a 64-bit sys I wrote, but so did the 64 bits exe file, which was always manualmap failed。

sys: API emulation callback not registered: ntoskrnl.exe!DbgPrintEx called from imagebase+0x1025 BlackBone: ManualMap: Unmapping image 'myfirstdriver.sys' BlackBone: Free: Free at address 0x000001DCF04A0000 BlackBone: ManualMap: Unmapping image 'ntoskrnl.exe' BlackBone: Free: Free at address 0x000001DCF26A0000 uc_emu_start return: 0 entrypoint return: ffff10a0c2ae0d4c last rip: 1dcf04a101f (myfirstdriver.sys+101f) BlackBone: Free: Free at address 0x000001DCF0470000 BlackBone: Free: Free at address 0x000001DCF0490000 BlackBone: Free: Free at address 0x000001DCF0480000

exe: LdrLoadDllByName failed to MapImage dxcore.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x000001D1A5B80000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x000001D1A5B90000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x000001D1A5BA0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'ext-ms-win-gdi-desktop-l1-1-0.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'ext-ms-win-gdi-desktop-l1-1-0.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x000001D1A5B80000 BlackBone: Free: Free at address 0x000001D1A5B90000 BlackBone: Free: Free at address 0x000001D1A5BA0000 LdrLoadDllByName failed to MapImage ext-ms-win-gdi-desktop-l1-1-0.dll, status C0000034 BlackBone: ManualMap: Performing security cookie initializtion for image 'user32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'test.exe' BlackBone: Free: Decommit at address 0x000001D1A9E45000 (0x1000 bytes) BlackBone: Free: Decommit at address 0x000001D1A9B83000 (0x1000 bytes) unknown API called called from imagebase+0x70e7c BlackBone: ManualMap: Unmapping image 'test.exe' BlackBone: Free: Free at address 0x000001D1A7380000 BlackBone: ManualMap: Unmapping image 'user32.dll' BlackBone: Free: Free at address 0x000001D1A99F0000 BlackBone: ManualMap: Unmapping image 'gdi32.dll' BlackBone: Free: Free at address 0x000001D1A9E20000 uc_emu_start return: 0 entrypoint return: 1 last rip: 1d1a73f0e76 (test.exe+70e76)

UnlimitedChild commented 2 years ago

Release Mode ->

LdrLoadDllByName failed to MapImage ext-ms-win-gdi-desktop-l1-1-0.dll, status C0000034 LdrLoadDllByName failed to MapImage shcore.dll, status C0000034 LdrLoadDllByName failed to MapImage shunimpl.dll, status C0000034 LdrLoadDllByName failed to MapImage shunimpl.dll, status C0000034 LdrLoadDllByName failed to MapImage shunimpl.dll, status C0000034 LdrLoadDllByName failed to MapImage shcore.dll, status C0000034 LdrLoadDllByName failed to MapImage dpapi.dll, status C0000034 LdrLoadDllByName failed to MapImage dpapi.dll, status C0000034 LdrLoadDllByName failed to MapImage dpapi.dll, status C0000034 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 UC_MEM_FETCH_PROT from ntdll.dll+2adc0 UC_MEM_FETCH_PROT rip at ntdll.dll+2adc0 uc_emu_start return: 8 entrypoint return: 8 last rip: 1e4baacec7f (procexp.exe+aec7f)

UnlimitedChild commented 2 years ago

Debug Mode ->

unicorn_pe procexp.exe BlackBone: Allocate: Allocating at address 0x0000028B1ABB0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1ABC0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1ABD0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'procexp.exe' with flags 0x5d001 BlackBone: ManualMap: Loading new image 'procexp.exe' BlackBone: ManualMap: Image base allocated at 0x0000028b1af40000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'procexp.exe' BlackBone: ManualMap: Loading new dependency 'ws2_32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\WS2_32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\WS2_32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1e140000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\ws2_32.dll' BlackBone: ManualMap: Loading new dependency 'kernelbase.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\kernelbase.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\kernelbase.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1e480000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\kernelbase.dll' BlackBone: ManualMap: Loading new dependency 'ntdll.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\ntdll.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\ntdll.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1ec20000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\ntdll.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'ntdll.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'kernelbase.dll' BlackBone: ManualMap: Loading new dependency 'kernel32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\kernel32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\kernel32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1e270000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\kernel32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'kernel32.dll' BlackBone: ManualMap: Loading new dependency 'rpcrt4.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\rpcrt4.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\rpcrt4.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1e900000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\rpcrt4.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'rpcrt4.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'ws2_32.dll' BlackBone: ManualMap: Loading new dependency 'user32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\user32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\user32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1efc0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\user32.dll' BlackBone: ManualMap: Loading new dependency 'win32u.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\win32u.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\win32u.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1b110000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\win32u.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'win32u.dll' BlackBone: ManualMap: Loading new dependency 'gdi32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\gdi32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\gdi32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1e7b0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\gdi32.dll' BlackBone: ManualMap: Loading new dependency 'gdi32full.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\gdi32full.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\gdi32full.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1ee20000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\gdi32full.dll' BlackBone: ManualMap: Loading new dependency 'msvcp_win.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\msvcp_win.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\msvcp_win.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1f4c0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\msvcp_win.dll' BlackBone: ManualMap: Loading new dependency 'ucrtbase.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\ucrtbase.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\ucrtbase.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1f660000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\ucrtbase.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'ucrtbase.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'msvcp_win.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'gdi32full.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'gdi32.dll' BlackBone: ManualMap: Mapping image 'ext-ms-win-gdi-desktop-l1-1-0.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'ext-ms-win-gdi-desktop-l1-1-0.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1ABB0000 BlackBone: Free: Free at address 0x0000028B1ABC0000 BlackBone: Free: Free at address 0x0000028B1ABD0000 LdrLoadDllByName failed to MapImage ext-ms-win-gdi-desktop-l1-1-0.dll, status C0000034 BlackBone: ManualMap: Performing security cookie initializtion for image 'user32.dll' BlackBone: ManualMap: Loading new dependency 'shlwapi.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\SHLWAPI.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\SHLWAPI.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1ea90000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\shlwapi.dll' BlackBone: ManualMap: Loading new dependency 'msvcrt.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\MSVCRT.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\MSVCRT.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1f160000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\msvcrt.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'msvcrt.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'shlwapi.dll' BlackBone: Allocate: Allocating at address 0x0000028B1EAF0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB00000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB10000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'shcore.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'shcore.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EAF0000 BlackBone: Free: Free at address 0x0000028B1EB00000 BlackBone: Free: Free at address 0x0000028B1EB10000 LdrLoadDllByName failed to MapImage shcore.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1EAF0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB00000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB10000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'shunimpl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'shunimpl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EAF0000 BlackBone: Free: Free at address 0x0000028B1EB00000 BlackBone: Free: Free at address 0x0000028B1EB10000 LdrLoadDllByName failed to MapImage shunimpl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1EAF0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB00000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB10000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'shunimpl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'shunimpl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EAF0000 BlackBone: Free: Free at address 0x0000028B1EB00000 BlackBone: Free: Free at address 0x0000028B1EB10000 LdrLoadDllByName failed to MapImage shunimpl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1EAF0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB00000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB10000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'shunimpl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'shunimpl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EAF0000 BlackBone: Free: Free at address 0x0000028B1EB00000 BlackBone: Free: Free at address 0x0000028B1EB10000 LdrLoadDllByName failed to MapImage shunimpl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1EAF0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB00000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB10000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'shcore.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'shcore.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EAF0000 BlackBone: Free: Free at address 0x0000028B1EB00000 BlackBone: Free: Free at address 0x0000028B1EB10000 LdrLoadDllByName failed to MapImage shcore.dll, status C0000034 BlackBone: ManualMap: Loading new dependency 'iphlpapi.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\iphlpapi.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\iphlpapi.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1ea30000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\iphlpapi.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'iphlpapi.dll' BlackBone: ManualMap: Loading new dependency 'crypt32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\crypt32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\crypt32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1f360000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\crypt32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'crypt32.dll' BlackBone: Allocate: Allocating at address 0x0000028B1EB70000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB80000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EF60000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dpapi.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dpapi.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EB70000 BlackBone: Free: Free at address 0x0000028B1EB80000 BlackBone: Free: Free at address 0x0000028B1EF60000 LdrLoadDllByName failed to MapImage dpapi.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1EB70000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB80000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EF60000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dpapi.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dpapi.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EB70000 BlackBone: Free: Free at address 0x0000028B1EB80000 BlackBone: Free: Free at address 0x0000028B1EF60000 LdrLoadDllByName failed to MapImage dpapi.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1EB70000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EB80000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1EF60000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dpapi.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dpapi.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1EB70000 BlackBone: Free: Free at address 0x0000028B1EB80000 BlackBone: Free: Free at address 0x0000028B1EF60000 LdrLoadDllByName failed to MapImage dpapi.dll, status C0000034 BlackBone: ManualMap: Loading new dependency 'setupapi.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\Setupapi.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\Setupapi.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1f760000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\setupapi.dll' BlackBone: ManualMap: Loading new dependency 'cfgmgr32.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\cfgmgr32.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\cfgmgr32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1ef60000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\cfgmgr32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'cfgmgr32.dll' BlackBone: ManualMap: Loading new dependency 'bcrypt.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\bcrypt.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\bcrypt.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1f280000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\bcrypt.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'bcrypt.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'setupapi.dll' BlackBone: Allocate: Allocating at address 0x0000028B1F250000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F260000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F270000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'devrtl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'devrtl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F250000 BlackBone: Free: Free at address 0x0000028B1F260000 BlackBone: Free: Free at address 0x0000028B1F270000 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F250000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F260000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F270000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'devrtl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'devrtl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F250000 BlackBone: Free: Free at address 0x0000028B1F260000 BlackBone: Free: Free at address 0x0000028B1F270000 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F250000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F260000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F270000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'devrtl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'devrtl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F250000 BlackBone: Free: Free at address 0x0000028B1F260000 BlackBone: Free: Free at address 0x0000028B1F270000 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F250000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F260000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F270000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'devrtl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'devrtl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F250000 BlackBone: Free: Free at address 0x0000028B1F260000 BlackBone: Free: Free at address 0x0000028B1F270000 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F250000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F260000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F270000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'devrtl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'devrtl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F250000 BlackBone: Free: Free at address 0x0000028B1F260000 BlackBone: Free: Free at address 0x0000028B1F270000 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F250000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F260000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F270000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'devrtl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'devrtl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F250000 BlackBone: Free: Free at address 0x0000028B1F260000 BlackBone: Free: Free at address 0x0000028B1F270000 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F250000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F260000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1F270000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'devrtl.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'devrtl.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F250000 BlackBone: Free: Free at address 0x0000028B1F260000 BlackBone: Free: Free at address 0x0000028B1F270000 LdrLoadDllByName failed to MapImage devrtl.dll, status C0000034 BlackBone: ManualMap: Loading new dependency 'mpr.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\mpr.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\mpr.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1f260000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\mpr.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'mpr.dll' BlackBone: ManualMap: Loading new dependency 'comctl32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.844_none_423537bff6b9828c\comctl32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.844_none_423537bff6b9828c\comctl32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1fbd0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.844_none_423537bff6b9828c\comctl32.dll' BlackBone: ManualMap: Loading new dependency 'advapi32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\advapi32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\advapi32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1fd30000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\advapi32.dll' BlackBone: ManualMap: Loading new dependency 'sechost.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\sechost.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\sechost.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1fe80000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\sechost.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'sechost.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'advapi32.dll' BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B1F650000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDE0000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B1FDF0000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'cryptsp.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'cryptsp.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B1F650000 BlackBone: Free: Free at address 0x0000028B1FDE0000 BlackBone: Free: Free at address 0x0000028B1FDF0000 LdrLoadDllByName failed to MapImage cryptsp.dll, status C0000034 BlackBone: ManualMap: Performing security cookie initializtion for image 'comctl32.dll' BlackBone: ManualMap: Loading new dependency 'version.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\version.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\version.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1fce0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\version.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'version.dll' BlackBone: ManualMap: Loading new dependency 'credui.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\credui.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\credui.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1fe30000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\credui.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'credui.dll' BlackBone: ManualMap: Loading new dependency 'aclui.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\aclui.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\aclui.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b1ff60000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\aclui.dll' BlackBone: ManualMap: Loading new dependency 'ntdsapi.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\ntdsapi.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\ntdsapi.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b20000000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\ntdsapi.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'ntdsapi.dll' BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: Allocate: Allocating at address 0x0000028B20030000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20040000 (0x1000 bytes) BlackBone: Allocate: Allocating at address 0x0000028B20050000 (0x4000 bytes) BlackBone: ManualMap: Mapping image 'dsparse.dll' with flags 0x1d001 BlackBone: ManualMap: Failed to load image 'dsparse.dll'/0x0000000000000000. Status 0xC0000034 BlackBone: Free: Free at address 0x0000028B20030000 BlackBone: Free: Free at address 0x0000028B20040000 BlackBone: Free: Free at address 0x0000028B20050000 LdrLoadDllByName failed to MapImage dsparse.dll, status C0000034 BlackBone: ManualMap: Loading new dependency 'shell32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\SHELL32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\SHELL32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b207d0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\shell32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'shell32.dll' BlackBone: ManualMap: Loading new dependency 'shcore.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\SHCORE.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\SHCORE.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b20090000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\shcore.dll' BlackBone: ManualMap: Loading new dependency 'combase.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\combase.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\combase.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b20f10000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\combase.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'combase.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'shcore.dll' BlackBone: ManualMap: Loading new dependency 'ole32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\ole32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\ole32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b20270000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\ole32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'ole32.dll' BlackBone: ManualMap: Loading new dependency 'oleaut32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\OLEAUT32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\OLEAUT32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b203a0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\oleaut32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'oleaut32.dll' BlackBone: ManualMap: Loading new dependency 'xmllite.dll' BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\xmllite.dll' BlackBone: ManualMap: Loading new image 'c:\windows\system32\xmllite.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b20140000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\xmllite.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'xmllite.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'aclui.dll' BlackBone: ManualMap: Loading new dependency 'powrprof.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\powrprof.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\powrprof.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b201d0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\powrprof.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'powrprof.dll' BlackBone: ManualMap: Loading new dependency 'wtsapi32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\wtsapi32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\wtsapi32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b20240000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\wtsapi32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'wtsapi32.dll' BlackBone: ManualMap: Loading new dependency 'uxtheme.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\uxtheme.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\uxtheme.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b20510000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\uxtheme.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'uxtheme.dll' BlackBone: ManualMap: Loading new dependency 'comdlg32.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\COMDLG32.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\COMDLG32.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b206a0000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\comdlg32.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'comdlg32.dll' BlackBone: ManualMap: Loading new dependency 'winhttp.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\winhttp.dll' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\winhttp.dll' BlackBone: ManualMap: Image base allocated at 0x0000028b21270000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\winhttp.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'winhttp.dll' BlackBone: ManualMap: Loading new dependency 'psapi.dll' BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\PSAPI.DLL' BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\PSAPI.DLL' BlackBone: ManualMap: Image base allocated at 0x0000028b20470000 BlackBone: ManualMap: Performing image copy BlackBone: ManualMap: Relocating image 'c:\windows\system32\psapi.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'psapi.dll' BlackBone: ManualMap: Performing security cookie initializtion for image 'procexp.exe' BlackBone: Free: Decommit at address 0x0000028B20029000 (0x1000 bytes) BlackBone: Free: Decommit at address 0x0000028B20EFB000 (0x14000 bytes) BlackBone: Free: Decommit at address 0x0000028B21257000 (0xe000 bytes) BlackBone: Free: Decommit at address 0x0000028B2013A000 (0x4000 bytes) BlackBone: Free: Decommit at address 0x0000028B20397000 (0x3000 bytes) BlackBone: Free: Decommit at address 0x0000028B2046A000 (0x3000 bytes) BlackBone: Free: Decommit at address 0x0000028B20175000 (0x1000 bytes) BlackBone: Free: Decommit at address 0x0000028B1FFF2000 (0x2000 bytes) BlackBone: Free: Decommit at address 0x0000028B2021A000 (0x1000 bytes) BlackBone: Free: Decommit at address 0x0000028B20253000 (0x1000 bytes) BlackBone: Free: Decommit at address 0x0000028B205AC000 (0x2000 bytes) BlackBone: Free: Decommit at address 0x0000028B20778000 (0x2000 bytes) BlackBone: Free: Decommit at address 0x0000028B2137A000 (0x1000 bytes) BlackBone: Free: Decommit at address 0x0000028B20477000 (0x1000 bytes) BlackBone: Free: Decommit at address 0x0000028B1B0CF000 (0x2000 bytes) UC_MEM_FETCH_PROT from ntdll.dll+2adc0 UC_MEM_FETCH_PROT rip at ntdll.dll+2adc0 BlackBone: ManualMap: Unmapping image 'procexp.exe' BlackBone: Free: Free at address 0x0000028B1AF40000 BlackBone: ManualMap: Unmapping image 'psapi.dll' BlackBone: Free: Free at address 0x0000028B20470000 BlackBone: ManualMap: Unmapping image 'winhttp.dll' BlackBone: Free: Free at address 0x0000028B21270000 BlackBone: ManualMap: Unmapping image 'comdlg32.dll' BlackBone: Free: Free at address 0x0000028B206A0000 BlackBone: ManualMap: Unmapping image 'uxtheme.dll' BlackBone: Free: Free at address 0x0000028B20510000 BlackBone: ManualMap: Unmapping image 'wtsapi32.dll' BlackBone: Free: Free at address 0x0000028B20240000 BlackBone: ManualMap: Unmapping image 'powrprof.dll' BlackBone: Free: Free at address 0x0000028B201D0000 BlackBone: ManualMap: Unmapping image 'aclui.dll' BlackBone: Free: Free at address 0x0000028B1FF60000 BlackBone: ManualMap: Unmapping image 'xmllite.dll' BlackBone: Free: Free at address 0x0000028B20140000 BlackBone: ManualMap: Unmapping image 'oleaut32.dll' BlackBone: Free: Free at address 0x0000028B203A0000 BlackBone: ManualMap: Unmapping image 'ole32.dll' BlackBone: Free: Free at address 0x0000028B20270000 BlackBone: ManualMap: Unmapping image 'shcore.dll' BlackBone: Free: Free at address 0x0000028B20090000 BlackBone: ManualMap: Unmapping image 'combase.dll' BlackBone: Free: Free at address 0x0000028B20F10000 BlackBone: ManualMap: Unmapping image 'shell32.dll' BlackBone: Free: Free at address 0x0000028B207D0000 BlackBone: ManualMap: Unmapping image 'ntdsapi.dll' BlackBone: Free: Free at address 0x0000028B20000000 uc_emu_start return: 8 entrypoint return: 4 last rip: 28b1afeec7f (procexp.exe+aec7f)

UnlimitedChild commented 2 years ago

failed to MapImage shcore.dll, status C0000034 failed to MapImage failed to MapImage failed to MapImage etc