Hi Michael,
I had to run it eventually on Linux 2.3.1 as there is no way to redirect stderr on Windows
to a file. Output is as follows:
Volatility Foundation Volatility Framework 2.3.1
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls
DEBUG : volatility.obj : Applying modification from Win7SP1x64GuiVTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Win7GuiOverlay
DEBUG : volatility.obj : Applying modification from Win7x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Win7x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7
DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64
DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7KDBG
DEBUG : volatility.obj : Applying modification from Win7ObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7x64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Vista2008Tcpip
DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from HiberVistaSP01x86
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP1x86Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Vistax86DTB
DEBUG : volatility.obj : Applying modification from Win7Pointer64
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax86
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls
DEBUG : volatility.obj : Applying modification from Win7SP1x64GuiVTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Win7GuiOverlay
DEBUG : volatility.obj : Applying modification from Win7x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Win7x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7
DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64
DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7KDBG
DEBUG : volatility.obj : Applying modification from Win7ObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7x64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win2003SP12Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType
DEBUG : volatility.obj : Applying modification from Win2003x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win2003SP12Tcpip
DEBUG : volatility.obj : Applying modification from Win2003SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from Win2003KDBG
DEBUG : volatility.obj : Applying modification from Win2003x86DTB
DEBUG : volatility.obj : Applying modification from Win2003x86Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x86
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls
DEBUG : volatility.obj : Applying modification from Win7SP1x64GuiVTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Win7GuiOverlay
DEBUG : volatility.obj : Applying modification from Win7x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Win7x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7
DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64
DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7KDBG
DEBUG : volatility.obj : Applying modification from Win7ObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7x64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from WinXPSyscalls
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from XPOverlay
DEBUG : volatility.obj : Applying modification from XPx86SessionOverlay
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypesXPx86
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes
DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberVistaSP2x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP2x64Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Vistax64DTB
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes
DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberVistaSP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP1x64Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Vistax64DTB
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes
DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberVistaSP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP1x64Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Vistax64DTB
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls
DEBUG : volatility.obj : Applying modification from Win7SP0x64GuiVTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Win7GuiOverlay
DEBUG : volatility.obj : Applying modification from Win7x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Win7x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7
DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64
DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7KDBG
DEBUG : volatility.obj : Applying modification from Win7ObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7x64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Vista2008Tcpip
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from Win7SP01Syscalls
DEBUG : volatility.obj : Applying modification from Win7SP1x86GuiVTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Win7GuiOverlay
DEBUG : volatility.obj : Applying modification from Win7Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from HiberWin7SP01x86
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Win7Pointer64
DEBUG : volatility.obj : Applying modification from Win7x86DTB
DEBUG : volatility.obj : Applying modification from Win7x86Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7
DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x86
DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7KDBG
DEBUG : volatility.obj : Applying modification from Win7ObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax86
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Vista2008Tcpip
DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from HiberVistaSP01x86
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP1x86Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Vistax86DTB
DEBUG : volatility.obj : Applying modification from Win7Pointer64
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax86
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from VistaSP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes
DEBUG : volatility.obj : Applying modification from VistaSP12x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberVistaSP2x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP2x64Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Vistax64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Vista2008Tcpip
DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from HiberVistaSP2x86
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP2x86Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Vistax86DTB
DEBUG : volatility.obj : Applying modification from Win7Pointer64
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax86
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Vista2008Tcpip
DEBUG : volatility.obj : Applying modification from VistaSP12Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from HiberVistaSP2x86
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP2x86Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Vistax86DTB
DEBUG : volatility.obj : Applying modification from Win7Pointer64
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86
DEBUG : volatility.obj : Applying modification from VistaSP1KDBG
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax86
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win2003SP12Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType
DEBUG : volatility.obj : Applying modification from Win2003x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win2003SP12Tcpip
DEBUG : volatility.obj : Applying modification from Win2003SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from Win2003KDBG
DEBUG : volatility.obj : Applying modification from Win2003x86DTB
DEBUG : volatility.obj : Applying modification from Win2003x86Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x86
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from HiberWin2003x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from Win2003KDBG
DEBUG : volatility.obj : Applying modification from Win2003x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from Win2003x64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Vista2008Tcpip
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from Win7SP01Syscalls
DEBUG : volatility.obj : Applying modification from Win7SP0x86GuiVTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Win7GuiOverlay
DEBUG : volatility.obj : Applying modification from Win7Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from HiberWin7SP01x86
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Win7Pointer64
DEBUG : volatility.obj : Applying modification from Win7x86DTB
DEBUG : volatility.obj : Applying modification from Win7x86Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7
DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x86
DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7KDBG
DEBUG : volatility.obj : Applying modification from Win7ObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax86
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from VistaSP0x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Vista2008x64GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberVistaSP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP0x64Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax64
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Vistax64DTB
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from Win7SP01x64Syscalls
DEBUG : volatility.obj : Applying modification from Win7SP0x64GuiVTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Tcpip
DEBUG : volatility.obj : Applying modification from Win7Vista2008x64Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from Win7GuiOverlay
DEBUG : volatility.obj : Applying modification from Win7x64Tcpip
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from HiberWin7SP01x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Win7x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesWin7x64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesWin7
DEBUG : volatility.obj : Applying modification from ShimCacheTypesWin7x64
DEBUG : volatility.obj : Applying modification from UserAssistWin7VTypes
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7KDBG
DEBUG : volatility.obj : Applying modification from Win7ObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax64
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from Win7Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from Win7x64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Vista2008Tcpip
DEBUG : volatility.obj : Applying modification from VistaSP0Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from Win7Vista2008x86Timers
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from Vista2008x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from HiberVistaSP01x86
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from VistaKDBG
DEBUG : volatility.obj : Applying modification from VistaSP0x86Hiber
DEBUG : volatility.obj : Applying modification from VistaWin7KPCR
DEBUG : volatility.obj : Applying modification from Vistax86DTB
DEBUG : volatility.obj : Applying modification from Win7Pointer64
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from NetscanObjectClasses
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesVista
DEBUG : volatility.obj : Applying modification from ShimCacheTypesVistax86
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from ServiceVista
DEBUG : volatility.obj : Applying modification from ServiceVistax86
DEBUG : volatility.obj : Applying modification from VistaMMVAD
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win2003SP12Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType
DEBUG : volatility.obj : Applying modification from Win2003SP0Syscalls
DEBUG : volatility.obj : Applying modification from Win2003x86GuiVTypes
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win2003SyscallVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from Win2003KDBG
DEBUG : volatility.obj : Applying modification from Win2003x86DTB
DEBUG : volatility.obj : Applying modification from Win2003x86Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x86
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win2003SP0x86DTB
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from HiberWin2003x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from Win2003KDBG
DEBUG : volatility.obj : Applying modification from Win2003x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from Win2003x64DTB
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from HiberWin2003x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from Win2003KDBG
DEBUG : volatility.obj : Applying modification from Win2003x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from Win2003x64DTB
DEBUG : volatility.obj : Applying modification from AtomTablex64Overlay
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win2003SP12x64Syscalls
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx64VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from XP2003x64BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x64TimerVType
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from HiberWin2003x64
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from Win64SyscallVTypes
DEBUG : volatility.obj : Applying modification from WinXP2003Tcpipx64
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from EThreadCreateTime
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from Win2003KDBG
DEBUG : volatility.obj : Applying modification from Win2003x64Hiber
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx64
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from ExFastRefx64
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypes2003x64
DEBUG : volatility.obj : Applying modification from Win2003MMVad
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.obj : Applying modification from WinPEx64VTypes
DEBUG : volatility.obj : Applying modification from Windows64Overlay
DEBUG : volatility.obj : Applying modification from ServiceBasex64
DEBUG : volatility.obj : Applying modification from Win2003x64DTB
DEBUG : volatility.obj : Applying modification from BasicObjectClasses
DEBUG : volatility.obj : Applying modification from ControlAreaModification
DEBUG : volatility.obj : Applying modification from ELF64Modification
DEBUG : volatility.obj : Applying modification from HPAKVTypes
DEBUG : volatility.obj : Applying modification from IEHistoryVTypes
DEBUG : volatility.obj : Applying modification from LimeTypes
DEBUG : volatility.obj : Applying modification from MachoTypes
DEBUG : volatility.obj : Applying modification from MbrObjectTypes
DEBUG : volatility.obj : Applying modification from SSLKeyModification
DEBUG : volatility.obj : Applying modification from UnloadedDriverVTypes
DEBUG : volatility.obj : Applying modification from VMwareVTypesModification
DEBUG : volatility.obj : Applying modification from VirtualBoxModification
DEBUG : volatility.obj : Applying modification from Win32KGahtiVType
DEBUG : volatility.obj : Applying modification from Win32Kx86VTypes
DEBUG : volatility.obj : Applying modification from WinSyscallsAttribute
DEBUG : volatility.obj : Applying modification from WinXPSyscalls
DEBUG : volatility.obj : Applying modification from XP2003x86BaseVTypes
DEBUG : volatility.obj : Applying modification from XP2003x86TimerVType
DEBUG : volatility.obj : Applying modification from WindowsVTypes
DEBUG : volatility.obj : Applying modification from AtomTablex86Overlay
DEBUG : volatility.obj : Applying modification from EVTObjectTypes
DEBUG : volatility.obj : Applying modification from ProcessAuditVTypes
DEBUG : volatility.obj : Applying modification from WindowsOverlay
DEBUG : volatility.obj : Applying modification from MalwareCallbackMods
DEBUG : volatility.obj : Applying modification from MalwarePspCid
DEBUG : volatility.obj : Applying modification from MalwareTimerVTypes
DEBUG : volatility.obj : Applying modification from MalwareWSPVTypes
DEBUG : volatility.obj : Applying modification from TokenXP2003
DEBUG : volatility.obj : Applying modification from UserAssistVTypes
DEBUG : volatility.obj : Applying modification from WinPEObjectClasses
DEBUG : volatility.obj : Applying modification from WinPEVTypes
DEBUG : volatility.obj : Applying modification from WindowsObjectClasses
DEBUG : volatility.obj : Applying modification from XPOverlay
DEBUG : volatility.obj : Applying modification from XPx86SessionOverlay
DEBUG : volatility.obj : Applying modification from CmdHistoryObjectClasses
DEBUG : volatility.obj : Applying modification from CmdHistoryVTypesx86
DEBUG : volatility.obj : Applying modification from CrashInfoModification
DEBUG : volatility.obj : Applying modification from DumpFilesVTypesx86
DEBUG : volatility.obj : Applying modification from KDBGObjectClass
DEBUG : volatility.obj : Applying modification from KPCRProfileModification
DEBUG : volatility.obj : Applying modification from MFTTYPES
DEBUG : volatility.obj : Applying modification from MalwareDrivers
DEBUG : volatility.obj : Applying modification from MalwareIDTGDTx86
DEBUG : volatility.obj : Applying modification from MalwareKthread
DEBUG : volatility.obj : Applying modification from MalwareObjectClasesXP
DEBUG : volatility.obj : Applying modification from ServiceBase
DEBUG : volatility.obj : Applying modification from ShellBagsTypesXP
DEBUG : volatility.obj : Applying modification from ShimCacheTypesXPx86
DEBUG : volatility.obj : Applying modification from Win32KCoreClasses
DEBUG : volatility.utils : Voting round
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.macho.MachOAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: mac: need base
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.lime.LimeAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: lime: need base
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'>
DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No base
Address Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'>
DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: No base
Address Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: No base Address
Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'>
DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: No base
Address Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'>
DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: No base Address
Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'>
DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: No base
Address Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'>
DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: No base Address
Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'>
DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: No base Address
Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.intel.IA32PagedMemory'>
DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: No base Address
Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.standard.FileAddressSpace'>
DEBUG : volatility.utils : Succeeded instantiating
<volatility.plugins.addrspaces.standard.FileAddressSpace object at 0xf0e33d0>
DEBUG : volatility.utils : Voting round
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.macho.MachOAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: MachO Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.lime.LimeAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: Invalid Lime header
signature
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'>
DEBUG1 : volatility.obj : None object instantiated: Invalid hibernation header
DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No xpress
signature found
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'>
DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: Invalid magic
found
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'>
DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: ELF64 Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'>
DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: Invalid VMware
signature: 0x0
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'>
DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'>
DEBUG : volatility.utils : Succeeded instantiating
<volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0xf0e3490>
DEBUG : volatility.utils : Voting round
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.macho.MachOAddressSpace'>
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x0 of size 0x4
DEBUG1 : volatility.utils : Failed instantiating MachOAddressSpace: MachO Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.lime.LimeAddressSpace'>
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x0 of size 0x4
DEBUG1 : volatility.utils : Failed instantiating LimeAddressSpace: Invalid Lime header
signature
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.hibernate.WindowsHiberFileSpace32'>
DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000,
instantiating PO_MEMORY_IMAGE
DEBUG1 : volatility.obj : None object instantiated: Invalid hibernation header
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x0 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x1000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x2000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x3000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x4000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x5000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x6000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x7000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x8000 of size 0x8
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x9000 of size 0x8
DEBUG1 : volatility.utils : Failed instantiating WindowsHiberFileSpace32: No xpress
signature found
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace64'>
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x0 of size 0x8
DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace64: Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.hpak.HPAKAddressSpace'>
DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000,
instantiating HPAK_HEADER
DEBUG1 : volatility.utils : Failed instantiating HPAKAddressSpace: Invalid magic
found
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.vboxelf.VirtualBoxCoreDumpElf64'>
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x0 of size 0x6
DEBUG1 : volatility.utils : Failed instantiating VirtualBoxCoreDumpElf64: ELF64 Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.vmware.VMWareSnapshotFile'>
DEBUG1 : volatility.obj : None object instantiated: Invalid Address 0x00000000,
instantiating _VMWARE_HEADER
DEBUG1 : volatility.utils : Failed instantiating VMWareSnapshotFile: Invalid VMware
signature: -
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.crash.WindowsCrashDumpSpace32'>
DEBUG1 : volatility.obj : None object instantiated: Could not read_chunks from addr
0x0 of size 0x8
DEBUG1 : volatility.utils : Failed instantiating WindowsCrashDumpSpace32: Header
signature invalid
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.amd64.AMD64PagedMemory'>
DEBUG1 : volatility.utils : Failed instantiating AMD64PagedMemory: Can not stack over
another paging address space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.intel.IA32PagedMemoryPae'>
DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemoryPae: Incompatible
profile Win7SP1x64 selected
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.intel.IA32PagedMemory'>
DEBUG1 : volatility.utils : Failed instantiating IA32PagedMemory: Incompatible profile
Win7SP1x64 selected
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.standard.FileAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating FileAddressSpace: Must be first
Address Space
DEBUG : volatility.utils : Trying <class
'volatility.plugins.addrspaces.arm.ArmAddressSpace'>
DEBUG1 : volatility.utils : Failed instantiating ArmAddressSpace: Can not stack over
another paging address space
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d000L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d008L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d010L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d018L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d020L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d028L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d030L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d038L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d040L
DEBUG1 : volatility.obj : None object instantiated: Unable to read_long_long_phys at
0xf8b4c0575d048L
--
Konrads Smelkovs
KPMG LLP
www.kpmg.com/uk/cyber | Love challenge? Work for us:
www.kpmgcareers.co.uk
15 Canada Square
London, E14 5GL
☎ Mobile +44 (0) 7990 987 057
☎ Direct +44 (0) 2076 945 519
✉ E-mail konrads.smelkovs(a)kpmg.co.uk
-----Original Message-----
From: Michael Ligh [mailto:michael.ligh@mnin.org]
Sent: 01 March 2014 21:22
To: Smelkovs, Konrads (London)
Cc: vol-users(a)volatilesystems.com
Subject: Re: [Vol-users] Volatility never finishes on 8 gig Win7SP1x64
Hi Konrads,
Could you paste us the output of:
volatility-2.3.1.standalone.exe -d -d -d -f C:\image.raw kdbgscan --profile=Win7SP1x64
Notice the 3 -d options after the program name. This will enable some extra debugging that
might help us figure out what's going on.
Thanks!
Michael
--------------------------------------------------
Michael Ligh (@iMHLv2)
GPG:
http://mnin.org/gpg.pubkey.txt
Blog:
http://volatility-labs.blogspot.com
Training:
http://memoryanalysis.net
On Mar 1, 2014, at 10:55 AM, "Smelkovs, Konrads (London)"
<Konrads.Smelkovs(a)KPMG.co.uk> wrote:
Hello,
C:\ >volatility-2.3.1.standalone.exe -f C:\image.raw kdbgscan
--profile=Win7SP1x64 Volatility Foundation Volatility Framework 2.3.1
.....
Never finishes - analysing 8 gig dump, CPU max. Help?
This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc,
KPMG Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company
under the control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited
(together, "KPMG"). ELLP does not provide services to clients and none of its
subsidiaries has authority to bind it.
This email, and any attachments, is confidential and may be privileged or otherwise
protected from disclosure. It is intended solely for the stated addressee(s) and access to
it by any other person is unauthorised. If you are not the intended recipient, you must
not disclose, copy, circulate or in any other way use or rely on the information contained
herein. If you have received this email in error, please inform us immediately and delete
all copies of it.
Any communications made with KPMG may be monitored and a record may be kept of any
communication.
Any opinion or advice contained herein is subject to the terms and conditions set out in
your KPMG LLP client engagement letter.
A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered
office.
KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited
liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered
no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited
(registered no. 03580549) are companies registered in England and Wales. Each entity's
registered office is at 15 Canada Square, London, E14 5GL.
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilesystems.com
http://lists.volatilesystems.com/mailman/listinfo/vol-users
This email has been sent by and on behalf of one or more of KPMG LLP, KPMG Audit plc, KPMG
Europe LLP ("ELLP"), KPMG Resource Centre Private Limited or a company under the
control of KPMG LLP, including KPMG United Kingdom plc and KPMG UK Limited (together,
"KPMG"). ELLP does not provide services to clients and none of its subsidiaries
has authority to bind it.
This email, and any attachments, is confidential and may be privileged or otherwise
protected from disclosure. It is intended solely for the stated addressee(s) and access to
it by any other person is unauthorised. If you are not the intended recipient, you must
not disclose, copy, circulate or in any other way use or rely on the information contained
herein. If you have received this email in error, please inform us immediately and delete
all copies of it.
Any communications made with KPMG may be monitored and a record may be kept of any
communication.
Any opinion or advice contained herein is subject to the terms and conditions set out in
your KPMG LLP client engagement letter.
A list of members of KPMG LLP and ELLP is open for inspection at KPMG's registered
office.
KPMG LLP (registered no. OC301540) and ELLP (registered no. OC324045) are limited
liability partnerships registered in England and Wales. Each of KPMG Audit plc (registered
no. 03110745), KPMG United Kingdom plc (registered no. 03513178) and KPMG UK Limited
(registered no. 03580549) are companies registered in England and Wales. Each entity's
registered office is at 15 Canada Square, London, E14 5GL.