Noriben.py

# Noriben Malware Analysis Sandbox
#
# Directions:
# Just copy Noriben.py to a Windows-based VM alongside the Sysinternals Procmon.exe
#
# Run Noriben.py, then run your executable.
# When the executable has completed its processing, stop Noriben and you'll have a clean text report and timeline
#
# Version 1.0 - 10 Apr 13 - @bbaskin - brian@thebaskins.com
#       Gracious edits, revisions, and corrections by Daniel Raygoza
# Version 1.1 - 21 Apr 13 -
#       Much improved filters and filter parsing
# Version 1.1a - 1 May 13 -
#       Revamped regular expression support. Added Python 3.x forward
#       compatibility
# Version 1.2 - 28 May 13 -
#       Now reads CSV files line-by-line to handle large files, keep
#       unsuccessful registry deletes, compartmentalize sections, creates CSV
#       timeline, can reparse PMLs, can specify alternative PMC filters,
#       changed command line arguments, added global whitelist
# Version 1.3 - 13 Sep 13 -
#       Option to generalize file paths in output, option to use a timeout
#       instead of Ctrl-C to end monitoring, only writes RegSetValue entries
#       if Length > 0
# Version 1.4 - 16 Sep 13 -
#       Fixed string generalization on file rename and now supports ()'s in
#       environment name (for 64-bit systems), added ability to Ctrl-C from
#       a timeout, added specifying malware file from command line, added an
#       output directory
# Version 1.5 - 28 Sep 13 -
#       Standardized to single quotes, added YARA scanning of resident files,
#       reformatted function comments to match appropriate docstring format,
#       fixed bug with generalize paths - now generalizes after getting MD5
# Version 1.5b - 1 Oct 13 -
#       Ninja edits to fix a few small bug fixes and change path generalization
#       to an ordered list instead of an unordered dictionary. This lets you
#       prioritize resolutions.
# Version 1.6 - 14 Mar 15 -
#       Long delayed and now forked release. This will be the final release for
#       Python 2.X except for updated rules. Now requires 3rd party libraries.
#       VirusTotal API scanning implemented. Added better filters.
#       Added controls for some registry writes that had size but no data.
#       Added whitelist for MD5 hashes and --hash option for hash file.
#       Renamed 'blacklist' to 'whitelist' because it's supposed to be. LOL
#       Change file handling due to 'read entire file' bug in FileInput.
# Version 1.6.1 - 16 Mar 15 -
#       Soft fails on Requests import. Lack of module now just disables VirusTotal.
#       Added better YARA handling. Instead of failing over a single error, it
#       will skip the offending file. You can now hard-set the YARA signature
#       folder in the script.
# Version 1.6.2 - 9 Apr 15 -
#       Created debug output to file. This now includes full VirusTotal dumps.
#       Currently Noriben only displays number of hits, but additional meta is now
#       dumped for further analysis by users.
# Version 1.6.3 - 13 Jan 16 -
#       Bug fixes to handle path joining. Bug fixes for spaces in all directory
#       names. Added support to find default PMC from script working directory.
# Version 1.6.4 - 7 Dec 16 -
#       A handful of bug fixes related to bad Internet access. Small variable updates.
# Version 1.7.0 - 4 Feb 17 -
#       Default hash method is not SHA256. An argument and global var allow to
#       override hash. Numerous filters added. PEP8 cleanup, multiple small fixes to
#       code and implementation styles.
# Version 1.7.1 - 3 Apr 17 -
#       Small updates. Change --filter to not find default if a bad one is specified.
# Version 1.7.2 - 21 Apr 17 -
#       Fixed Debug output to go to a log file continually, so output is stored if
#       unexpected exit. Check for PML and Config file between executions to account
#       for destructive malware that erases during runtime. Added headless option for
#       automated runs, so that screenshot can be grabbed w/o output on screen.
#
#
# TODO:
# * Upload files directly to VirusTotal (1.7.X feature?)
# * extract data directly from registry? (may require python-registry - http://www.williballenthin.com/registry/)
# * scan for mutexes, preferably in a way that doesn't require wmi/pywin32
# * Fix CSV issues (see GitHub issue)

from __future__ import print_function

import codecs
import hashlib
import io
import os
import re
import subprocess
import sys
import time
from argparse import ArgumentParser
from datetime import datetime
from string import whitespace
from time import sleep
from traceback import format_exc

try:
    import yara
    has_yara = True
except ImportError:
    has_yara = False

try:
    import requests
    import json
    has_internet = True
except ImportError:
    has_internet = False
    print('[!] Python module "requests" not found. Internet functionality is now disabled.')


# The below are customizable variables. Change these as you see fit.
procmon = 'procmon.exe'  # Change this if you have a renamed procmon.exe
generalize_paths = True  # Generalize paths to their base environment variable
enable_timeline = True   # Create a second, compact CSV with events in order
debug = False
timeout_seconds = 0      # Set to 0 to manually end monitoring with Ctrl-C
virustotal_api_key = ''               # Set API here
if os.path.exists('virustotal.api'):  # Or put it in here
    virustotal_api_key = open('virustotal.api', 'r').readline().strip()
yara_folder = ''
hash_type = 'SHA256'
valid_hash_types = ['MD5', 'SHA1', 'SHA256']

# Rules for creating rules:
# 1. Every rule string must begin with the `r` for regular expressions to work.
# 1.a. This signifies a 'raw' string.
# 2. No backslashes at the end of a filter. Either:
# 2.a. truncate the backslash, or
# 2.b. use '\*' to signify 'zero or more slashes'.
# 3. To find a list of available '%%' variables, type `set` from a command prompt

# These entries are applied to all whitelists
global_whitelist = [r'VMwareUser.exe',      # VMware User Tools
                    r'CaptureBAT.exe',      # CaptureBAT Malware Tool
                    r'SearchIndexer.exe',   # Windows Search Indexer
                    r'Fakenet.exe',         # Practical Malware Analysis FakeNET
                    r'idaq.exe',            # IDA Pro
                    r'ngen.exe',            # Windows Native Image Generator
                    r'ngentask.exe',        # Windows Native Image Generator
                    r'consent.exe',         # Windows UAC prompt
                    r'taskhost.exe',
                    r'SearchIndexer.exe'
                    r'RepUx.exe',
                    r'RepMgr64.exe',
                    r'EcatService.exe']

cmd_whitelist = [r'%SystemRoot%\system32\wbem\wmiprvse.exe',
                 r'%SystemRoot%\system32\wscntfy.exe',
                 r'procmon.exe',
                 r'procmon64.exe',
                 r'wuauclt.exe',
                 r'jqs.exe',
                 r'avgrsa.exe',  # AVG AntiVirus
                 r'avgcsrva.exe',  # AVG AntiVirus
                 r'avgidsagenta.exe',  # AVG AntiVirus
                 r'TCPView.exe',
                 r'%WinDir%\System32\mobsync.exe',
                 r'/Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}',  # Thumbnail server
                 r'/Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}',  # DCOM error
                 # r'\??\%WinDir%\system32\conhost.exe -'
                 r'\??\%WinDir%\system32\conhost.exe .*-.*-.*-.*'  # Experimental
                 ] + global_whitelist

file_whitelist = [r'procmon.exe',

                  r'Desired Access: Execute/Traverse',
                  r'Desired Access: Synchronize',
                  r'Desired Access: Generic Read/Execute',
                  r'Desired Access: Read EA',
                  r'Desired Access: Read Data/List',
                  r'Desired Access: Generic Read, ',
                  r'Desired Access: Read Attributes',
                  r'Google\Chrome\User Data\.*.tmp',
                  r'wuauclt.exe',
                  r'wmiprvse.exe',
                  r'Microsoft\Windows\Explorer\iconcache_*',
                  r'Microsoft\Windows\Explorer\thumbcache_.*.db',
                  r'Thumbs.db$',

                  r'%AllUsersProfile%\Application Data\Microsoft\OFFICE\DATA',
                  r'%AllUsersProfile%\Microsoft\RAC',
                  r'%AppData%\Microsoft\Proof\*',
                  r'%AppData%\Microsoft\Templates\*',
                  r'%LocalAppData%\Google\Drive\sync_config.db*',
                  r'%LocalAppData%\GDIPFONTCACHEV1.DAT',
                  r'MAILSLOT\NET\NETLOGON',
                  r'%ProgramFiles%\Capture\*',
                  r'%SystemDrive%\Python',
                  r'%SystemRoot%\assembly',
                  r'%SystemRoot%\Microsoft.NET\Framework64',
                  r'%SystemRoot%\Prefetch\*',
                  r'%SystemRoot%\system32\wbem\Logs\*',
                  r'%SystemRoot%\System32\LogFiles\Scm',
                  r'%SystemRoot%\System32\Tasks\Microsoft\Windows',  # Some may want to remove this
                  r'%UserProfile%$',
                  r'%UserProfile%\Desktop$',
                  r'%UserProfile%\AppData\LocalLow$',
                  r'%UserProfile%\Recent\*',
                  r'%UserProfile%\Local Settings\History\History.IE5\*',
                  r'%WinDir%\AppCompat\Programs\RecentFileCache.bcf',
                  r'%WinDir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*',
                  r'%WinDir%\System32\spool\drivers\*',
                  r'%WinDir%\Temp\fwtsqmfile00.sqm',  # Software Quality Metrics (SQM) from iphlpsvc
                  r'Windows\Temporary Internet Files\counters.dat',
                  r'Program Files.*\confer\*'
                  ] + global_whitelist

reg_whitelist = [r'CaptureProcessMonitor',
                 r'consent.exe',
                 r'procmon.exe',
                 r'verclsid.exe',
                 r'wmiprvse.exe',
                 r'wscntfy.exe',
                 r'wuauclt.exe',
                 r'PROCMON',
                 r'}\DefaultObjectStore\*',

                 r'HKCR$',
                 r'HKCR\AllFilesystemObjects\shell',

                 r'HKCU$',
                 r'HKCU\Printers\DevModePerUser',
                 r'HKCU\SessionInformation\ProgramCount',
                 r'HKCU\Software$',
                 r'HKCU\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide',
                 r'HKCU\Software\Classes\Local Settings\MuiCache\*',
                 r'HKCU\Software\Classes\Local Settings\MrtCache\*',
                 r'HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\SyncMgr\*',
                 r'HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\*',
                 r'HKCU\Software\Microsoft\Calc$',
                 r'HKCU\Software\Microsoft\.*\Window_Placement',
                 r'HKCU\Software\Microsoft\Internet Explorer\TypedURLs',
                 r'HKCU\Software\Microsoft\Notepad',
                 r'HKCU\Software\Microsoft\Office',
                 r'HKCU\Software\Microsoft\Shared Tools',
                 r'HKCU\Software\Microsoft\SystemCertificates\Root$',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Applets',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2',
                 r'HKCU\Software\Microsoft\Windows\Currentversion\Explorer\StreamMRU',
                 r'HKCU\Software\Microsoft\Windows\Currentversion\Explorer\Streams',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\HomeGroup',
                 r'HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\*',
                 r'HKCU\Software\Microsoft\Windows\Shell',
                 r'HKCU\Software\Microsoft\Windows\Shell\BagMRU',
                 r'HKCU\Software\Microsoft\Windows\Shell\Bags',
                 r'HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache',
                 r'HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU',
                 r'HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags',
                 r'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Devices',
                 r'HKCU\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\*',
                 r'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\UserSelectedDefault',
                 r'HKCU\Software\Policies$',
                 r'HKCU\Software\Policies\Microsoft$',

                 r'HKLM$',
                 r'HKLM\.*\Enum$',
                 r'HKLM\SOFTWARE$',
                 r'HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed',  # Some people prefer to leave this in.
                 r'HKLM\SOFTWARE\Microsoft$',
                 r'HKLM\SOFTWARE\MICROSOFT\Dfrg\Statistics',
                 r'HKLM\SOFTWARE\Microsoft\Reliability Analysis\RAC',
                 r'HKLM\SOFTWARE\MICROSOFT\SystemCertificates$',
                 r'HKLM\Software\Microsoft\WBEM',
                 r'HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products',
                 r'HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\*',
                 r'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render',
                 r'HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions',
                 r'HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\*',
                 r'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\*',
                 r'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\*',
                 r'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Prefetcher\*',
                 r'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\*',
                 r'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Tracing\*',
                 r'HKLM\SOFTWARE\Policies$',
                 r'HKLM\SOFTWARE\Policies\Microsoft$',
                 r'HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{',
                 r'HKLM\SOFTWARE\Wow6432Node\Google\Update\old-uid',
                 r'HKLM\SOFTWARE\Wow6432Node\Google\Update\uid',

                 r'HKLM\System\CurrentControlSet\Control\CLASS\{.*-E325-11CE-BFC1-08002BE10318}',
                 r'HKLM\System\CurrentControlSet\Control\DeviceClasses',
                 r'HKLM\System\CurrentControlSet\Control\MediaProperties',
                 r'HKLM\System\CurrentControlSet\Control\Network\{.*-e325-11ce-bfc1-08002be10318}',
                 r'HKLM\System\CurrentControlSet\Control\Network\NetCfgLockHolder',
                 r'HKLM\System\CurrentControlSet\Control\Nsi\{eb004a03-9b1a-11d4-9123-0050047759bc}',
                 r'HKLM\System\CurrentControlSet\Control\Print\Environments\*',
                 r'HKLM\System\CurrentControlSet\Enum\*',
                 r'HKLM\System\CurrentControlSet\Services\CaptureRegistryMonitor',
                 r'HKLM\System\CurrentControlSet\Services\Eventlog\*',
                 r'HKLM\System\CurrentControlSet\Services\Tcpip\Parameters',
                 r'HKLM\System\CurrentControlSet\Services\WinSock2\Parameters',
                 r'HKLM\System\CurrentControlSet\Services\VSS\Diag',

                 r'HKU\.DEFAULT\Printers\*',
                 r'HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache',

                 r'LEGACY_CAPTUREREGISTRYMONITOR',
                 r'Software\Microsoft\Multimedia\Audio$',
                 r'Software\Microsoft\Multimedia\Audio Compression Manager',
                 r'Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder',
                 r'Software\Microsoft\Windows\ShellNoRoam\Bags',
                 r'Software\Microsoft\Windows\ShellNoRoam\BagMRU',
                 r'Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc',
                 r'Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs',
                 r'Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders',
                 r'Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders',
                 r'UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}',
                 r'UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}',
                 r'UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}'
                 ] + global_whitelist

net_whitelist = [r'hasplms.exe'                       # Hasp dongle beacons
                 # r'192.168.2.',                     # Example for blocking net ranges
                 # r'Verizon_router.home']            # Example for blocking local domains
                 # r' -> .*\..*\..*\..*:1900
                 ] + global_whitelist

hash_whitelist = [r'f8f0d25ca553e39dde485d8fc7fcce89',  # WinXP ntdll.dll
                  r'b60dddd2d63ce41cb8c487fcfbb6419e',  # iexplore.exe 8.0
                  r'6fe42512ab1b89f32a7407f261b1d2d0',  # kernel32.dll
                  r'8b1f3320aebb536e021a5014409862de',  # gdi32.dll
                  r'b26b135ff1b9f60c9388b4a7d16f600b',  # user32.dll
                  r'355edbb4d412b01f1740c17e3f50fa00',  # msvcrt.dll
                  r'd4502f124289a31976130cccb014c9aa',  # rpcrt4.dll
                  r'81faefc42d0b236c62c3401558867faa',  # iertutil.dll
                  r'e40fcf943127ddc8fd60554b722d762b',  # msctf.dll
                  r'0da85218e92526972a821587e6a8bf8f']  # imm32.dll


# Below are global internal variables. Do not edit these. ################
__VERSION__ = '1.7.2'                                                    #
path_general_list = []                                                   #
virustotal_upload = True if virustotal_api_key else False  # TODO        #
use_virustotal = True if virustotal_api_key and has_internet else False  #
use_pmc = False                                                          #
vt_results = {}                                                          #
vt_dump = list()                                                         #
debug_messages = list()                                                  #
exe_cmdline = ''                                                         #
output_dir = ''                                                          #
time_exec = 0                                                            #
time_process = 0                                                         #
script_cwd = ''                                                          #
debug_file = ''                                                          #
headless = False                                                         #
##########################################################################


def log_debug(msg):
    """
    Logs a passed message. Results are printed and stored in
    a list for later writing to the debug log.

    Arguments:
        msg: Text string of message.
    Results:
        none
    """
    global debug_messages
    if msg and debug:
        print(msg)

        if debug_file:  # File already set, check for message buffer
            if debug_messages:  # If buffer, write and erase buffer
                hdbg = open(debug_file, 'a')
                for item in debug_messages:
                    hdbg.write(item)
                hdbg.close()
                debug_messages = list()
            else:
                open(debug_file, 'a').write('{}\n'.format(msg))
        else:  # Output file hasn't been set yet, append to buffer
            debug_messages.append(msg + '\r\n')


def generalize_vars_init():
    """
    Initialize a dictionary with the local system's environment variables.
    Returns via a global variable, path_general_list
    """
    envvar_list = [r'%AllUsersProfile%',
                   r'%LocalAppData%',
                   r'%AppData%',
                   r'%CommonProgramFiles%',
                   r'%ProgramData%',
                   r'%ProgramFiles%',
                   r'%ProgramFiles(x86)%',
                   r'%Public%',
                   r'%Temp%',
                   r'%UserProfile%',
                   r'%WinDir%']

    global path_general_list
    log_debug('[*] Enabling Windows string generalization.')
    for env in envvar_list:
        try:
            resolved = os.path.expandvars(env).encode('unicode_escape')
            resolved = resolved.replace(b'(', b'\\(').replace(b')', b'\\)')
            if not resolved == env and not resolved == env.replace(b'(', b'\\(').replace(b')', b'\\)'):
                path_general_list.append([env, resolved])
        except TypeError:
            if resolved in locals():
                log_debug('[!] generalize_vars_init(): Unable to parse var: %s' % resolved)
            continue


def generalize_var(path_string):
    """
    Generalize a given string to include its environment variable

    Arguments:
        path_string: string value to generalize
    Results:
        string value of a generalized string
    """
    if not len(path_general_list):
        generalize_vars_init()  # For edge cases when this isn't previously called.
    for item in path_general_list:
        path_string = re.sub(item[1], item[0], path_string)
    return path_string


def read_hash_file(hash_filename):
    """
    Read a given file of SHA256 hashes and add them to the hash whitelist.

    Arguments:
        hash_filename: path to a text file containing hashes (either flat or sha256deep)
    """
    global hash_whitelist
    for line_num, hash_line in enumerate(io.open(hash_filename, encoding='utf-8')):
        hashval = hash_line.split()[0]
        try:
            if int(hashval, 16) and (len(hashval) == 32 or len(hashval) == 40 or len(hashval) == 64):
                hash_whitelist.append(hashval)
        except (TypeError, ValueError):
            pass


def virustotal_query_hash(hashval):
    """
    Submit a given hash to VirusTotal to retrieve number of alerts

    Arguments:
        hashval: SHA256 hash to a given file
    """
    global vt_results
    global vt_dump
    result = ''
    try:
        if not (int(hashval, 16) and (len(hashval) == 32 or len(hashval) == 40 or len(hashval) == 64)):
            return ''
    except (TypeError, ValueError):
        pass

    try:
        previous_result = vt_results[hashval]
        log_debug('[*] VT scan already performed for %s. Returning previous: %s' % (hashval, previous_result))
        return previous_result
    except KeyError:
        pass

    vt_query_url = 'https://www.virustotal.com/vtapi/v2/file/report'
    post_params = {'apikey': virustotal_api_key,
                   'resource': hashval}
    log_debug('[*] Querying VirusTotal for hash: %s' % hashval)
    data = ''
    try:
        http_response = requests.post(vt_query_url, post_params)
    except requests.exceptions.RequestException:
        return ''  # null string to append to output

    if http_response.status_code == 204:
        print('[!] VirusTotal Rate Limit Exceeded. Sleeping for 60 seconds.')
        time.sleep(60)
        return virustotal_query_hash(hashval)
    else:
        try:
            data = http_response.json()
        except ValueError:
            result = 'Error'

        try:
            if data['response_code'] == -2:
                result = ' [VT: Queued]'
            elif data['response_code'] == -1:
                result = ' [VT: Error 001]'
            elif data['response_code'] == 0:
                result = ' [VT: Not Scanned]'
            elif data['response_code'] == 1:
                if data['total']:
                    vt_dump.append(data)
                    result = ' [VT: %s/%s]' % (data['positives'], data['total'])
                else:
                    result = ' [VT: Error 002]'
        except TypeError:
            result = ' [VT: Error 003]'
    vt_results[hashval] = result
    log_debug('[*] VirusTotal result for hash %s: %s' % (hashval, result))
    return result


def yara_rule_check(yara_files):
    """
    Scan a dictionary of YARA rule files to determine
    which are valid for compilation.

    Arguments:
        yara_files: path to folder containing rules
    """
    result = dict()
    for yara_id in yara_files:
        fname = yara_files[yara_id]
        try:
            yara.compile(filepath=fname)
            result[yara_id] = fname
        except yara.SyntaxError:
            log_debug('[!] Syntax Error found in YARA file: %s' % fname)
            log_debug(format_exc())
    return result


def yara_import_rules(yara_path):
    """
    Import a folder of YARA rule files

    Arguments:
        yara_path: path to folder containing rules
    Results:
        rules: a yara.Rules structure of available YARA rules
    """
    yara_files = {}
    if not yara_path[-1] == '\\':
        yara_path += '\\'

    print('[*] Loading YARA rules from folder: %s' % yara_path)
    files = os.listdir(yara_path)

    for file_name in files:
        if '.yara' in file_name:
            yara_files[file_name.split('.yara')[0]] = yara_path + file_name

    yara_files = yara_rule_check(yara_files)
    rules = ''
    if yara_files:
        try:
            rules = yara.compile(filepaths=yara_files)
            print('[*] YARA rules loaded. Total files imported: %d' % len(yara_files))
        except yara.SyntaxError:
            print('[!] YARA: Unknown Syntax Errors found.')
            print('[!] YARA rules disabled until all Syntax Errors are fixed.')
            log_debug('[!] YARA: Unknown Syntax Errors found.')
            log_debug('[!] YARA rules disabled until all Syntax Errors are fixed.')
    return rules


def yara_filescan(file_path, rules):
    """
    Scan a given file to see if it matches a given set of YARA rules

    Arguments:
        file_path: full path to a file to scan
        rules: a yara.Rules structure of available YARA rules
    Results:
        results: a string value that's either null (no hits)
                 or formatted with hit results
    """
    if not rules:
        return ''
    try:
        matches = rules.match(file_path)
    except yara.Error:  # If can't open file
        log_debug('[!] YARA can\'t open file: %s' % file_path)
        return ''
    if matches:
        results = '\t[YARA: %s]' % \
                  reduce(lambda x, y: str(x) + ', ' + str(y), matches)
    else:
        results = ''
    return results


def open_file_with_assoc(fname):
    """
    Opens the specified file with its associated application

    Arguments:
        fname: full path to a file to open
    Results:
        None
    """
    if headless:
        # Headless is for automated runs, don't open results on VM
        return

    if os.name == 'mac':
        subprocess.call(('open', fname))
    elif os.name == 'nt':
        os.startfile(fname)
    elif os.name == 'posix':
        subprocess.call(('open', fname))


def file_exists(fname):
    """
    Determine if a file exists

    Arguments:
        fname: path to a file
    Results:
        boolean value if file exists
    """
    return os.path.exists(fname) and os.access(fname, os.F_OK)


def check_procmon():
    """
    Finds the local path to Procmon

    Results:
        folder path to procmon executable
    """
    global procmon

    if file_exists(procmon):
        return procmon
    else:
        for path in os.environ['PATH'].split(os.pathsep):
            if file_exists(os.path.join(path.strip('"'), procmon)):
                return os.path.join(path, procmon)
        if file_exists(os.path.join(script_cwd, procmon)):
            return os.path.join(script_cwd, procmon)


def hash_file(fname):
    """
    Given a filename, returns the hex hash value

    Arguments:
        fname: path to a file
    Results:
        hex hash value of file's contents as a string
    """
    if hash_type == 'MD5':
        return hashlib.md5(codecs.open(fname, 'rb').read()).hexdigest()
    elif hash_type == 'SHA1':
        return hashlib.sha1(codecs.open(fname, 'rb').read()).hexdigest()
    elif hash_type == 'SHA256':
        return hashlib.sha256(codecs.open(fname, 'rb').read()).hexdigest()


def get_session_name():
    """
    Returns current date and time stamp for file name

    Results:
        string value of a current timestamp to apply to log file names
    """
    return datetime.now().strftime('%d_%b_%y__%H_%M_%S_%f')


def protocol_replace(text):
    """
    Replaces text name resolutions from domain names

    Arguments:
        text: string of domain with resolved port name
    Results:
        string value with resolved port name in decimal format
    """
    replacements = [(':https', ':443'),
                    (':http', ':80'),
                    (':domain', ':53')]
    for find, replace in replacements:
        text = text.replace(find, replace)
    return text


def whitelist_scan(whitelist, data):
    """
    Given a whitelist and data string, see if data is in whitelist

    Arguments:
        whitelist: list of black-listed items
        data: string value to compare against whitelist
    Results:
        boolean value of if item exists in whitelist
    """
    for event in data:
        for bad in whitelist:
            bad = os.path.expandvars(bad).replace('\\', '\\\\')
            try:
                if re.search(bad, event, flags=re.IGNORECASE):
                    return True
            except re.error:
                log_debug('[!] Error found while processing filters.\r\nFilter:\t%s\r\nEvent:\t%s' % (bad, event))
                log_debug(format_exc())
                return False
    return False


def process_pml_to_csv(procmonexe, pml_file, pmc_file, csv_file):
    """
    Uses Procmon to convert the PML to a CSV file

    Arguments:
        procmonexe: path to Procmon executable
        pml_file: path to Procmon PML output file
        pmc_file: path to PMC filter file
        csv_file: path to output CSV file
    Results:
        None
    """
    global time_process
    time_convert_start = time.time()

    log_debug('[*] Converting session to CSV: %s' % csv_file)
    if not file_exists(pml_file):
        print('[!] Error detected. PML file was not found: %s' % pml_file)
        sys.exit(1)
    cmdline = '"%s" /OpenLog "%s" /saveas "%s"' % (procmonexe, pml_file, csv_file)
    if use_pmc and file_exists(pmc_file):
        cmdline += ' /LoadConfig "%s"' % pmc_file
    log_debug('[*] Running cmdline: %s' % cmdline)
    stdnull = subprocess.Popen(cmdline)
    stdnull.wait()

    time_convert_end = time.time()
    time_process = time_convert_end - time_convert_start


def launch_procmon_capture(procmonexe, pml_file, pmc_file):
    """
    Launch Procmon to begin capturing data

    Arguments:
        procmonexe: path to Procmon executable
        pml_file: path to Procmon PML output file
        pmc_file: path to PMC filter file
    Results:
        None
    """
    global time_exec
    time_exec = time.time()

    cmdline = '"%s" /BackingFile "%s" /Quiet /Minimized' % (procmonexe, pml_file)
    if use_pmc and file_exists(pmc_file):
        cmdline += ' /LoadConfig "%s"' % pmc_file
    log_debug('[*] Running cmdline: %s' % cmdline)
    subprocess.Popen(cmdline)
    sleep(3)


def terminate_procmon(procmonexe):
    """
    Terminate Procmon cleanly

    Arguments:
        procmonexe: path to Procmon executable
    Results:
        None
    """
    global time_exec
    time_exec = time.time() - time_exec

    cmdline = '"%s" /Terminate' % procmonexe
    log_debug('[*] Running cmdline: %s' % cmdline)
    stdnull = subprocess.Popen(cmdline)
    stdnull.wait()


def parse_csv(csv_file, report, timeline):
    """
    Given the location of CSV and TXT files, parse the CSV for notable items

    Arguments:
        csv_file: path to csv output to parse
        report: OUT string text containing the entirety of the text report
        timeline: OUT string text containing the entirety of the CSV report
    """
    process_output = list()
    file_output = list()
    reg_output = list()
    net_output = list()
    error_output = list()
    remote_servers = list()
    if yara_folder and has_yara:
        yara_rules = yara_import_rules(yara_folder)
    else:
        yara_rules = ''

    log_debug('[*] Processing CSV: %s' % csv_file)

    time_parse_csv_start = time.time()

    # Use fileinput.input() now to read data line-by-line
    # for original_line in fileinput.input(csv_file, openhook=fileinput.hook_encoded('iso-8859-1')):
    for line_num, original_line in enumerate(io.open(csv_file, encoding='utf-8')):
        server = ''
        if original_line[0] != '"':  # Ignore lines that begin with Tab.
            continue
        line = original_line.strip(whitespace + '"')
        field = line.strip().split('","')
        log_debug('[*] Parse line. Event: %s' % field[3])
        try:
            if field[3] in ['Process Create'] and field[5] == 'SUCCESS':
                cmdline = field[6].split('Command line: ')[1]
                if not whitelist_scan(cmd_whitelist, field):
                    if generalize_paths:
                        cmdline = generalize_var(cmdline)
                    child_pid = field[6].split('PID: ')[1].split(',')[0]
                    outputtext = '[CreateProcess] %s:%s > "%s"\t[Child PID: %s]' % (
                        field[1], field[2], cmdline.replace('"', ''), child_pid)
                    tl_text = '%s,Process,CreateProcess,%s,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                        field[2], cmdline.replace('"', ''), child_pid)
                    process_output.append(outputtext)
                    timeline.append(tl_text)

            elif field[3] == 'CreateFile' and field[5] == 'SUCCESS':
                if not whitelist_scan(file_whitelist, field):
                    path = field[4]
                    yara_hits = ''
                    if yara_folder and yara_rules:
                        yara_hits = yara_filescan(path, yara_rules)
                    if os.path.isdir(path):
                        if generalize_paths:
                            path = generalize_var(path)
                        outputtext = '[CreateFolder] %s:%s > %s' % (field[1], field[2], path)
                        tl_text = '%s,File,CreateFolder,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                     field[2], path)
                        file_output.append(outputtext)
                        timeline.append(tl_text)
                    else:
                        try:
                            hashval = hash_file(path)
                            if hashval in hash_whitelist:
                                log_debug('[_] Skipping hash: %s' % hashval)
                                continue

                            av_hits = ''
                            if use_virustotal and has_internet:
                                av_hits = virustotal_query_hash(hashval)

                            if generalize_paths:
                                path = generalize_var(path)
                            outputtext = '[CreateFile] %s:%s > %s\t[%s: %s]%s%s' % (field[1], field[2], path, hash_type,
                                                                                    hashval, yara_hits, av_hits)
                            tl_text = '%s,File,CreateFile,%s,%s,%s,%s,%s,%s,%s' % (field[0].split()[0].split('.')[0],
                                                                                   field[1], field[2], path,
                                                                                   hash_type, hashval, yara_hits,
                                                                                   av_hits)
                            file_output.append(outputtext)
                            timeline.append(tl_text)
                        except (IndexError, IOError):
                            if generalize_paths:
                                path = generalize_var(path)
                            outputtext = '[CreateFile] %s:%s > %s\t[File no longer exists]' % (field[1], field[2], path)
                            tl_text = '%s,File,CreateFile,%s,%s,%s,N/A' % (field[0].split()[0].split('.')[0],
                                                                           field[1], field[2], path)
                            file_output.append(outputtext)
                            timeline.append(tl_text)

            elif field[3] == 'SetDispositionInformationFile' and field[5] == 'SUCCESS':
                if not whitelist_scan(file_whitelist, field):
                    path = field[4]
                    if generalize_paths:
                        path = generalize_var(path)
                    outputtext = '[DeleteFile] %s:%s > %s' % (field[1], field[2], path)
                    tl_text = '%s,File,DeleteFile,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                               field[2], path)
                    file_output.append(outputtext)
                    timeline.append(tl_text)

            elif field[3] == 'SetRenameInformationFile':
                if not whitelist_scan(file_whitelist, field):
                    from_file = field[4]
                    to_file = field[6].split('FileName: ')[1].strip('"')
                    if generalize_paths:
                        from_file = generalize_var(from_file)
                        to_file = generalize_var(to_file)
                    outputtext = '[RenameFile] %s:%s > %s => %s' % (field[1], field[2], from_file, to_file)
                    tl_text = '%s,File,RenameFile,%s,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                  field[2], from_file, to_file)
                    file_output.append(outputtext)
                    timeline.append(tl_text)

            elif field[3] == 'RegCreateKey' and field[5] == 'SUCCESS':
                if not whitelist_scan(reg_whitelist, field):
                    outputtext = '[RegCreateKey] %s:%s > %s' % (field[1], field[2], field[4])
                    if outputtext not in reg_output:  # Ignore multiple CreateKeys. Only log the first.
                        tl_text = '%s,Registry,RegCreateKey,%s,%s,%s' % (field[0].split()[0].split('.')[0],
                                                                         field[1], field[2], field[4])
                        reg_output.append(outputtext)
                        timeline.append(tl_text)

            elif field[3] == 'RegSetValue' and field[5] == 'SUCCESS':
                if not whitelist_scan(reg_whitelist, field):
                    reg_length = field[6].split('Length:')[1].split(',')[0].strip(whitespace + '"')
                    try:
                        if int(reg_length):
                            if 'Data:' in field[6]:
                                data_field = '  =  %s' % field[6].split('Data:')[1].strip(whitespace + '"')
                                if len(data_field.split(' ')) == 16:
                                    data_field += ' ...'
                            elif 'Length:' in field[6]:
                                data_field = ''
                            else:
                                continue
                            outputtext = '[RegSetValue] %s:%s > %s%s' % (field[1], field[2], field[4], data_field)
                            tl_text = '%s,Registry,RegSetValue,%s,%s,%s,%s' % (field[0].split()[0].split('.')[0],
                                                                               field[1], field[2], field[4], data_field)
                            reg_output.append(outputtext)
                            timeline.append(tl_text)

                    except (IndexError, ValueError):
                        error_output.append(original_line.strip())

            elif field[3] == 'RegDeleteValue':  # and field[5] == 'SUCCESS':
                # SUCCESS is commented out to allows all attempted deletions, whether or not the value exists
                if not whitelist_scan(reg_whitelist, field):
                    outputtext = '[RegDeleteValue] %s:%s > %s' % (field[1], field[2], field[4])
                    tl_text = '%s,Registry,RegDeleteValue,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                       field[2], field[4])
                    reg_output.append(outputtext)
                    timeline.append(tl_text)

            elif field[3] == 'RegDeleteKey':  # and field[5] == 'SUCCESS':
                # SUCCESS is commented out to allows all attempted deletions, whether or not the value exists
                if not whitelist_scan(reg_whitelist, field):
                    outputtext = '[RegDeleteKey] %s:%s > %s' % (field[1], field[2], field[4])
                    tl_text = '%s,Registry,RegDeleteKey,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                     field[2], field[4])
                    reg_output.append(outputtext)
                    timeline.append(tl_text)

            elif field[3] == 'UDP Send' and field[5] == 'SUCCESS':
                if not whitelist_scan(net_whitelist, field):
                    server = field[4].split('-> ')[1]
                    # TODO: work on this later, once I can verify it better.
                    # if field[6] == 'Length: 20':
                    #    output_line = '[DNS Query] %s:%s > %s' % (field[1], field[2], protocol_replace(server))
                    # else:
                    outputtext = '[UDP] %s:%s > %s' % (field[1], field[2], protocol_replace(server))
                    if outputtext not in net_output:
                        tl_text = '%s,Network,UDP Send,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                    field[2], protocol_replace(server))
                        net_output.append(outputtext)
                        timeline.append(tl_text)

            elif field[3] == 'UDP Receive' and field[5] == 'SUCCESS':
                if not whitelist_scan(net_whitelist, field):
                    server = field[4].split('-> ')[1]
                    outputtext = '[UDP] %s > %s:%s' % (protocol_replace(server), field[1], field[2])
                    if outputtext not in net_output:
                        tl_text = '%s,Network,UDP Receive,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                    field[2])
                        net_output.append(outputtext)
                        timeline.append(tl_text)

            elif field[3] == 'TCP Send' and field[5] == 'SUCCESS':
                if not whitelist_scan(net_whitelist, field):
                    server = field[4].split('-> ')[1]
                    outputtext = '[TCP] %s:%s > %s' % (field[1], field[2], protocol_replace(server))
                    if outputtext not in net_output:
                        tl_text = '%s,Network,TCP Send,%s,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                    field[2], protocol_replace(server))
                        net_output.append(outputtext)
                        timeline.append(tl_text)

            elif field[3] == 'TCP Receive' and field[5] == 'SUCCESS':
                if not whitelist_scan(net_whitelist, field):
                    server = field[4].split('-> ')[1]
                    outputtext = '[TCP] %s > %s:%s' % (protocol_replace(server), field[1], field[2])
                    if outputtext not in net_output:
                        tl_text = '%s,Network,TCP Receive,%s,%s' % (field[0].split()[0].split('.')[0], field[1],
                                                                    field[2])
                        net_output.append(outputtext)
                        timeline.append(tl_text)

        except IndexError:
            log_debug(line)
            log_debug(format_exc())
            error_output.append(original_line.strip())

        # Enumerate unique remote hosts into their own section
        if server:
            server = server.split(':')[0]
            if server not in remote_servers and server != 'localhost':
                remote_servers.append(server)
    # } End of file input processing

    time_parse_csv_end = time.time()

    report.append('-=] Sandbox Analysis Report generated by Noriben v%s' % __VERSION__)
    report.append('-=] Developed by Brian Baskin: brian @@ thebaskins.com  @bbaskin')
    report.append('-=] The latest release can be found at https://github.com/Rurik/Noriben')
    report.append('')
    if exe_cmdline:
        report.append('-=] Analysis of command line: %s' % exe_cmdline)

    if time_exec:
        report.append('-=] Execution time: %0.2f seconds' % time_exec)
    if time_process:
        report.append('-=] Processing time: %0.2f seconds' % time_process)

    time_analyze = time_parse_csv_end - time_parse_csv_start
    report.append('-=] Analysis time: %0.2f seconds' % time_analyze)
    report.append('')

    report.append('Processes Created:')
    report.append('==================')
    log_debug('[*] Writing %d Process Events results to report' % len(process_output))
    for event in process_output:
        report.append(event)

    report.append('')
    report.append('File Activity:')
    report.append('==================')
    log_debug('[*] Writing %d Filesystem Events results to report' % len(file_output))
    for event in file_output:
        report.append(event)

    report.append('')
    report.append('Registry Activity:')
    report.append('==================')
    log_debug('[*] Writing %d Registry Events results to report' % len(reg_output))
    for event in reg_output:
        report.append(event)

    report.append('')
    report.append('Network Traffic:')
    report.append('==================')
    log_debug('[*] Writing %d Network Events results to report' % len(net_output))
    for event in net_output:
        report.append(event)

    report.append('')
    report.append('Unique Hosts:')
    report.append('==================')
    log_debug('[*] Writing %d Remote Servers results to report' % len(remote_servers))
    for server in sorted(remote_servers):
        report.append(protocol_replace(server).strip())

    if error_output:
        report.append('\r\n\r\n\r\n\r\n\r\n\r\nERRORS DETECTED')
        report.append('The following items could not be parsed correctly:')
        log_debug('[*] Writing %d Output Errors results to report' % len(error_output))
        for error in error_output:
            report.append(error)

    if debug and vt_dump:
        vt_file = os.path.join(output_dir, os.path.splitext(csv_file)[0] + '.vt.json')
        log_debug('[*] Writing %d VirusTotal results to %s' % (len(vt_dump), vt_file))
        vt_out = open(vt_file, 'w')
        json.dump(vt_dump, vt_out)
        vt_out.close()

    if debug and debug_messages:
        debug_out = open(debug_file, 'a')
        for message in debug_messages:
            debug_out.write(message)
        debug_out.close()
# End of parse_csv()


def main():
    """
    Main routine, parses arguments and calls other routines
    """
    global generalize_paths
    global timeout_seconds
    global yara_folder
    global use_pmc
    global debug
    global exe_cmdline
    global output_dir
    global script_cwd
    global hash_type
    global debug_file
    global headless

    print('--===[ Noriben v%s' % __VERSION__)
    print('--===[ @bbaskin')

    parser = ArgumentParser()
    parser.add_argument('-c', '--csv', help='Re-analyze an existing Noriben CSV file', required=False)
    parser.add_argument('-p', '--pml', help='Re-analyze an existing Noriben PML file', required=False)
    parser.add_argument('-f', '--filter', help='Specify alternate Procmon Filter PMC', required=False)
    parser.add_argument('--hash', help='Specify hash whitelist file', required=False)
    parser.add_argument('--hashtype', help='Specify hash type', required=False, choices=valid_hash_types)
    parser.add_argument('--headless', action='store_true', help='Do not open results on VM after processing',
                        required=False)
    parser.add_argument('-t', '--timeout', help='Number of seconds to collect activity', required=False, type=int)
    parser.add_argument('--output', help='Folder to store output files', required=False)
    parser.add_argument('--yara', help='Folder containing YARA rules', required=False)
    parser.add_argument('--generalize', dest='generalize_paths', default=False, action='store_true',
                        help='Generalize file paths to their environment variables. Default: %s' % generalize_paths,
                        required=False)
    parser.add_argument('--cmd', help='Command line to execute (in quotes)', required=False)
    parser.add_argument('-d', '--debug', action='store_true', help='Enable debugging', required=False)
    args = parser.parse_args()
    report = list()
    timeline = list()
    script_cwd = os.path.dirname(os.path.abspath(__file__))

    if args.debug:
        debug = True

    # Check to see if string generalization is wanted
    if args.generalize_paths:
        generalize_paths = True
        generalize_vars_init()

    if args.headless:
        headless = True

    if args.hashtype:
        hash_type = args.hashtype

    # Load hash whitelist and append to global white list
    if args.hash:
        if file_exists(args.hash):
            read_hash_file(args.hash)

    # Check for a valid filter file
    if args.filter:
        if file_exists(args.filter):
            pmc_file = args.filter
        else:
            pmc_file = ''
    else:
        pmc_file = 'ProcmonConfiguration.PMC'
    pmc_file_cwd = os.path.join(script_cwd, pmc_file)

    if pmc_file:
        if not file_exists(pmc_file):
            if not file_exists(pmc_file_cwd):
                use_pmc = False
                print('[!] Filter file %s not found. Continuing without filters.' % pmc_file)
            else:
                use_pmc = True
                pmc_file = pmc_file_cwd
                print('[*] Using filter file: %s' % pmc_file)
        else:
            use_pmc = True
            print('[*] Using filter file: %s' % pmc_file)
            log_debug('[*] Using filter file: %s' % pmc_file)
    else:
        use_pmc = False

    # Find a valid procmon executable.
    procmonexe = check_procmon()
    if not procmonexe:
        print('[!] Unable to find Procmon (%s) in path.' % procmon)
        sys.exit(2)

    # Check to see if specified output folder exists. If not, make it.
    # This only works one path deep. In future, may make it recursive.
    if args.output:
        output_dir = args.output
        if not os.path.exists(output_dir):
            try:
                os.mkdir(output_dir)
            except WindowsError:
                print('[!] Fatal: Unable to create output directory: %s' % output_dir)
                sys.exit(3)
    else:
        output_dir = ''
    log_debug('[*] Log output directory: %s' % output_dir)

    # Check to see if specified YARA folder exists
    use_yara = False
    if args.yara or yara_folder:
        if not yara_folder:
            yara_folder = args.yara
        if not yara_folder[-1] == '\\':
            yara_folder += '\\'
        if not os.path.exists(yara_folder):
            print('[!] YARA rule path not found: %s' % yara_folder)
            yara_folder = ''
            use_yara = False
        else:
            use_yara = True
    log_debug('[*] YARA directory: %s' % yara_folder)

    # Print feature list
    print('[+] Features: (Debug: %s\tYARA: %s\tVirusTotal: %s)' % (debug, use_yara, use_virustotal))
    log_debug('[+] Features: (Debug: %s\tYARA: %s\tVirusTotal: %s)' % (debug, use_yara, use_virustotal))

    # Check if user-specified to rescan a PML
    if args.pml:
        if file_exists(args.pml):
            # Reparse an existing PML
            csv_file = os.path.join(output_dir, os.path.splitext(args.pml)[0] + '.csv')
            txt_file = os.path.join(output_dir, os.path.splitext(args.pml)[0] + '.txt')
            debug_file = os.path.join(output_dir, os.path.splitext(args.pml)[0] + '.log')
            timeline_file = os.path.join(output_dir, os.path.splitext(args.pml)[0] + '_timeline.csv')

            process_pml_to_csv(procmonexe, args.pml, pmc_file, csv_file)
            if not file_exists(csv_file):
                print('[!] Error detected. Could not create CSV file: %s' % csv_file)
                sys.exit(5)

            parse_csv(csv_file, report, timeline)

            print('[*] Saving report to: %s' % txt_file)
            codecs.open(txt_file, 'w', 'utf-8').write('\r\n'.join(report))

            print('[*] Saving timeline to: %s' % timeline_file)
            codecs.open(timeline_file, 'w', 'utf-8').write('\r\n'.join(timeline))

            open_file_with_assoc(txt_file)
            sys.exit(0)
        else:
            print('[!] PML file does not exist: %s\n' % args.pml)
            parser.print_usage()
            sys.exit(1)

    # Check if user-specified to rescan a CSV
    if args.csv:
        if file_exists(args.csv):
            # Reparse an existing CSV
            txt_file = os.path.splitext(args.csv)[0] + '.txt'
            debug_file = os.path.splitext(args.csv)[0] + '.log'
            timeline_file = os.path.splitext(args.csv)[0] + '_timeline.csv'

            parse_csv(args.csv, report, timeline)

            print('[*] Saving report to: %s' % txt_file)
            codecs.open(txt_file, 'w', 'utf-8').write('\r\n'.join(report))

            print('[*] Saving timeline to: %s' % timeline_file)
            codecs.open(timeline_file, 'w', 'utf-8').write('\r\n'.join(timeline))

            open_file_with_assoc(txt_file)
            sys.exit(0)
        else:
            parser.print_usage()
            sys.exit(10)

    if args.timeout:
        timeout_seconds = args.timeout

    if args.cmd:
        exe_cmdline = args.cmd
    else:
        exe_cmdline = ''

    # Start main data collection and processing
    print('[*] Using procmon EXE: %s' % procmonexe)
    session_id = get_session_name()
    pml_file = os.path.join(output_dir, 'Noriben_%s.pml' % session_id)
    csv_file = os.path.join(output_dir, 'Noriben_%s.csv' % session_id)
    txt_file = os.path.join(output_dir, 'Noriben_%s.txt' % session_id)
    debug_file = os.path.join(output_dir, 'Noriben_%s.log' % session_id)

    timeline_file = os.path.join(output_dir, 'Noriben_%s_timeline.csv' % session_id)
    print('[*] Procmon session saved to: %s' % pml_file)

    if exe_cmdline and not file_exists(exe_cmdline):
        print('[!] Error: Specified malware executable does not exist: %s' % exe_cmdline)
        sys.exit(6)

    print('[*] Launching Procmon ...')
    launch_procmon_capture(procmonexe, pml_file, pmc_file)

    if exe_cmdline:
        print('[*] Launching command line: %s' % exe_cmdline)
        try:
            subprocess.Popen(exe_cmdline)
        except WindowsError:  # Occurs if VMWare bug removes Owner from file
            print('[!] Error executing file. Windows is refusing execution based upon permissions.')
            sys.exit(4)
    else:
        print('[*] Procmon is running. Run your executable now.')

    if timeout_seconds:
        print('[*] Running for %d seconds. Press Ctrl-C to stop logging early.' % timeout_seconds)
        # Print a small progress indicator, for those REALLY long sleeps.
        try:
            for i in range(timeout_seconds):
                progress = (100 / timeout_seconds) * i
                sys.stdout.write('\r%d%% complete' % progress)
                sys.stdout.flush()
                sleep(1)
        except KeyboardInterrupt:
            pass

    else:
        print('[*] When runtime is complete, press CTRL+C to stop logging.')
        try:
            while True:
                sleep(100)
        except KeyboardInterrupt:
            pass

    print('\n[*] Termination of Procmon commencing... please wait')
    terminate_procmon(procmonexe)

    print('[*] Procmon terminated')
    if not file_exists(pml_file):
        print('[!] Error creating PML file!')
        sys.exit(8)

    # PML created, now convert it to a CSV for parsing
    process_pml_to_csv(procmonexe, pml_file, pmc_file, csv_file)
    if not file_exists(csv_file):
        print('[!] Error detected. Could not create CSV file: %s' % csv_file)
        sys.exit(7)

    # Process CSV file, results in 'report' and 'timeline' output lists
    parse_csv(csv_file, report, timeline)
    print('[*] Saving report to: %s' % txt_file)
    codecs.open(txt_file, 'w', 'utf-8').write('\r\n'.join(report))

    print('[*] Saving timeline to: %s' % timeline_file)
    codecs.open(timeline_file, 'w', 'utf-8').write('\r\n'.join(timeline))

    open_file_with_assoc(txt_file)
    # End of main()

if __name__ == '__main__':
    main()