33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 40:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T7be,"sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Sublime Text\Installed Packages" at 00000000-00006328-00000049-1558858 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Sublime Text\Packages" at 00000000-00006328-00000049-1576315 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Sublime Text\Cache" at 00000000-00006328-00000049-1576449 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Sublime Text\Packages\User" at 00000000-00006328-00000049-1586055 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Sublime Text\Cache\Default" at 00000000-00006328-00000049-1587923 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Sublime Text\Cache\Default\Syntax Summary.cache" at 00000000-00006328-00000049-1618991 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Sublime Text\Cache\Default\Meta Info Summary.cache" at 00000000-00006328-00000049-1646258 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Sublime Text\Packages\User" at 00000000-00006328-00000049-1663468 "sublime_text.exe" queries volume information of "C:\Windows\Fonts\consola.ttf" at 00000000-00006328-00000049-1682371 "sublime_text.exe" queries volume information of "C:\Windows\Fonts\consolab.ttf" at 00000000-00006328-00000049-1714417 "sublime_text.exe" queries volume information of "C:\Windows\Fonts\consolai.ttf" at 00000000-00006328-00000049-1732611 "sublime_text.exe" queries volume information of "C:\Windows\Fonts\consolaz.ttf" at 00000000-00006328-00000049-1754468 "sublime_text.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00006328-00000049-2141077 "sublime_text.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Sublime Text\Cache\Default" at 00000000-00006328-00000049-215043636:T79e,"sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTLASTSYNCTIME") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8"; Key: "BLOB") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "sublime_text.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL")37:T41a,"stable_update_check_1_.htm" has type "JSON data"- [targetUID: 00000000-00006328] "Ignored Packages.cache" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Sublime Text\Cache\Default\Ignored Packages.cache]- [targetUID: 00000000-00006328] "103621DE9CD5414CC2538780B4B75751" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00006328] ".18b80.tmp" has type "data"- Location: [%LOCALAPPDATA%\Sublime Text\Cache\Default\.18b80.tmp]- [targetUID: 00000000-00006328] "Startup.cache" has type "data"- Location: [%LOCALAPPDATA%\Sublime Text\Cache\Default\Startup.cache]- [targetUID: 00000000-00006328] "Session.sublime_session.tmp" has type "ASCII text"- Location: [%APPDATA%\Sublime Text\Local\Session.sublime_session.tmp]- [targetUID: 00000000-00006328] "Auto Save Temp Session.sublime_session.tmp" has type "ASCII text"- Location: [%APPDATA%\Sublime Text\Local\Auto Save Temp Session.sublime_session.tmp]- [targetUID: 00000000-00006328]38:T4b6,"GET /updates/4/stable_update_check?version=4142&platform=windows&arch=x64&now=1668097887 HTTP/1.1 Accept: */* User-Agent: sublime-version-check/3.0 Host: www.sublimetext.com" "HTTP/1.1 200 OK Server: nginx Date: Thu, 10 Nov 2022 16:31:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 706 Last-Modified: Wed, 09 Nov 2022 23:49:31 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "636c3c8b-2c2" Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Accept-Ranges: bytes { "latest_version": 4142, "license_lapse_timestamp": 458956, "last_license_number_lapsed": 1189819, "update_url": "https://www.sublimetext.com/download", "manifest_host": "download.sublimetext.com", "update_host": "download.sublimetext.com", "manifest_path_osx": "/_pak/sublime_text_osx_4142.manifest.xz", "update_path_osx": "/sublime_text_osx_4142.pak.xz", "manifest_path_windows_x64": "/_pak/sublime_text_windows_x64_4142.manifest.xz", "update_path_windows_x64": "/sublime_text_windows_x64_4142.pak.xz", "manifest_path_windows_x32": "/_pak/sublime_text_windows_x32_4142.manifest.xz", "update_path_windows_x32": "/sublime_text_windows_x32_4142.pak.xz" }"39:T41d,"HTTP/1.1 200 OK Server: nginx Date: Thu, 10 Nov 2022 16:31:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 706 Last-Modified: Wed, 09 Nov 2022 23:49:31 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "636c3c8b-2c2" Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Accept-Ranges: bytes { "latest_version": 4142, "license_lapse_timestamp": 458956, "last_license_number_lapsed": 1189819, "update_url": "https://www.sublimetext.com/download", "manifest_host": "download.sublimetext.com", "update_host": "download.sublimetext.com", "manifest_path_osx": "/_pak/sublime_text_osx_4142.manifest.xz", "update_path_osx": "/sublime_text_osx_4142.pak.xz", "manifest_path_windows_x64": "/_pak/sublime_text_windows_x64_4142.manifest.xz", "update_path_windows_x64": "/sublime_text_windows_x64_4142.pak.xz", "manifest_path_windows_x32": "/_pak/sublime_text_windows_x32_4142.manifest.xz", "update_path_windows_x32": "/sublime_text_windows_x32_4142.pak.xz" }" (Indicator: "https://")3a:T604,"sublime_text.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "sublime_text.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 0) "sublime_text.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 1247796224) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435460; Subtree: 3824915200) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate" (Filter: 268435460; Subtree: 3824915456) "sublime_text.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate" (Filter: 268435460; Subtree: 0)3b:T54c,"sublime_text.exe" trying to access non-existent file "C:\DWMAPI.DLL" "sublime_text.exe" trying to access non-existent file "C:\UXTHEME.DLL" "sublime_text.exe" trying to access non-existent file "C:\FLTLIB.DLL" "sublime_text.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Sublime Text\Cache\Default\IGNORED PACKAGES.CACHE" "sublime_text.exe" trying to access non-existent file "C:\PACKAGES" "sublime_text.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Sublime Text\Local\AUTO SAVE SESSION.SUBLIME_SESSION" "sublime_text.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Sublime Text\Local\LICENSE.SUBLIME_LICENSE" "sublime_text.exe" trying to access non-existent file "C:\LICENSE.SUBLIME_LICENSE" "sublime_text.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Sublime Text\Local\LICENSE.SUBLIME_LICENSE.MISSING" "sublime_text.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "sublime_text.exe" trying to access non-existent file "C:\iertutil.dll" "sublime_text.exe" trying to access non-existent file "C:\URLMON.DLL" "sublime_text.exe" trying to access non-existent file "C:\urlmon.dll" "sublime_text.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "sublime_text.exe" trying to access non-existent file "C:\DPAPI.DLL"3c:T714,"vcruntime140.dll" contains export function called "_CreateFrameInfo" at ordinal 1 "vcruntime140.dll" contains export function called "_CxxThrowException" at ordinal 2 "vcruntime140.dll" contains export function called "_FindAndUnlinkFrame" at ordinal 3 "vcruntime140.dll" contains export function called "_IsExceptionObjectToBeDestroyed" at ordinal 4 "vcruntime140.dll" contains export function called "_SetWinRTOutOfMemoryExceptionCallback" at ordinal 5 "vcruntime140.dll" contains export function called "__AdjustPointer" at ordinal 6 "vcruntime140.dll" contains export function called "__BuildCatchObject" at ordinal 7 "vcruntime140.dll" contains export function called "__BuildCatchObjectHelper" at ordinal 8 "vcruntime140.dll" contains export function called "__C_specific_handler" at ordinal 9 "vcruntime140.dll" contains export function called "__C_specific_handler_noexcept" at ordinal 10 "vcruntime140.dll" contains export function called "__CxxDetectRethrow" at ordinal 11 "vcruntime140.dll" contains export function called "__CxxExceptionFilter" at ordinal 12 "vcruntime140.dll" contains export function called "__CxxFrameHandler" at ordinal 13 "vcruntime140.dll" contains export function called "__CxxFrameHandler2" at ordinal 14 "vcruntime140.dll" contains export function called "__CxxFrameHandler3" at ordinal 15 "vcruntime140.dll" contains export function called "__CxxQueryExceptionSize" at ordinal 16 "vcruntime140.dll" contains export function called "__CxxRegisterExceptionObject" at ordinal 17 "vcruntime140.dll" contains export function called "__CxxUnregisterExceptionObject" at ordinal 18 "vcruntime140.dll" contains export function called "__DestructExceptionObject" at ordinal 19 "vcruntime140.dll" contains export function called "__FrameUnwindFilter" at ordinal 203d:T5b2,"subl.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Sublime Text\Update\subl.exe]- [targetUID: 00000000-00003360] "vcruntime140.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Sublime Text\Update\vcruntime140.dll]- [targetUID: 00000000-00003360] "libssl-1_1-x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Sublime Text\Update\libssl-1_1-x64.dll]- [targetUID: 00000000-00003360] "update_installer.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Sublime Text\Update\update_installer.exe]- [targetUID: 00000000-00003360] "crash_reporter.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Sublime Text\Update\crash_reporter.exe]- [targetUID: 00000000-00003360] "libcrypto-1_1-x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\Sublime Text\Update\libcrypto-1_1-x64.dll]- [targetUID: 00000000-00003360] "sublime_plugin.py" has type "Python script text executable Python script ASCII text executable"- Location: [%LOCALAPPDATA%\Sublime Text\Update\Lib\python38\sublime_plugin.py]- [targetUID: 00000000-00003360] "sublime_types.py" has type "Python script ASCII text executable"- Location: [%LOCALAPPDATA%\Sublime Text\Update\Lib\python38\sublime_types.py]- [targetUID: 00000000-00003360]3e:Tb9f,Found an embedded script in 'PKZIP' file "Ruby.sublime-package" at offset 137203: