26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 95:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 73edb93b4c4e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 73edb93b4c4e…. Malware family: Malware. Threat score 100/100. 4/25 AV engines flagged this file. 10 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/73edb93b4c4eddd67d38c7f4681e51216202f8b8aa245460447847652b04e6e8","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","73edb93b4c4eddd67d38c7f4681e51216202f8b8aa245460447847652b04e6e8"],"about":{"@type":"SoftwareApplication","name":"ef815145211a1a34f6e93ff364b83a79.exe","applicationCategory":["peexe","executable"],"identifier":"73edb93b4c4eddd67d38c7f4681e51216202f8b8aa245460447847652b04e6e8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":4,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T424,"ef815145211a1a34f6e93ff364b83a79.exe" called "LoadResource with parameter {'hModule': '1949040640', 'hResInfo': '1950416032'}" (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadResource with parameter {'hModule': '1941700608', 'hResInfo': '1941864792'}" (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadResource with parameter {'hModule': '1941700608', 'hResInfo': '54761392'}" (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadResource with parameter {'hModule': '66191361', 'hResInfo': '66318112'}" (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadResource with parameter {'hModule': '66191361', 'hResInfo': '66293264'}" (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadResource with parameter {'hModule': '66191361', 'hResInfo': '66293296'}" (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadResource with parameter {'hModule': '1949040640', 'hResInfo': '11470680'}" (UID: 00000000-00003576)28:Tc27,"updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/uninstall (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/gmp-clearkey/0.1 (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/gmp-clearkey (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/fonts (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/dictionaries (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/defaults/pref (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/defaults (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/browser/features (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/browser/extensions (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/browser/VisualElements (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/browser (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/updating (UID: 00000000-00001816) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox/tobedeleted (UID: 00000000-00001816) "helper.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\tobedeleted\ (UID: 00000000-00003704) "helper.exe" called "RemoveDirectoryW" with parameter %TEMP%\nsmD02B.tmp\ (UID: 00000000-00003704) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/uninstall (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/gmp-clearkey/0.1 (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/gmp-clearkey (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/fonts (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/defaults/pref (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/defaults (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/browser/features (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/browser/VisualElements (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Mozilla Firefox\updated/browser (UID: 00000000-00003596) "updater.exe" called "RemoveDirectoryW" (UID: 00000000-00003596)29:T63b,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")2a:Tb65,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "VirtualAlloc2" (Indicator: "VirtualAlloc"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API ": (malloc) Error in VirtualFree()" (Indicator: "VirtualFree"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")2b:Tbec,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003276.00000000.74194.72941000.00000020.mdmp")2c:T54a,file/memory contains long string with (Indicator: "RC2"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: "SHA512"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: "Oid"; File: "5F3C8DC9E9802537477FE27DE5A08A4AEE85504F") Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") file/memory contains long string with (Indicator: "RC2"; File: "pkcs11.txt") file/memory contains long string with (Indicator: "SHA512"; File: "pkcs11.txt") file/memory contains long string with (Indicator: "Oid"; File: "SSL") file/memory contains long string with (Indicator: "Oid"; File: "scriptCache-new.bin") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp, 00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp")2d:T474,file/memory contains long string with (Indicator: "ControlService"; File: "ServicesHelper.dll") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp")2e:Te6a,"updater.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Mozilla\updates\308046B0AF4A39CB\updates\0\sta930C.tmp" to "%LOCALAPPDATA%\Mozilla\updates\308046B0AF4A39CB\updates\0\update.status" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\xul.dll.sig" to "%PROGRAMFILES%\Mozilla Firefox\xul.dll.sig.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\xul.dll" to "%PROGRAMFILES%\Mozilla Firefox\xul.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\vcruntime140.dll" to "%PROGRAMFILES%\Mozilla Firefox\vcruntime140.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\updater.ini" to "%PROGRAMFILES%\Mozilla Firefox\updater.ini.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\updater.exe" to "%PROGRAMFILES%\Mozilla Firefox\updater.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\uninstall\helper.exe" to "%PROGRAMFILES%\Mozilla Firefox\uninstall\helper.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\ucrtbase.dll" to "%PROGRAMFILES%\Mozilla Firefox\ucrtbase.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\softokn3.dll" to "%PROGRAMFILES%\Mozilla Firefox\softokn3.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\softokn3.chk" to "%PROGRAMFILES%\Mozilla Firefox\softokn3.chk.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\removed-files" to "%PROGRAMFILES%\Mozilla Firefox\removed-files.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\qipcap.dll" to "%PROGRAMFILES%\Mozilla Firefox\qipcap.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\precomplete" to "%PROGRAMFILES%\Mozilla Firefox\precomplete.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe" to "%PROGRAMFILES%\Mozilla Firefox\plugin-hang-ui.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\plugin-container.exe.sig" to "%PROGRAMFILES%\Mozilla Firefox\plugin-container.exe.sig.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\plugin-container.exe" to "%PROGRAMFILES%\Mozilla Firefox\plugin-container.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\platform.ini" to "%PROGRAMFILES%\Mozilla Firefox\platform.ini.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\pingsender.exe" to "%PROGRAMFILES%\Mozilla Firefox\pingsender.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\omni.ja" to "%PROGRAMFILES%\Mozilla Firefox\omni.ja.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nssdbm3.dll" to "%PROGRAMFILES%\Mozilla Firefox\nssdbm3.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nssdbm3.chk" to "%PROGRAMFILES%\Mozilla Firefox\nssdbm3.chk.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nssckbi.dll" to "%PROGRAMFILES%\Mozilla Firefox\nssckbi.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nss3.dll" to "%PROGRAMFILES%\Mozilla Firefox\nss3.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\msvcp140.dll" to "%PROGRAMFILES%\Mozilla Firefox\msvcp140.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\mozglue.dll" to "%PROGRAMFILES%\Mozilla Firefox\mozglue.dll.moz-backup"2f:T9df,Found string "%PROGRAMFILES%\Mozilla Firefox\freebl3.dll\*.*" (Indicator: "\freebl3.dll"; Source: "00000000-00003704-00000C28-9779389401") Found string "%PROGRAMFILES%\Mozilla Firefox\mozglue.dll\*.*" (Indicator: "\mozglue.dll"; Source: "00000000-00003704-00000C28-10036073348") Found string "%PROGRAMFILES%\Mozilla Firefox\msvcp140.dll\*.*" (Indicator: "\msvcp140.dll"; Source: "00000000-00003704-00000C28-10040540772") Found string "%PROGRAMFILES%\Mozilla Firefox\nss3.dll\*.*" (Indicator: "\nss3.dll"; Source: "00000000-00003704-00000C28-10045030627") Found string "%PROGRAMFILES%\Mozilla Firefox\softokn3.dll\*.*" (Indicator: "softokn3.dll"; Source: "00000000-00003704-00000C28-10110923005") Found string "%PROGRAMFILES%\Mozilla Firefox/softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00003596-00000C37-24995962318") Found string "%PROGRAMFILES%\Mozilla Firefox\updated/softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00003596-00000C37-24995962318") Found string ":\Program Files\Mozilla Firefox/softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp, 00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found string ""softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp 00000000-00001816.00000001.70562.00290000.00000004.mdmp"), Found string "\??\C:\Program Files\Mozilla Firefox\nss3.dll.moz-backups" (Indicator: "\nss3.dll"; Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp"), Found string "EXECUTE REMOVEFILE softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp"), Found string "softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp 00000000-00001816.00000001.70562.00290000.00000004.mdmp 00000000-00001816.00000001.70562.00390000.00000004.mdmp"), Found string "\Program Files\Mozilla Firefox/softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp"), Found string "FINISH ADD softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp"), Found string ":\Program Files\Mozilla Firefox\mozglue.dll" (Indicator: "\mozglue.dll"; Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp"), Found string ":\Program Files\Mozilla Firefox\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp")30:T8658,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Fk7azpE" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2024" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/success" in header "GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive" Contains base64 string in header "detectportal" in header "GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive" Contains base64 string in header "Language" in header "GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive" Contains base64 string in header "Encoding" in header "GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive" Contains base64 string in header "gzip" in header "GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive" Contains base64 string in header "deflateCache" in header "GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive" Contains base64 string in header "keep" in header "GET /success.txt HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive" Contains base64 string in header "/success" in header "GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache" Contains base64 string in header "ipv4" in header "GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache" Contains base64 string in header "detectportal" in header "GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache" Contains base64 string in header "Encoding" in header "GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache" Contains base64 string in header "gzip" in header "GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache" Contains base64 string in header "keep" in header "GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "ocsp" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "digicert" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "Language" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "application/ocsp" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "83Connection" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: ocsp.digicert.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "POST" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "ocsp" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "googUser" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "Language" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "Encoding" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "gzip" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "Type" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "application/ocsp" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "84Connection" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "keep" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 84Connection: keep-alive" Contains base64 string in header "POST" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "ocsp" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "googUser" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "Language" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "Encoding" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "gzip" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "Type" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "application/ocsp" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "83Connection" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive" Contains base64 string in header "keep" in header "POST /gts1c3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/ocsp-requestContent-Length: 83Connection: keep-alive"31:T333e,"ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286a10e17e0266ffcc0499ffff04ccffff0400e17e020000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000001011e33d7f87eb0e77e022a9ded7500000000248302760400000000000000000000002cf97e0200000000e79ced7502000780c4e17e02000000004e00000014e27e02feffffff9ce17e02cf004f77d6004f777bc127754e0000002700000014e27e026f006e0070e17e026e007400d8e17e02 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286a70dd9a0366ffcc0499ffff04ccffff0460dd9a030000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286ab0e29c0366ffcc0499ffff04ccffff04a0e29c030000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286a10e1f10366ffcc0499ffff04ccffff0400e1f1030000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000001d4e2f103d0e6f103b2f44e7717c1a87400000000a8726000ff2b4e77afc2a8749cfb6000ac015e0000005e0000000000ff2b4e770600de0095110000ac015e0000005e00ff2b4e7793c2a8743ca3276cac015e0000005e0063c2a874ac201e6d04009800951100000000000080fb60000500f700951100000500f7009511000000705e0048f76000486e5e0095110000200000000ce2f10300000000104b6000386b5e00586c5e0058a7620000705e00386b5e00f0e1f10390a6620070e3f10395e14a77f73c1700feffffffff2b4e779a2a4e773ca3276c2ca3276c00000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000060000000bc7318001a00d0000000e0000000e000bc7300000000b4edf103c8eef10314f1f10395e14a7777381700feffffffb2f44e77c0f84e77010000000000bc730000000000000000ff2b4e7777cea874ff2b4e777fcea874e055be73ac015e0000005e001f006100f9c162001c007000f9c1620088f0f103a401507720005c00f9c162001d006b00f9c16200486e5e0038eff103486e5e00000049772000000088c562000000000088c56200386b5e00586c5e00e8b3630000705e000000e40014eef10395e14a7708f0f10395e14a77000000005ceff103586de400eceef103 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b4e7723cda87474fc6000ac015e0000005e0000000000000000001b007500ffc16200000000000000000000000000000000001c007000ffc162000000000000000000486e5e00ff2b4e77ebcea8742c75be73ac015e0000005e00386b5e00586c5e001a007a00ffc162000000000040edf1030b00c00208f0f1031b007500ffc1620008f0f10395e14a77486e5e00feffffff20000000dd594f770000000088c56200386b5e00586c5e0038b4630000705e00 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286ab0df000666ffcc0499ffff04ccffff04a0df00060000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000164e1000660e50006b2f44e7767c0597100000000287260000000026b1400160064e00006f0000000f000026b0000000044e0000654003400a4e3000695e14a7777381700ff2b4e77e3c159713ca3036bac015e0000005e00f3c15971ac201e6d4b000c00bd0900000000000080fb60004c005200bd0900004c005200bd0900000000000048f76000486e5e00bd090000200000009ce0000600000000407d6700386b5e00586c5e004073680000705e00386b5e0080e000066873680000e2000695e14a77f73c1700feffffffff2b4e779a2a4e773ca3036b2ca3036b00000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286af0e3580666ffcc0499ffff04ccffff04e0e358060000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000001a4e55806a0e95806b2f44e7727c4017100000000a87260000000b06814001600a4e45806f0000000f000b0680000000084e4580654003400e4e7580695e14a7777381700ff2b4e77a3c501713ca3b168ac015e0000005e00b3c50171ac201e6d4b007f002a9768000000000080fb60004c007a002a9768004c007a002a9768000000000048f76000486e5e002a97680020000000dce458060000000098926800386b5e00586c5e0038bb6a0000705e00386b5e00c0e45806c0ba6a0040e6580695e14a77f73c1700feffffffff2b4e779a2a4e773ca3b1682ca3b16800000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286a80ddeb0366ffcc0499ffff04ccffff0470ddeb030000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000134dfeb0330e3eb03b2f44e77b7feb27400000000287260000000026b1400160034deeb03f0000000f000026b0000000014deeb035400340074e1eb0395e14a7777381700ff2b4e7733feb2743ca3036bac015e0000005e0003feb274ac201e6d44007a00d09f68000000000080fb600045006b00d09f680045006b00d09f68000000000048f76000486e5e00d09f6800200000006cdeeb030000000098926800386b5e00586c5e00c0ba6a0000705e00386b5e0050deeb03d0b96a00d0dfeb0395e14a77f73c1700feffffffff2b4e779a2a4e773ca3036b2ca3036b00000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286a70e2fb0566ffcc0499ffff04ccffff0460e2fb050000286a0000000001000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000134e4fb0530e8fb05b2f44e77b7c3a27200000000a87260000000b4681400160034e3fb05f0000000f000b4680000000014e3fb055400340074e6fb0595e14a7777381700ff2b4e7733c3a2723ca3b568ac015e0000005e0003c3a272ac201e6d4d00a700bd1800000000000080fb60004e002901bd1800004e002901bd1800000000000048f76000486e5e00bd180000200000006ce3fb0500000000407d6700386b5e00586c5e00f879680000705e00386b5e0050e3fb05e0736800d0e4fb0595e14a77f73c1700feffffffff2b4e779a2a4e773ca3b5682ca3b56800000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099049966cc04cc66cc04ff6699040099cc043399cc046699cc049999cc04cc99cc04ff99cc0400cccc0433cccc0466cccc0499cccc04cccccc04ffcccc0400ffcc0433ffcc0466ff990499ffcc04ccffcc04ffffcc043300cc046600ff049900ff040033cc043333ff046633ff049933ff04cc33ff04ff33ff040066ff043366ff046666cc049966ff04cc66ff04ff66cc040099ff043399ff046699ff049999ff04cc99ff04ff99ff0400ccff0433ccff0466ccff0499ccff04ccccff040000286a10e5e80366ffcc0499ffff04ccffff0400e5e8030000286a0000000001000000 (UID: 00000000-00003576)32:Tc16,"ef815145211a1a34f6e93ff364b83a79.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efefbc73bc6f76470200000044c7bc730000f203aecabc738c6de400586de40048eff1030000000008f0f10344d6bd73306f3b37feffffffefefbc736defbc73aecabc739ceff10390e8bc73aecabc7367c171752875be73b8eff103c2c6bc732875be7300000000e8f0f10300000000 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb097608be6a0000f0fd7f9a5c4f7700a0fd7fe0d6e80344f0fd7f00000000400000003f0000002900000000f0fd7fd4d6e803c15c4f77608256772900000000f0fd7f9a5c4f7700a0fd7ff8d6e80357894e778083567713176475d8eb0976 (UID: 00000000-00003576) "helper.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0976709868000060fd7f9a5c4f7700f0fd7fd8d412004460fd7f00000000400000003f0000001d0000000060fd7fccd41200c15c4f77608256771d0000000060fd7f9a5c4f7700f0fd7ff0d4120057894e778083567713176475d8eb0976 (UID: 00000000-00003704) "helper.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000004000000830100000000000003000000860100008601a0ee120000000000ccf0120095e14a77c1580800feffffff6b2c4f773119647502100000000000000000010000100000380186015001000001000000c8ef12006b2c4f77 (UID: 00000000-00003704) "helper.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000001f000000e7010000000000001e000000050200000502a0ee120000000000ccf0120095e14a77c1580800feffffff6b2c4f773119647502100000000000000000010000100000380105025001000001000000c8ef12006b2c4f77 (UID: 00000000-00003704) "helper.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003704)33:T78c,Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp, 00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp, 00000000-00003276.00000000.74194.637F1000.00000020.mdmp") Found reference to API "__crtGetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")34:Tbfe,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp, 00000000-00003276.00000000.74194.637F1000.00000020.mdmp, 00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003276.00000000.74194.637F1000.00000020.mdmp, 00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003276.00000000.74194.637F1000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp")35:T69d,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp, 00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")36:T492,Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "GetNativeSystemInfo"; File: "scriptCache-new.bin") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003276.00000000.74194.637F1000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003276.00000000.74194.64158000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")37:T78c,Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp, 00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp, 00000000-00003276.00000000.74194.637F1000.00000020.mdmp") Found reference to API "__crtGetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")38:T543,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003276.00000000.74194.637F1000.00000020.mdmp") Found reference to API "10430681184,1236,109,,GetWindowTextW,user32.dll,"252:02:42.748",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp") Found reference to API "82272939940,1344,109,,GetWindowTextW,user32.dll,"252:05:12.285",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00003576.00000001.67898.005E0000.00000004.mdmp")39:T441,Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "GetUserPreferredUILanguages" (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp") Found reference to API "kernel32.GetUserPreferredUILanguages" (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00003276.00000000.74194.72931000.00000020.mdmp")3a:T4d5,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "GetVersion"; File: "UserInfo.dll") Found reference to API "!!!!GetVersionEx" (Indicator: "GetVersion"; File: "scriptCache-new.bin") file/memory contains long string with (Indicator: "GetVersionExW"; File: "scriptCache-new.bin") file/memory contains long string with (Indicator: "GetVersion"; File: "scriptCache-new.bin") Found reference to API "1446820458,3104,3024,,RtlGetVersion,NTDLL.dll,"252:04:48.032",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "lGetVersion,NTDLL.dll,"252:02:39" (Indicator: "GetVersion"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp")3b:Tce6,"updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\updating\update.manifest" at 00000000-00001816-0000010C-1914968 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\precomplete" at 00000000-00001816-0000010C-1919628 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\xul.dll.sig" at 00000000-00001816-0000010C-1922204 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\xul.dll" at 00000000-00001816-0000010C-1923083 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\vcruntime140.dll" at 00000000-00001816-0000010C-1923924 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\updater.ini" at 00000000-00001816-0000010C-1924750 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\updater.exe" at 00000000-00001816-0000010C-1925592 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" at 00000000-00001816-0000010C-1926614 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\ucrtbase.dll" at 00000000-00001816-0000010C-1927471 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\softokn3.dll" at 00000000-00001816-0000010C-1928341 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\softokn3.chk" at 00000000-00001816-0000010C-1929220 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\removed-files" at 00000000-00001816-0000010C-1930297 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\qipcap.dll" at 00000000-00001816-0000010C-1931390 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\precomplete" at 00000000-00001816-0000010C-1932249 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe" at 00000000-00001816-0000010C-1933078 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\plugin-container.exe.sig" at 00000000-00001816-0000010C-1933909 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\plugin-container.exe" at 00000000-00001816-0000010C-1934730 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\platform.ini" at 00000000-00001816-0000010C-1936264 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\pingsender.exe" at 00000000-00001816-0000010C-1937087 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\omni.ja" at 00000000-00001816-0000010C-1937947 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\nssdbm3.dll" at 00000000-00001816-0000010C-1938814 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\nssdbm3.chk" at 00000000-00001816-0000010C-1939700 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\nssckbi.dll" at 00000000-00001816-0000010C-1940587 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\nss3.dll" at 00000000-00001816-0000010C-1941393 "updater.exe" queries volume information of "C:\Program Files\Mozilla Firefox\msvcp140.dll" at 00000000-00001816-0000010C-19422143c:T65f,"ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "USESHORTNAME") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "APPENDPATH") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "PATH") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIREFOX.EXE") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIREFOX.EXE") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIREFOX.EXE"; Key: "APPENDPATH") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FIREFOX.EXE"; Key: "PATH") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CHROME.EXE") "ef815145211a1a34f6e93ff364b83a79.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CHROME.EXE")3d:T151c,"updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox\firefox.exe to new location %PROGRAMFILES%\Mozilla Firefox\firefox.exe.moz-callback (UID: 00000000-00001816) "updater.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Mozilla\updates\308046B0AF4A39CB\updates\0\update.log to new location %PROGRAMFILES%\Mozilla Firefox\uninstall\uninstall.update (UID: 00000000-00001816) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox\maintenanceservice.exe to new location %PROGRAMFILES%\Mozilla Maintenance Service\maintenanceservice_tmp.exe (UID: 00000000-00001816) "maintenanceservice_tmp.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Maintenance Service\maintenanceservice_tmp.exe to new location %PROGRAMFILES%\Mozilla Maintenance Service\maintenanceservice.exe (UID: 00000000-00002424) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/Accessible.tlb to new location %PROGRAMFILES%\Mozilla Firefox\updated/Accessible.tlb (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/AccessibleHandler.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/AccessibleHandler.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/AccessibleMarshal.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/AccessibleMarshal.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-core-file-l1-2-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-core-file-l2-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-core-localization-l1-2-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-core-processthreads-l1-1-1.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-core-synch-l1-2-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-core-synch-l1-2-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-core-timezone-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-core-timezone-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-conio-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-conio-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-convert-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-convert-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-environment-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-filesystem-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-filesystem-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-heap-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-locale-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-math-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-multibyte-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-multibyte-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-private-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-private-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-process-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-process-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-runtime-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00003596) "updater.exe" called "CopyFileW" to copy %PROGRAMFILES%\Mozilla Firefox/api-ms-win-crt-stdio-l1-1-0.dll to new location %PROGRAMFILES%\Mozilla Firefox\updated/api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00003596)3e:T5ba,"ef815145211a1a34f6e93ff364b83a79.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" - (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Mozilla Firefox\firefox.exe" https://www.youtube.com" - (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Mozilla Firefox\firefox.exe" https://www.facebook.com/login" - (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Mozilla Firefox\firefox.exe" https://accounts.google.com" - (UID: 00000000-00003576) "updater.exe" called "CreateProcessW" with parameter "argv0ignored /PostUpdate" - (UID: 00000000-00001816) "updater.exe" called "CreateProcessW" with parameter "dummyparam.exe upgrade" - (UID: 00000000-00001816) "updater.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Mozilla Firefox\firefox.exe" https://www.facebook.com/login" - (UID: 00000000-00001816)3f:T2f57,"ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DUser.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00003576) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter WSOCK32.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00001816) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003840) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003840) "updater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003840) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003840) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003840) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %TEMP%\nsmD02B.tmp\System.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %TEMP%\nsmD02B.tmp\CityHash.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %TEMP%\nsmD02B.tmp\liteFirewallW.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %TEMP%\nsmD02B.tmp\ShellLink.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\AccessibleHandler.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\AccessibleMarshal.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %TEMP%\nsmD02B.tmp\UserInfo.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter %TEMP%\nsmD02B.tmp\ServicesHelper.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003704) "helper.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003704) "maintenanceservice_tmp.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Maintenance Service\maintenanceservice.exe (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Maintenance Service\maintenanceservice_tmp.exe (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002424) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003596) "updater.exe" called "LoadLibrary" with a parameter WSOCK32.dll (UID: 00000000-00003596) "pingsender.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003276) "pingsender.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003276) "pingsender.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003276) "pingsender.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003276)40:Te58d,"ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter LoadIconWithScaleDown (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InitGadgets (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegisterMessagePumpHook (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateGadget (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetGadgetMessageFilter (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetGadgetStyle (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetGadgetRootInfo (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetGadgetParent (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetDUserModule (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FindStdColor (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter AttachWndProcW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetGadgetRect (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetGadgetRgn (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetGadgetTicket (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InvalidateGadget (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetGadgetFocus (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetGadgetFocus (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DUserSendEvent (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetGadgetRect (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetBufferedPaintDC (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetBufferedPaintTargetDC (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ForwardGadgetMessage (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter FindGadgetFromPoint (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DisableContainerHwnd (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DUserFlushMessages (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DUserFlushDeferredMessages (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DeleteHandle (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter UnregisterMessagePumpHook (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter DetachWndProc (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003576) "updater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptImportPublicKeyInfo (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter DrawThemeParentBackgroundEx (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001816) "updater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003840) "updater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003840) "helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CharUpper (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetCityHash64 (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter IsWow64Process2W (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter WSCSetApplicationCategory (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter OpenServiceWW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter AddRule (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetShortCutTarget (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter Int64Op (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter DllRegisterServer (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetName (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetAccountType (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter PathToUniqueRegistryPath (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetProfileType (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetSidIdentifierAuthority (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00003704) "helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003704) "maintenanceservice_tmp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002424) "updater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptImportPublicKeyInfo (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003596) "updater.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003596) "pingsender.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003276) "pingsender.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003276)41:T510,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp")42:T89d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "OpenThread"; File: "UserInfo.dll") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")43:T509,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "UserInfo.dll") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp")44:T886,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "GetLastError"; File: "System.dll") file/memory contains long string with (Indicator: "GetLastError"; File: "ServicesHelper.dll") file/memory contains long string with (Indicator: "GetLastError"; File: "UserInfo.dll") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "?_XGetLastError@std@@YAXXZ" (Indicator: "GetLastError"; Source: "00000000-00003276.00000000.74186.640F1000.00000020.mdmp") Found reference to API "MOZ_RELEASE_ASSERT(GetLastError() == 1460L)" (Indicator: "GetLastError"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")45:T5f6,Found reference to API "StartServiceCtrlDispatcher failed. (%d)" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcher failed. (%d)" (Indicator: "StartService"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcher failed. (%d)" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed. (%d)" (Indicator: "StartService"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp")46:T877,"mozavcodec.dll" contains export function called "av_codec_ffversion" at ordinal 1 "mozavcodec.dll" contains export function called "av_codec_is_decoder" at ordinal 2 "mozavcodec.dll" contains export function called "av_codec_is_encoder" at ordinal 3 "mozavcodec.dll" contains export function called "av_codec_iterate" at ordinal 4 "mozavcodec.dll" contains export function called "av_fast_padded_malloc" at ordinal 5 "mozavcodec.dll" contains export function called "av_fast_padded_mallocz" at ordinal 6 "mozavcodec.dll" contains export function called "av_get_audio_frame_duration" at ordinal 7 "mozavcodec.dll" contains export function called "av_get_bits_per_sample" at ordinal 8 "mozavcodec.dll" contains export function called "av_get_exact_bits_per_sample" at ordinal 9 "mozavcodec.dll" contains export function called "av_get_pcm_codec" at ordinal 10 "mozavcodec.dll" contains export function called "av_get_profile_name" at ordinal 11 "mozavcodec.dll" contains export function called "av_grow_packet" at ordinal 12 "mozavcodec.dll" contains export function called "av_init_packet" at ordinal 13 "mozavcodec.dll" contains export function called "av_new_packet" at ordinal 14 "mozavcodec.dll" contains export function called "av_packet_copy_props" at ordinal 15 "mozavcodec.dll" contains export function called "av_packet_free_side_data" at ordinal 16 "mozavcodec.dll" contains export function called "av_packet_from_data" at ordinal 17 "mozavcodec.dll" contains export function called "av_packet_get_side_data" at ordinal 18 "mozavcodec.dll" contains export function called "av_packet_move_ref" at ordinal 19 "mozavcodec.dll" contains export function called "av_packet_new_side_data" at ordinal 20 "mozavcodec.dll" contains export function called "av_packet_pack_dictionary" at ordinal 21 "mozavcodec.dll" contains export function called "av_packet_ref" at ordinal 22 "mozavcodec.dll" contains export function called "av_packet_rescale_ts" at ordinal 23 "mozavcodec.dll" contains export function called "av_packet_shrink_side_data" at ordinal 24 "mozavcodec.dll" contains export function called "av_packet_side_data_name" at ordinal 2547:T1972,"Software\AutoIt v3\AutoIt" in Source: ef815145211a1a34f6e93ff364b83a79.exe "SOFTWARE\Classes\" in Source: ef815145211a1a34f6e93ff364b83a79.exe "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: ef815145211a1a34f6e93ff364b83a79.exe "SOFTWARE\Mozilla\MaintenanceService\" in Source: 5902-567-0087CEB0 "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 5902-655-0087ED30 "Software\Classes\Applications" in Source: 5902-300-00875710 "Software\Classes\Applications\updater.exe" in Source: 5902-300-00875710 "SOFTWARE\Mozilla\MaintenanceService\3932ecacee736d366d6436db0f55bce4" in Source: 5902-562-0087D420 "importMresource://gre/modules/UpdateUtils.jsmUpdateUtilsUpdateChannelWindowsRegistryreadRegKeyCi!nsIWindowsRegKey+ROOT_KEY_CURRENT_USER1Software\Mozilla\FirefoxUninstalled-removeRegKeyTrueuninstall1_checkForOldBuildUpdates!prefHasUserValue-services.sync.usernameWeaveServicePageThumbsNewTabUtils7AboutPrivateBrowsingHandler/AboutProtectionsHandlerPageActions+_firstWindowTelemetry%_firstWindowLoadedE_collectStartupConditionsTelemetryPlacesUtilsfavicons=setDefaultIconURIPreferredSize!devicePixelRatio;_setPrefExpectationsAndUpdate!_matchCBCategoryaddObserver5privacy.trackingprotection;network.cookie.cookieBehavior=ContentBlockingCategoriesPrefs!PREF_CB_CATEGORY#_updateCBCategory-media.autoplay.default'_updateAutoplayPref)_setPrefExpectationsObrowser.contentblocking.features.strictM" in Source: scriptCache-new.bin "!!!!wrkroot.this;open#SOFTWARE\PoliciesACCESS_READhasChildMozilla\Servicesappinfoname!WindowsGPOParserreadPolicies_policiesclose.WQT" in Source: scriptCache-new.bin "vendornameAppConstantsMOZ_APP_NAMEthunderbirdMozillaSOFTWARE\\.Q55Q55QV=EQ;5=" in Source: scriptCache-new.bin "ctypesuint8_tuint16_tuint32_tchar16_tintStructType!OSVERSIONINFOEXW'dwOSVersionInfoSizedwMajorVersiondwMinorVersiondwBuildNumberdwPlatformIdArrayTypeszCSDVersion#wServicePackMajor#wServicePackMinorwSuiteMaskwProductTypewReservedopenKernel323Unable to open kernel32! %.unknown (unknown)declareGetVersionExWwinapi_abiptrsizeaddress.YUnknown failure in GetVersionEX (returned 0).unknowngError getting service pack information. Exception: vccompare10YSOFTWARE\Microsoft\Windows NT\CurrentVersionWindowsRegistryreadRegKeyCi!nsIWindowsRegKey-ROOT_KEY_LOCAL_MACHINEUBRWOW64_64undefinedclose (gWinCPUArch)!secondaryLibrary%encodeURIComponentgQQQ5" in Source: scriptCache-new.bin "vendorMozillaCcK@mozilla.org/xre/directory-provider;1getServiceCi#nsIXREDirProvidergetInstallHashSoftware\\\Installer\;" in Source: scriptCache-new.bin "localeAppConstantsplatformandroidkernel_versionkernelVersionwinYSOFTWARE\Microsoft\Windows NT\CurrentVersion+getWindowsVersionInfo!servicePackMajor!servicePackMinorbuildNumber%windowsBuildNumber" in Source: scriptCache-new.bin "!!!!!!!!installed!!!!wrk!!!!e;AppConstants/MOZ_MAINTENANCE_SERVICEplatformwinLOGIisServiceInstalled - returning falseCcG@mozilla.org/windows-registry-key;1createInstanceCi!nsIWindowsRegKeyopen-ROOT_KEY_LOCAL_MACHINEGSOFTWARE\Mozilla\MaintenanceServiceACCESS_READWOW64_64readIntValueInstalledclose?isServiceInstalled - returning *Q5 DQ5=!=QB>QQ;5" in Source: scriptCache-new.bin "aryABIwrkregPathregValHKCUregValHKLMappBaseDirPath; AppConstantsplatformwinUpdateUtilsABIsplit-x86x64CcG@mozilla.org/windows-registry-key;1createInstanceCi!nsIWindowsRegKey#SOFTWARE\Mozilla\Servicesappinfoname#\32to64DidMigrateWindowsRegistryreadRegKey+ROOT_KEY_CURRENT_USERNeverWOW64_32-ROOT_KEY_LOCAL_MACHINELOGChecker:_getCanMigrate - all installations should not be migratedgetAppBaseDirpathChecker:_getCanMigrate - this installation should not be migrateduChecker:_getCanMigrate - this installation can be migratedChecker:_getCanMigrate - no registry entries for this installation5E0Q5=B;5" in Source: scriptCache-new.bin "!!!!UT_PSIS!!!!aSuffixaInstalled!!!!attempted!!!!id!!!!e!!!!wrk!!!!e!!!!id!!!!e;G@mozilla.org/windows-registry-key;1CcCureportErrorCr-NS_ERROR_NOT_AVAILABLE3UPDATE_SERVICE_INSTALLED_Servicestelemetry!getHistogramByIdaddcreateInstanceCi!nsIWindowsRegKeyopen-ROOT_KEY_LOCAL_MACHINEGSOFTWARE\Mozilla\MaintenanceServiceACCESS_READWOW64_64readIntValueAttemptedcloseIUPDATE_SERVICE_MANUALLY_UNINSTALLED_3'Q=;q (;" in Source: scriptCache-new.bin "Software\Microsoft\Windows\CurrentVersion" in Source: 46731-8-0040644E "Software\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\Capabilities" in Source: 00000000-00003704-00000BC1-121624536 "-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00001816.00000001.70562.00290000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001816.00000001.70562.00344000.00000004.mdmp "SOFTWARE\%S\%S\TaskBarIDs" in Source: 00000000-00001816.00000001.70562.00344000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService" in Source: 00000000-00001816.00000001.70562.00344000.00000004.mdmp "SOFTWARE\Mozilla\MaintenanceService\" in Source: 00000000-00001816.00000001.70562.00344000.00000004.mdmp "SOFTWARE\Mozilla\MaintenanceService\3932ecacee736d366d6436db0f55bce4" in Source: 00000000-00001816.00000001.70562.00344000.00000004.mdmp "SOFTWARE\%S\%S\TaskBarIDs" in Source: 00000000-00002424.00000000.70863.000B0000.00000004.mdmp 00000000-00002424.00000000.70869.01258000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService" in Source: 00000000-00002424.00000000.70863.000B0000.00000004.mdmp 00000000-00002424.00000000.70869.01258000.00000002.mdmp "SOFTWARE\Mozilla\MaintenanceService\" in Source: 00000000-00002424.00000000.70863.000B0000.00000004.mdmp 00000000-00002424.00000000.70869.01258000.00000002.mdmp "SOFTWARE\Mozilla\MaintenanceService\3932ecacee736d366d6436db0f55bce4" in Source: 00000000-00002424.00000000.70863.000B0000.00000004.mdmp 00000000-00002424.00000000.70869.01258000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00003576.00000000.65977.005E0000.00000004.mdmp 00000000-00003576.00000001.67898.005E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003576.00000000.65977.005E0000.00000004.mdmp 00000000-00003576.00000001.67898.005E0000.00000004.mdmp48:T617,file/memory contains long string with (Indicator: "OpenSCManager"; File: "ServicesHelper.dll") file/memory contains long string with (Indicator: "QueryServiceStatus"; File: "ServicesHelper.dll") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp")49:T443,"\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "Local\ZonesCacheCounterMutex" "Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" "IsoScope_3c8_IE_EarlyTabStart_0xbac_Mutex" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "Local\URLBLOCK_DOWNLOAD_MUTEX" "IsoScope_3c8_IESQMMUTEX_0_519" "IsoScope_3c8_IESQMMUTEX_0_331" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_968" "IsoScope_3c8_IESQMMUTEX_0_303" "Local\!BrowserEmulation!SharedMemory!Mutex" "Local\VERMGMTBlockListFileMutex" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "UpdatingNewTabPageData" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "IsoScope_3c8_ConnHashTable<968>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_3c8_IESQMMUTEX_0_519" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_968" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX"4a:T606,"ef815145211a1a34f6e93ff364b83a79.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "ef815145211a1a34f6e93ff364b83a79.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "ef815145211a1a34f6e93ff364b83a79.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "ef815145211a1a34f6e93ff364b83a79.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "updater.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "updater.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "updater.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "helper.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "helper.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "maintenanceservice_tmp.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "pingsender.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "pingsender.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "pingsender.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]4b:T8b2,"mozavcodec.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nss3.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "helper.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ucrtbase.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "minidump-analyzer.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "mozglue.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "default-browser-agent.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "freebl3.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "firefox.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msvcp140.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "updater.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nssckbi.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "osclientcerts.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "mozwer.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT4c:Tb04,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found string "https://www.youtube.com" (Indicator: "youtube"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "facebook.com"; File: "permissions.sqlite") file/memory contains long string with (Indicator: "facebook.com"; File: "533H5AAS.txt") file/memory contains long string with (Indicator: "youtube"; File: "KEIFA4KJ.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "DYYF2XJK.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "46NOP07Z.txt") file/memory contains long string with (Indicator: "facebook.com"; File: "R3YOIY47.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217372191488031086470131223614531083646VISITOR_INFO1_LIVEbPMYAqN5wIQyoutube.com/9217158403225631119864131520015031083646" (Indicator: "youtube"; File: "GGP0AAZH.txt") Found string "@\F{~predictor-origin,:https://www.facebook.com/predictor::seenpredictor::resource-countpredictor::https://static.xx.fbcdn.net/1,2,1705853017,4096predictor::https://facebook.com/1,2,1705853017,4096" (Indicator: "facebook.com"; File: "97AE667565B6120DDEBF42730CC21468FE5AC36E") Found string "0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0sfacebook.com/921719569263363110175970503212931083646o0WtZdg0Tk9t8F8VW87hP-OZfacebook.com/921735013804803116412070518812931083646" (Indicator: "facebook.com"; File: "1B2125G4.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217372191488031086470131223614531083646" (Indicator: "youtube"; File: "MQ71UMH6.txt") Found string "0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0sfacebook.com/921719569263363110175970503212931083646" (Indicator: "facebook.com"; File: "5E44OLOE.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "4JSC9XS7.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "star-mini.c10r.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "youtube-ui.l.google.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL")4d:T2e7c,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2363 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:26:11 GMT Last-Modified: Sun 21 Jan 2024 15:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 21 Jan 2024 15:43:16 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2575 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA216041432192D2918BF035A75726826C5E5F33E11AB3206180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4086 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:26:11 GMT Last-Modified: Sun 21 Jan 2024 15:18:05 GMT Server: ECAcc (sac/254B) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 21 Jan 2024 15:42:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2647 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 21 Jan 2024 15:28:03 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3489 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2275 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:26:14 GMT Last-Modified: Sun 21 Jan 2024 15:48:19 GMT Server: ECAcc (sac/254B) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 300 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:26:14 GMT Last-Modified: Sun 21 Jan 2024 16:21:15 GMT Server: ECAcc (sac/253F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 21 Jan 2024 15:53:54 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1940 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 299 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:26:14 GMT Last-Modified: Sun 21 Jan 2024 16:21:16 GMT Server: ECAcc (sac/254E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 21 Jan 2024 15:42:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2654 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 21 Jan 2024 16:02:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1452 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 21 Jan 2024 16:26:21 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 0 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1007 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:04 GMT Last-Modified: Sun 21 Jan 2024 16:10:17 GMT Server: ECAcc (sac/2548) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 363 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:05 GMT Last-Modified: Sun 21 Jan 2024 16:21:02 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2418 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:06 GMT Last-Modified: Sun 21 Jan 2024 15:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive" Response ==> HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun 21 Jan 2024 11:13:08 GMT Age: 18857 Content-Type: text/plain Cache-Control: public must-revalidate max-age=0 s-maxage=3600 with response body ==>737563636573730A....... "GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun 21 Jan 2024 12:26:44 GMT Age: 14441 Content-Type: text/plain Cache-Control: public must-revalidate max-age=0 s-maxage=3600 with response body ==>737563636573730A....... "GET /success.txt HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive" Response ==> HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun 21 Jan 2024 11:13:08 GMT Age: 18919 Content-Type: text/plain Cache-Control: public must-revalidate max-age=0 s-maxage=3600 with response body ==>737563636573730A....... "GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun 21 Jan 2024 12:26:44 GMT Age: 14503 Content-Type: text/plain Cache-Control: public must-revalidate max-age=0 s-maxage=3600 with response body ==>737563636573730A.......4e:T35a4,"ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c70000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "KERNEL32" at base 773b0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b820000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "COMCTL32.DLL" at base 742c0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "KERNEL32.DLL" at base 773b0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "UXTHEME.DLL" at base 73ff0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "IMM32.DLL" at base 776c0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "COMCTL32" at base 742c0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "SHELL32.DLL" at base 760b0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "OLE32.DLL" at base 76dd0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "ADVAPI32.DLL" at base 75970000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "PROPSYS.DLL" at base 74180000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "OLEAUT32.DLL" at base 75a20000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "APPHELP.DLL" at base 75240000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "CLBCATQ.DLL" at base 75c10000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a280000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75440000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "URLMON.DLL" at base 75ac0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 70d80000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74180000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 6b920000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "IERTUTIL.DLL" at base 75e20000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 760b0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "USER32.DLL" at base 76d00000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 773b0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "SETUPAPI.DLL" at base 76f60000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "RPCRT4.DLL" at base 757e0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75240000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\NDFAPI.DLL" at base 6c260000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "NTDLL.DLL" at base 77490000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "DUSER.DLL" at base 73bc0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73bc0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "DWMAPI.DLL" at base 73d00000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 73cd0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76dd0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75890000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\NDFAPI.DLL" at base 6b020000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\NDFAPI.DLL" at base 68b00000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\NDFAPI.DLL" at base 68b40000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "NTMARTA.DLL" at base 74150000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 757c0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "PROFAPI.DLL" at base 753b0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75ac0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "SECUR32.DLL" at base 750c0000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75680000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71920000 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "ef815145211a1a34f6e93ff364b83a79.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "updater.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c70000 "updater.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "updater.exe" loaded module "KERNEL32" at base 773b0000 "updater.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "updater.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b820000 "updater.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "updater.exe" loaded module "WSOCK32.DLL" at base 70bd0000 "updater.exe" loaded module "CRYPTSP.DLL" at base 74da0000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b30000 "updater.exe" loaded module "ADVAPI32.DLL" at base 75970000 "updater.exe" loaded module "CRYPTBASE.DLL" at base 75290000 "updater.exe" loaded module "COMCTL32.DLL" at base 742c0000 "updater.exe" loaded module "CRYPT32.DLL" at base 75500000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ff0000 "updater.exe" loaded module "KERNEL32.DLL" at base 773b0000 "updater.exe" loaded module "DWMAPI.DLL" at base 73d00000 "updater.exe" loaded module "UXTHEME.DLL" at base 73ff0000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76dd0000 "updater.exe" loaded module "CLBCATQ.DLL" at base 75c10000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75890000 "updater.exe" loaded module "OLEAUT32.DLL" at base 75a20000 "updater.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75240000 "updater.exe" loaded module "RPCRT4.DLL" at base 757e0000 "helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c70000 "helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "helper.exe" loaded module "KERNEL32" at base 773b0000 "helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "helper.exe" loaded module "ADVAPI32.DLL" at base 75970000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74180000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73d00000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 75290000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72140000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75c10000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74830000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 6c270000 "helper.exe" loaded module "CRYPTBASE.DLL" at base 75290000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ff0000 "helper.exe" loaded module "OLE32.DLL" at base 76dd0000 "helper.exe" loaded module "KERNEL32.DLL" at base 773b0000 "helper.exe" loaded module "COMCTL32.DLL" at base 742c0000 "helper.exe" loaded module "OLEAUT32.DLL" at base 75a20000 "helper.exe" loaded module "CLBCATQ.DLL" at base 75c10000 "helper.exe" loaded module "SETUPAPI.DLL" at base 76f60000 "helper.exe" loaded module "RPCRT4.DLL" at base 757e0000 "helper.exe" loaded module "NTMARTA.DLL" at base 74150000 "helper.exe" loaded module "SHELL32.DLL" at base 760b0000 "helper.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 757c0000 "helper.exe" loaded module "PROFAPI.DLL" at base 753b0000 "helper.exe" loaded module "%TEMP%\NSMD02B.TMP\SYSTEM.DLL" at base 10000000 "helper.exe" loaded module "%TEMP%\NSMD02B.TMP\CITYHASH.DLL" at base 1400000 "helper.exe" loaded module "%TEMP%\NSMD02B.TMP\LITEFIREWALLW.DLL" at base 1400000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\FIREWALLAPI.DLL" at base 74840000 "helper.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 757c0000 "helper.exe" loaded module "%TEMP%\NSMD02B.TMP\SHELLLINK.DLL" at base 1400000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 760b0000 "helper.exe" loaded module "LINKINFO.DLL" at base 6e720000 "helper.exe" loaded module "PROPSYS.DLL" at base 74180000 "helper.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\ACCESSIBLEHANDLER.DLL" at base 640c0000 "helper.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\ACCESSIBLEMARSHAL.DLL" at base 65b70000 "helper.exe" loaded module "%TEMP%\NSMD02B.TMP\USERINFO.DLL" at base 1400000 "helper.exe" loaded module "SSPICLI.DLL" at base 75220000 "helper.exe" loaded module "%TEMP%\NSMD02B.TMP\SERVICESHELPER.DLL" at base 1400000 "helper.exe" loaded module "CRYPTSP.DLL" at base 74da0000 "helper.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b30000 "helper.exe" loaded module "USERENV.DLL" at base 75450000 "maintenanceservice_tmp.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 757c0000 "maintenanceservice_tmp.exe" loaded module "NTMARTA.DLL" at base 74150000 "maintenanceservice_tmp.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "firefox.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75240000 "firefox.exe" loaded module "NTDLL.DLL" at base 77490000 "firefox.exe" loaded module "API-MS-WIN-CORE-MEMORY-L1-1-5.DLL" at base 0 "firefox.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 6c1d0000 "firefox.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "firefox.exe" loaded module "KERNEL32" at base 773b0000 "firefox.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "firefox.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 320000 "firefox.exe" loaded module "%WINDIR%\TEMP\VXSSL32.DLL" at base 370000 "firefox.exe" loaded module "USER32.DLL" at base 76d00000 "firefox.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 72f80000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 6b810000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 6b4d0000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 6b050000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-CONVERT-L1-1-0.DLL" at base 6b040000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\VCRUNTIME140.DLL" at base 72940000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 6b030000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 6b020000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-TIME-L1-1-0.DLL" at base 6b010000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL" at base 6b000000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 6afe0000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-UTILITY-L1-1-0.DLL" at base 6afb0000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\MSVCP140.DLL" at base 640f0000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\MOZGLUE.DLL" at base 68b10000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\API-MS-WIN-CRT-MULTIBYTE-L1-1-0.DLL" at base 72960000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\NSS3.DLL" at base 635a0000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\LGPLLIBS.DLL" at base 6afa0000 "firefox.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 773b0000 "firefox.exe" loaded module "KERNEL32.DLL" at base 773b0000 "firefox.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\XUL.DLL" at base 5dc30000 "firefox.exe" loaded module "OLE32.DLL" at base 76dd0000 "firefox.exe" loaded module "CRYPTBASE.DLL" at base 75290000 "firefox.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ff0000 "firefox.exe" loaded module "NTMARTA.DLL" at base 74150000 "firefox.exe" loaded module "RPCRT4.DLL" at base 757e0000 "firefox.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 757c0000 "firefox.exe" loaded module "ADVAPI32.DLL" at base 75970000 "firefox.exe" loaded module "%WINDIR%\SYSTEM32\MFPLAT.DLL" at base 72830000 "firefox.exe" loaded module "%WINDIR%\SYSTEM32\MF.DLL" at base 5d460000 "firefox.exe" loaded module "%WINDIR%\SYSTEM32\DXVA2.DLL" at base 72810000 "firefox.exe" loaded module "%WINDIR%\SYSTEM32\EVR.DLL" at base 5d3e0000 "firefox.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 774d64bc "firefox.exe" loaded module "WS2_32.DLL" at base 756d0000 "pingsender.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 6c1d0000 "pingsender.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "pingsender.exe" loaded module "KERNEL32" at base 773b0000 "pingsender.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "pingsender.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b820000 "pingsender.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 04f:T17f6,"ef815145211a1a34f6e93ff364b83a79.exe" was detected as "AutoIt" and name: "Library" "ef815145211a1a34f6e93ff364b83a79.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ef815145211a1a34f6e93ff364b83a79.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ef815145211a1a34f6e93ff364b83a79.exe" was detected as "Microsoft Linker" and name: "Linker" "mozavcodec.dll" was detected as "AutoIt" and name: "Library" "mozavcodec.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "mozavcodec.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mozavcodec.dll" was detected as "Microsoft Linker" and name: "Linker" "nss3.dll" was detected as "AutoIt" and name: "Library" "nss3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nss3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nss3.dll" was detected as "Microsoft Linker" and name: "Linker" "helper.exe" was detected as "AutoIt" and name: "Library" "helper.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "helper.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "helper.exe" was detected as "Microsoft Linker" and name: "Linker" "ucrtbase.dll" was detected as "AutoIt" and name: "Library" "ucrtbase.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ucrtbase.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ucrtbase.dll" was detected as "Microsoft Linker" and name: "Linker" "minidump-analyzer.exe" was detected as "AutoIt" and name: "Library" "minidump-analyzer.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "minidump-analyzer.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "minidump-analyzer.exe" was detected as "Microsoft Linker" and name: "Linker" "mozglue.dll" was detected as "AutoIt" and name: "Library" "mozglue.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "mozglue.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mozglue.dll" was detected as "Microsoft Linker" and name: "Linker" "default-browser-agent.exe" was detected as "AutoIt" and name: "Library" "default-browser-agent.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "default-browser-agent.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "default-browser-agent.exe" was detected as "Microsoft Linker" and name: "Linker" "freebl3.dll" was detected as "AutoIt" and name: "Library" "freebl3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "freebl3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "freebl3.dll" was detected as "Microsoft Linker" and name: "Linker" "firefox.exe" was detected as "AutoIt" and name: "Library" "firefox.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "firefox.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "firefox.exe" was detected as "Microsoft Linker" and name: "Linker" "msvcp140.dll" was detected as "AutoIt" and name: "Library" "msvcp140.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "msvcp140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msvcp140.dll" was detected as "Microsoft Linker" and name: "Linker" "updater.exe" was detected as "AutoIt" and name: "Library" "updater.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "updater.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "updater.exe" was detected as "Microsoft Linker" and name: "Linker" "nssckbi.dll" was detected as "AutoIt" and name: "Library" "nssckbi.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nssckbi.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nssckbi.dll" was detected as "Microsoft Linker" and name: "Linker" "osclientcerts.dll" was detected as "AutoIt" and name: "Library" "osclientcerts.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "osclientcerts.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "osclientcerts.dll" was detected as "Microsoft Linker" and name: "Linker" "mozwer.dll" was detected as "AutoIt" and name: "Library" "mozwer.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "mozwer.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mozwer.dll" was detected as "Microsoft Linker" and name: "Linker" "softokn3.dll" was detected as "AutoIt" and name: "Library" "softokn3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "softokn3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "softokn3.dll" was detected as "Microsoft Linker" and name: "Linker" "plugin-container.exe" was detected as "AutoIt" and name: "Library" "plugin-container.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "plugin-container.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "plugin-container.exe" was detected as "Microsoft Linker" and name: "Linker" "crashreporter.exe" was detected as "AutoIt" and name: "Library" "crashreporter.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "crashreporter.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "crashreporter.exe" was detected as "Microsoft Linker" and name: "Linker" "maintenanceservice.exe" was detected as "AutoIt" and name: "Library" "maintenanceservice.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "maintenanceservice.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "maintenanceservice.exe" was detected as "Microsoft Linker" and name: "Linker" "mozavutil.dll" was detected as "AutoIt" and name: "Library" "mozavutil.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "mozavutil.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mozavutil.dll" was detected as "Microsoft Linker" and name: "Linker"50:T1220,"ef815145211a1a34f6e93ff364b83a79.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "ef815145211a1a34f6e93ff364b83a79.exe" touched "Network Diagnostics Framework" (Path: "HKCU\CLSID\{C529C7EF-A3AF-45F2-8A47-767B33AA5CC0}\TREATAS") "helper.exe" touched "HNetCfg.FwPolicy2" (Path: "HKCU\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}") "helper.exe" touched "HNetCfg.FwRule" (Path: "HKCU\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}\TREATAS") "helper.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "helper.exe" touched "ISimpleDOMNode" (Path: "HKCU\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\INPROCSERVER32")51:T451,"ef815145211a1a34f6e93ff364b83a79.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "mozavcodec.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "nss3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ucrtbase.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "minidump-analyzer.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "mozglue.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "default-browser-agent.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "freebl3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "firefox.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "msvcp140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "updater.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "nssckbi.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "osclientcerts.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "mozwer.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "softokn3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"52:T397e,"ef815145211a1a34f6e93ff364b83a79.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "mozavcodec.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100fc8be,call 0x100fc8d3,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100fc79e,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x10239014],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x100fc8ed,test esi, ecx,jne 0x100fc913,call 0x100fc91e,mov ecx, eax,cmp ecx, edi,jne 0x100fc8ff,mov ecx, 0xbb40e64f,jmp 0x100fc90d,test esi, ecx,jne 0x100fc90d,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x10239014], ecx," "nss3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1015691e,call 0x10156e41,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x101567fe,add esp, 0xc,pop ebp,ret 0xc,mov eax, dword ptr [0x101f0d68],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x101569a1,test eax, eax,jne 0x1015699d,push 0x101e0028,call dword ptr [0x101ecb8c],mov esi, eax,test esi, esi,jne 0x1015695a,mov esi, ebx,jmp 0x10156984,push 0x101e0010,push esi,call dword ptr [0x101ecb90],test eax, eax,je 0x10156956,push 0x101dfff8,push esi," "nss3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101dd78e,call 0x101dd7a3,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x101dd66e,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x10227014],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x101dd7bd,test esi, ecx,jne 0x101dd7e3,call 0x101dd7ee,mov ecx, eax,cmp ecx, edi,jne 0x101dd7cf,mov ecx, 0xbb40e64f,jmp 0x101dd7dd,test esi, ecx,jne 0x101dd7dd,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x10227014], ecx," "mozavcodec.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101c639e,call 0x101c63b3,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x101c627e,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x101ef014],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x101c63cd,test esi, ecx,jne 0x101c63f3,call 0x101c63fe,mov ecx, eax,cmp ecx, edi,jne 0x101c63df,mov ecx, 0xbb40e64f,jmp 0x101c63ed,test esi, ecx,jne 0x101c63ed,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x101ef014], ecx," "helper.exe" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push esi,push edi,push 0x20,pop edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x14], ebx,mov dword ptr [esp + 0x10], 0x40a2e0,mov dword ptr [esp + 0x1c], ebx,call dword ptr [0x4080cc],call dword ptr [0x4080d0],and eax, 0xbfffffff,cmp ax, 6,mov dword ptr [0x434f0c], eax,je 0x403515,push ebx,call 0x406806,cmp eax, ebx,je 0x403515,push 0xc00,call eax,mov esi, 0x4082b0,push esi,call 0x406796,push esi,call dword ptr [0x408154]," "ucrtbase.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,je 0x1002ba4b,push dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1002ba52,pop ecx,pop ebp,ret 0xc,call 0x10061f70,jmp 0x1002ba3b,mov edi, edi,push ebp,mov ebp, esp,push ebx,xor ebx, ebx,push esi,push edi,sub edx, ebx,je 0x1002baf6,sub edx, 1,je 0x1002baed,sub edx, 1,jne 0x1002bacd,call dword ptr [0x10112054],mov ecx, dword ptr [0x101102e4],mov esi, eax,cmp ecx, -1,je 0x1002bb03,call 0x10031240,mov edi, eax,test edi, edi,je 0x100768ba," "ucrtbase.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,je 0x100300bb,push dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100300f0,pop ecx,pop ebp,ret 0xc,call 0x1005cc82,jmp 0x100300ab,mov eax, ecx,test edx, edx,je 0x100300e8,test eax, eax,je 0x100300e8,cmp eax, edx,je 0x100300e8,push esi,push edi,push 0x2e,pop ecx,mov esi, edx,mov edi, eax,rep movsd dword ptr es:[edi], dword ptr [esi],and dword ptr [eax + 0xc], 0,mov ecx, eax,pop edi,pop esi,jmp 0x100307d0,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x34,mov eax, dword ptr [0x1010e2b0],xor eax, ebp,mov dword ptr [ebp - 4], eax,push ebx,push esi," "helper.exe" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push esi,push edi,push 0x20,pop edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x14], ebx,mov dword ptr [esp + 0x10], 0x40a2e0,mov dword ptr [esp + 0x1c], ebx,call dword ptr [0x4080b0],call dword ptr [0x4080ac],cmp ax, 6,je 0x40337a,push ebx,call 0x4064be,cmp eax, ebx,je 0x40337a,push 0xc00,call eax,mov esi, 0x4082b8,push esi,call 0x40644e,push esi,call dword ptr [0x40815c],lea esi, [esi + eax + 1],cmp byte ptr [esi], 0,jne 0x40337f,push ebp,push 9," "minidump-analyzer.exe" file has an entrypoint instructions - "call 0x43fd92,jmp 0x43fb82,push ebp,mov ebp, esp,push ecx,cmp dword ptr [0x4b3b94], 1,jl 0x43fd8d,cmp dword ptr [ebp + 8], 0xc00002b4,je 0x43fd39,cmp dword ptr [ebp + 8], 0xc00002b5,jne 0x43fd8d,stmxcsr dword ptr [ebp - 4],mov eax, dword ptr [ebp - 4],xor eax, 0x3f,test al, 0x81,je 0x43fd86,test eax, 0x204,jne 0x43fd55,mov eax, 0xc000008e,leave ,ret ,test eax, 0x102,je 0x43fd86,test eax, 0x408,jne 0x43fd6a,mov eax, 0xc0000091,leave ,ret ,test eax, 0x810,jne 0x43fd78," "mozglue.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1004a55e,call 0x1004aaf9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1004a43e,add esp, 0xc,pop ebp,ret 0xc,mov eax, dword ptr [0x100a5700],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x1004a5e1,test eax, eax,jne 0x1004a5dd,push 0x1009b92c,call dword ptr [0x100a2970],mov esi, eax,test esi, esi,jne 0x1004a59a,mov esi, ebx,jmp 0x1004a5c4,push 0x1009b8c0,push esi,call dword ptr [0x100a2974],test eax, eax,je 0x1004a596,push 0x1009b8a8,push esi," "default-browser-agent.exe" file has an entrypoint instructions - "call 0x450a32,jmp 0x450822,push ebp,mov ebp, esp,push ecx,cmp dword ptr [0x49f2b4], 1,jl 0x450a2d,cmp dword ptr [ebp + 8], 0xc00002b4,je 0x4509d9,cmp dword ptr [ebp + 8], 0xc00002b5,jne 0x450a2d,stmxcsr dword ptr [ebp - 4],mov eax, dword ptr [ebp - 4],xor eax, 0x3f,test al, 0x81,je 0x450a26,test eax, 0x204,jne 0x4509f5,mov eax, 0xc000008e,leave ,ret ,test eax, 0x102,je 0x450a26,test eax, 0x408,jne 0x450a0a,mov eax, 0xc0000091,leave ,ret ,test eax, 0x810,jne 0x450a18," "minidump-analyzer.exe" file has an entrypoint instructions - "call 0x4492aa,jmp 0x449112,mov ecx, dword ptr [0x46a00c],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x4492c4,test esi, ecx,jne 0x4492ea,call 0x4492f5,mov ecx, eax,cmp ecx, edi,jne 0x4492d6,mov ecx, 0xbb40e64f,jmp 0x4492e4,test esi, ecx,jne 0x4492e4,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x46a00c], ecx,not ecx,pop edi,mov dword ptr [0x46a008], ecx,pop esi,ret ,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc]," "freebl3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10071b2e,call 0x10071b43,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10071a0e,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x100940b4],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x10071b5d,test esi, ecx,jne 0x10071b83,call 0x10071b8e,mov ecx, eax,cmp ecx, edi,jne 0x10071b6f,mov ecx, 0xbb40e64f,jmp 0x10071b7d,test esi, ecx,jne 0x10071b7d,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x100940b4], ecx," "firefox.exe" file has an entrypoint instructions - "call 0x426ca2,jmp 0x426a92,push ebp,mov ebp, esp,push ecx,cmp dword ptr [0x4512f4], 1,jl 0x426c9d,cmp dword ptr [ebp + 8], 0xc00002b4,je 0x426c49,cmp dword ptr [ebp + 8], 0xc00002b5,jne 0x426c9d,stmxcsr dword ptr [ebp - 4],mov eax, dword ptr [ebp - 4],xor eax, 0x3f,test al, 0x81,je 0x426c96,test eax, 0x204,jne 0x426c65,mov eax, 0xc000008e,leave ,ret ,test eax, 0x102,je 0x426c96,test eax, 0x408,jne 0x426c7a,mov eax, 0xc0000091,leave ,ret ,test eax, 0x810,jne 0x426c88," "firefox.exe" file has an entrypoint instructions - "call 0x43acf8,jmp 0x43a652,mov eax, dword ptr [0x4454ec],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x43a858,test eax, eax,jne 0x43a854,push 0x440e04,call dword ptr [0x4428e0],mov esi, eax,test esi, esi,jne 0x43a811,mov esi, ebx,jmp 0x43a83b,push 0x440d7c,push esi,call dword ptr [0x4428e8],test eax, eax,je 0x43a80d,push 0x440d64,push esi,mov dword ptr [0x4454f0], eax,call dword ptr [0x4428e8],test eax, eax,je 0x43a80d,mov dword ptr [0x4454f4], eax,mov ecx, esi,mov edx, 0x4454ec,xor eax, eax," "msvcp140.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003c6ee,call 0x1003cc38,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003c5aa,add esp, 0xc,pop ebp,ret 0xc,jmp 0x1003cd96,push ebp,mov ebp, esp,and dword ptr [0x1006550c], 0,sub esp, 0x24,or dword ptr [0x10063270], 1,push 0xa,call dword ptr [0x100660cc],test eax, eax,je 0x1003c8d5,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,mov dword ptr [edi], eax," "msvcp140.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003e27e,call 0x1003e6e5,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003e13a,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x10010430,mov dword ptr [esi], 0x10002d8c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x10002d94,mov dword ptr [ecx], 0x10002d8c,ret ,int3 ," "mozglue.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10058f5e,call 0x10059481,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10058e3e,add esp, 0xc,pop ebp,ret 0xc,mov eax, dword ptr [0x100685a8],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x10058fe1,test eax, eax,jne 0x10058fdd,push 0x1005fb8c,call dword ptr [0x10066458],mov esi, eax,test esi, esi,jne 0x10058f9a,mov esi, ebx,jmp 0x10058fc4,push 0x1005fb04,push esi,call dword ptr [0x1006645c],test eax, eax,je 0x10058f96,push 0x1005faec,push esi," "freebl3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10052b3e,call 0x10052b53,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10052a1e,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x100650b4],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x10052b6d,test esi, ecx,jne 0x10052b93,call 0x10052b9e,mov ecx, eax,cmp ecx, edi,jne 0x10052b7f,mov ecx, 0xbb40e64f,jmp 0x10052b8d,test esi, ecx,jne 0x10052b8d,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x100650b4], ecx," "updater.exe" file has an entrypoint instructions - "call 0x413788,jmp 0x4130e2,mov eax, dword ptr [0x440fbc],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x4132e8,test eax, eax,jne 0x4132e4,push 0x43d130,call dword ptr [0x43e378],mov esi, eax,test esi, esi,jne 0x4132a1,mov esi, ebx,jmp 0x4132cb,push 0x43b500,push esi,call dword ptr [0x43e384],test eax, eax,je 0x41329d,push 0x43b4e8,push esi,mov dword ptr [0x440fc0], eax,call dword ptr [0x43e384],test eax, eax,je 0x41329d,mov dword ptr [0x440fc4], eax,mov ecx, esi,mov edx, 0x440fbc,xor eax, eax," "nssckbi.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000bdee,call 0x1000be03,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000bcce,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x10050014],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x1000be1d,test esi, ecx,jne 0x1000be43,call 0x1000be4e,mov ecx, eax,cmp ecx, edi,jne 0x1000be2f,mov ecx, 0xbb40e64f,jmp 0x1000be3d,test esi, ecx,jne 0x1000be3d,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x10050014], ecx," "nssckbi.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100196ee,call 0x10019703,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100195ce,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x10053084],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x1001971d,test esi, ecx,jne 0x10019743,call 0x1001974e,mov ecx, eax,cmp ecx, edi,jne 0x1001972f,mov ecx, 0xbb40e64f,jmp 0x1001973d,test esi, ecx,jne 0x1001973d,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x10053084], ecx," "updater.exe" file has an entrypoint instructions - "call 0x413a98,jmp 0x4133f2,mov eax, dword ptr [0x43dea4],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x4135f8,test eax, eax,jne 0x4135f4,push 0x43a590,call dword ptr [0x43b7dc],mov esi, eax,test esi, esi,jne 0x4135b1,mov esi, ebx,jmp 0x4135db,push 0x438b4c,push esi,call dword ptr [0x43b7e8],test eax, eax,je 0x4135ad,push 0x438b34,push esi,mov dword ptr [0x43dea8], eax,call dword ptr [0x43b7e8],test eax, eax,je 0x4135ad,mov dword ptr [0x43deac], eax,mov ecx, esi,mov edx, 0x43dea4,xor eax, eax," "osclientcerts.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100292ce,call 0x100292e3,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100291ae,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x1004d0c4],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x100292fd,test esi, ecx,jne 0x10029323,call 0x1002932e,mov ecx, eax,cmp ecx, edi,jne 0x1002930f,mov ecx, 0xbb40e64f,jmp 0x1002931d,test esi, ecx,jne 0x1002931d,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x1004d0c4], ecx,"53:T58e,Process "iexplore.exe" (UID: 00000000-00000968) was launched with modified environment variables: "Path" Process "firefox.exe" (UID: 00000000-00003008) was launched with modified environment variables: "Path" Process "updater.exe" (UID: 00000000-00001816) was launched with new environment variables: "MOZ_CRASHREPORTER_EVENTS_DIRECTORY="%APPDATA%\Mozilla\Firefox\Crash Reports\events", MOZ_CRASHREPORTER_DATA_DIRECTORY="%APPDATA%\Mozilla\Firefox\Crash Reports", MOZ_CRASHREPORTER_RESTART_ARG_0="%PROGRAMFILES%\Mozilla Firefox\firefox.exe", MOZ_CRASHREPORTER_RESTART_ARG_1="https://www.facebook.com/login", MOZ_CRASHREPORTER_STRINGS_OVERRIDE="%PROGRAMFILES%\Mozilla Firefox\browser\crashreporter-override.ini", MOZ_CRASHREPORTER_PING_DIRECTORY="%APPDATA%\Mozilla\Firefox\Pending Pings"" Process "updater.exe" (UID: 00000000-00003840) was launched with modified environment variables: "MOZ_CRASHREPORTER_RESTART_ARG_1" Process "helper.exe" (UID: 00000000-00003704) was launched with modified environment variables: "MOZ_CRASHREPORTER_RESTART_ARG_1" Process "firefox.exe" (UID: 00000000-00002612) was launched with new environment variables: "MOZ_LAUNCHED_CHILD="1"" Process "firefox.exe" (UID: 00000000-00000964) was launched with modified environment variables: "MOZ_CRASHREPORTER_EVENTS_DIRECTORY" Process "firefox.exe" (UID: 00000000-00000964) was launched with missing environment variables: "MOZ_LAUNCHED_CHILD"54:T828,Observed system executable string:"Generated File. Do not edit.[HEADER]Version|0.19t|$Arch|x86-msvc|$[PLUGINS][INVALID]C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll|$1519318656000|$C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL|$1263069738000|$C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL|$1269458558000|$c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll|$1493847268000|$c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrlui.dll|$1493847268000|$C:\Program Files\Java\jre1.8.0_151\bin\plugin2\npjp2.dll|$1512319474739|$C:\Program Files\Java\jre1.8.0_151\bin\dtplugin\npdeployJava1.dll|$1512319474589|$C:\Windows\system32\Adobe\Director\np32dsw_1231201.dll|$1509625738000|$" [Source: pluginreg.dat.tmp] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00003576-00000C25-44364965] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00003576-00000C25-44550617] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003576-00000C25-44974068] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00003576-00000C25-45044965] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001816-00000C25-103407678] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00003704-00000C25-117247294] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00003704-00000C25-117268558] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00003704-00000C25-117285073] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00003704-00000C25-117350779] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00003704-00000C25-117367226] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00003704-00000C25-117385128] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00003704-00000C25-117434011]55:Te48,"updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\xul.dll.sig" to "%PROGRAMFILES%\Mozilla Firefox\xul.dll.sig.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\xul.dll" to "%PROGRAMFILES%\Mozilla Firefox\xul.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\vcruntime140.dll" to "%PROGRAMFILES%\Mozilla Firefox\vcruntime140.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\updater.ini" to "%PROGRAMFILES%\Mozilla Firefox\updater.ini.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\updater.exe" to "%PROGRAMFILES%\Mozilla Firefox\updater.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\uninstall\helper.exe" to "%PROGRAMFILES%\Mozilla Firefox\uninstall\helper.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\ucrtbase.dll" to "%PROGRAMFILES%\Mozilla Firefox\ucrtbase.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\softokn3.dll" to "%PROGRAMFILES%\Mozilla Firefox\softokn3.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\softokn3.chk" to "%PROGRAMFILES%\Mozilla Firefox\softokn3.chk.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\qipcap.dll" to "%PROGRAMFILES%\Mozilla Firefox\qipcap.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe" to "%PROGRAMFILES%\Mozilla Firefox\plugin-hang-ui.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\plugin-container.exe.sig" to "%PROGRAMFILES%\Mozilla Firefox\plugin-container.exe.sig.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\plugin-container.exe" to "%PROGRAMFILES%\Mozilla Firefox\plugin-container.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\platform.ini" to "%PROGRAMFILES%\Mozilla Firefox\platform.ini.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\pingsender.exe" to "%PROGRAMFILES%\Mozilla Firefox\pingsender.exe.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\omni.ja" to "%PROGRAMFILES%\Mozilla Firefox\omni.ja.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nssdbm3.dll" to "%PROGRAMFILES%\Mozilla Firefox\nssdbm3.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nssdbm3.chk" to "%PROGRAMFILES%\Mozilla Firefox\nssdbm3.chk.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nssckbi.dll" to "%PROGRAMFILES%\Mozilla Firefox\nssckbi.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\nss3.dll" to "%PROGRAMFILES%\Mozilla Firefox\nss3.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\msvcp140.dll" to "%PROGRAMFILES%\Mozilla Firefox\msvcp140.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\mozglue.dll" to "%PROGRAMFILES%\Mozilla Firefox\mozglue.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\mozavutil.dll" to "%PROGRAMFILES%\Mozilla Firefox\mozavutil.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\mozavcodec.dll" to "%PROGRAMFILES%\Mozilla Firefox\mozavcodec.dll.moz-backup" "updater.exe" renamed original file"C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" to "%PROGRAMFILES%\Mozilla Firefox\minidump-analyzer.exe.moz-backup"56:Ta7a,Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00000968) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00001528) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00000944) Spawned process "iexplore.exe" with commandline "SCODEF:968 CREDAT:275457 /prefetch:2" (UID: 00000000-00001296) Spawned process "iexplore.exe" with commandline "SCODEF:1528 CREDAT:275457 /prefetch:2" (UID: 00000000-00003412) Spawned process "iexplore.exe" with commandline "SCODEF:944 CREDAT:275457 /prefetch:2" (UID: 00000000-00003432) Spawned process "firefox.exe" with commandline "https://www.youtube.com" (UID: 00000000-00003008) Spawned process "firefox.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003012) Spawned process "firefox.exe" with commandline "https://accounts.google.com" (UID: 00000000-00003080) Spawned process "updater.exe" with commandline "%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0 " ..." (UID: 00000000-00001816), Spawned process "updater.exe" with commandline "%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0 " ..." (UID: 00000000-00003840) Spawned process "helper.exe" with commandline "argv0ignored /PostUpdate" (UID: 00000000-00003704) Spawned process "maintenanceservice_tmp.exe" with commandline "dummyparam.exe upgrade" (UID: 00000000-00002424) Spawned process "firefox.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002612) Spawned process "firefox.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002076) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.0.7254536\\577035674" -parentBuildI ..." (UID: 00000000-00000964) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.6.477323308\\515072553" -childID 1 ..." (UID: 00000000-00003388) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.13.899709596\\1984075958" -childID ..." (UID: 00000000-00003904) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.20.846512909\\636303164" -childID 3 ..." (UID: 00000000-00003084) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.27.731736264\\52314388" -childID 4 ..." (UID: 00000000-00003340) Spawned process "updater.exe" with commandline "%ALLUSERSPROFILE%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\ ..." (UID: 00000000-00003596) Spawned process "pingsender.exe" with commandline "undefined/submit/telemetry/85896c6f-e8e3-4885-93fe-698c3c54d581/ ..." (UID: 00000000-00003276)57:Ta7a,Spawned process "iexplore.exe" with commandline "https://www.youtube.com/" (UID: 00000000-00000968) Spawned process "iexplore.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00001528) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00000944) Spawned process "iexplore.exe" with commandline "SCODEF:968 CREDAT:275457 /prefetch:2" (UID: 00000000-00001296) Spawned process "iexplore.exe" with commandline "SCODEF:1528 CREDAT:275457 /prefetch:2" (UID: 00000000-00003412) Spawned process "iexplore.exe" with commandline "SCODEF:944 CREDAT:275457 /prefetch:2" (UID: 00000000-00003432) Spawned process "firefox.exe" with commandline "https://www.youtube.com" (UID: 00000000-00003008) Spawned process "firefox.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00003012) Spawned process "firefox.exe" with commandline "https://accounts.google.com" (UID: 00000000-00003080) Spawned process "updater.exe" with commandline "%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0 " ..." (UID: 00000000-00001816), Spawned process "updater.exe" with commandline "%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0 " ..." (UID: 00000000-00003840) Spawned process "helper.exe" with commandline "argv0ignored /PostUpdate" (UID: 00000000-00003704) Spawned process "maintenanceservice_tmp.exe" with commandline "dummyparam.exe upgrade" (UID: 00000000-00002424) Spawned process "firefox.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002612) Spawned process "firefox.exe" with commandline "https://www.facebook.com/login" (UID: 00000000-00002076) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.0.7254536\\577035674" -parentBuildI ..." (UID: 00000000-00000964) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.6.477323308\\515072553" -childID 1 ..." (UID: 00000000-00003388) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.13.899709596\\1984075958" -childID ..." (UID: 00000000-00003904) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.20.846512909\\636303164" -childID 3 ..." (UID: 00000000-00003084) Spawned process "firefox.exe" with commandline "-contentproc --channel="2076.27.731736264\\52314388" -childID 4 ..." (UID: 00000000-00003340) Spawned process "updater.exe" with commandline "%ALLUSERSPROFILE%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\ ..." (UID: 00000000-00003596) Spawned process "pingsender.exe" with commandline "undefined/submit/telemetry/85896c6f-e8e3-4885-93fe-698c3c54d581/ ..." (UID: 00000000-00003276)58:T488,"ef815145211a1a34f6e93ff364b83a79.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "mozavcodec.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "nss3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "helper.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ucrtbase.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "minidump-analyzer.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "mozglue.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "default-browser-agent.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "freebl3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "firefox.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msvcp140.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "updater.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "nssckbi.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "osclientcerts.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE59:T461,Found reference to API "RegisterServiceCtrlHandler failed. (%d)" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "RegisterServiceCtrlHandler failed. (%d)" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp")5a:T4d4,"blocklist.xml" has type "XML 1.0 document text" - Location: [%PROGRAMFILES%\Mozilla Firefox\browser\blocklist.xml] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators" "active-update.xml.tmp" has type "XML 1.0 document ASCII text with very long lines with no line terminators" - Location: [%ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\active-update.xml.tmp] "updates.xml.tmp" has type "XML 1.0 document ASCII text with very long lines with no line terminators" - Location: [%ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\updates.xml.tmp] "private_browsing.VisualElementsManifest.xml" has type "exported SGML document ASCII text" - Location: [%PROGRAMFILES%\Mozilla Firefox\updated\private_browsing.VisualElementsManifest.xml] "firefox.VisualElementsManifest.xml" has type "exported SGML document ASCII text" - Location: [%PROGRAMFILES%\Mozilla Firefox\firefox.VisualElementsManifest.xml] "blocklist.xml" has type "XML 1.0 document text" - Location: [%PROGRAMFILES%\Mozilla Firefox\updated\browser\blocklist.xml] "firefox.VisualElementsManifest.xml" has type "exported SGML document ASCII text" - Location: [%PROGRAMFILES%\Mozilla Firefox\updated\firefox.VisualElementsManifest.xml]5b:T10b1,"widevinecdm.dll.lib.tmp" has type "current ar archive" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\gmp-widevinecdm\4.10.1440.19\widevinecdm.dll.lib.tmp] "widevinecdm.dll.sig.tmp" has type "data" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\gmp-widevinecdm\4.10.1440.19\widevinecdm.dll.sig.tmp] "webext.sc.lz4.tmp" has type "data" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\webext.sc.lz4.tmp] "extensions.json.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\extensions.json.tmp] "aborted-session-ping.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\datareporting\aborted-session-ping.tmp] "log930B.tmp" has type "IPS patch file" - Location: [%LOCALAPPDATA%\Mozilla\updates\308046B0AF4A39CB\updates\0\log930B.tmp] "~DFAE0C319F564D18D7.TMP" has type "data" - Location: [%TEMP%\~DFAE0C319F564D18D7.TMP] "~DFE2B43A2548D867FA.TMP" has type "data" - Location: [%TEMP%\~DFE2B43A2548D867FA.TMP] "~DF1031C648F07CF2F4.TMP" has type "data" - Location: [%TEMP%\~DF1031C648F07CF2F4.TMP] "~DF53A96E592A8F42D1.TMP" has type "data" - Location: [%TEMP%\~DF53A96E592A8F42D1.TMP] "~DFE71EF4CA962D64B7.TMP" has type "data" - Location: [%TEMP%\~DFE71EF4CA962D64B7.TMP] "~DFE8ED350CE4CBE637.TMP" has type "data" - Location: [%TEMP%\~DFE8ED350CE4CBE637.TMP] "~DF3EB7F610A88C9D96.TMP" has type "data" - Location: [%TEMP%\~DF3EB7F610A88C9D96.TMP] "~DF231BFF4C78353FA3.TMP" has type "data" - Location: [%TEMP%\~DF231BFF4C78353FA3.TMP] "asrouter.ftl.tmp" has type "UTF-8 Unicode text" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\settings\main\ms-language-packs\asrouter.ftl.tmp] "recovery.jsonlz4.tmp" has type "Mozilla lz4 compressed data originally 18562 bytes" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\sessionstore-backups\recovery.jsonlz4.tmp] "85896c6f-e8e3-4885-93fe-698c3c54d581.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\saved-telemetry-pings\85896c6f-e8e3-4885-93fe-698c3c54d581.tmp] "4bd923be-7148-4e1a-9a4d-894976d7f105.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\saved-telemetry-pings\4bd923be-7148-4e1a-9a4d-894976d7f105.tmp] "1705852435491.85896c6f-e8e3-4885-93fe-698c3c54d581.update.jsonlz4.tmp" has type "Mozilla lz4 compressed data originally 5077 bytes" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\datareporting\archived\2024-01\1705852435491.85896c6f-e8e3-4885-93fe-698c3c54d581.update.jsonlz4.tmp] "search.json.mozlz4.tmp" has type "Mozilla lz4 compressed data originally 7408 bytes" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\search.json.mozlz4.tmp] "1705851737923.4bd923be-7148-4e1a-9a4d-894976d7f105.update.jsonlz4.tmp" has type "Mozilla lz4 compressed data originally 4601 bytes" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\datareporting\archived\2024-01\1705851737923.4bd923be-7148-4e1a-9a4d-894976d7f105.update.jsonlz4.tmp] "addonStartup.json.lz4.tmp" has type "Mozilla lz4 compressed data originally 7017 bytes" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\addonStartup.json.lz4.tmp] "active-update.xml.tmp" has type "XML 1.0 document ASCII text with very long lines with no line terminators" - Location: [%ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\active-update.xml.tmp] "extension-preferences.json.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\extension-preferences.json.tmp] "updates.xml.tmp" has type "XML 1.0 document ASCII text with very long lines with no line terminators" - Location: [%ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\updates.xml.tmp]5c:Ta87,"ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\EF815145211A1A34F6E93FF364B83A79.EXE"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "")5d:T1347,"ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "")5e:T8a2,"ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\WSOCK32.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\WSOCK32.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\VERSION.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\WINMM.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\ef815145211a1a34f6e93ff364b83a79.exe.Local\" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\MPR.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\MPR.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\IPHLPAPI.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\IPHLPAPI.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\WINNSI.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\WINNSI.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\UxTheme.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"5f:T765,"updater.exe" touched file "C:\Program Files\Mozilla Firefox\firefox.exe.update_in_progress.lock" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\firefox.exe.moz-callback" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\updating\update.manifest" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\xul.dll.sig" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\xul.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\vcruntime140.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\updater.ini" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\updater.exe" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\ucrtbase.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\softokn3.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\removed-files" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\qipcap.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\precomplete" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\plugin-container.exe.sig" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\plugin-container.exe" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\platform.ini" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\pingsender.exe" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\osclientcerts.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\omni.ja" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\nssdbm3.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\nssckbi.dll" "updater.exe" touched file "C:\Program Files\Mozilla Firefox\nss3.dll"60:T717,"ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\WSOCK32.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\VERSION.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\WINMM.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\MPR.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\WINNSI.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\UxTheme.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-sysinfo-l1-2-1.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\dwmapi.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\PROPSYS.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\apphelp.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\api-ms-win-downlevel-shlwapi-l2-1-0.dll" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\msedge.exe" "ef815145211a1a34f6e93ff364b83a79.exe" trying to access non-existent file "C:\Windows\system32\msedge.exe"61:T979,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D" Found http requests in header "GET /success.txt" Found http requests in header "GET /success.txt?ipv4" Found http requests in header "POST /" Found http requests in header "POST /gts1c3"62:T2ed6,Found requests in header "GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0s; sb=o0WtZdg0Tk9t8F8VW87hP-OZ; _js_datr=o0WtZbeXbiVLsS06MzNObeeLjazoest=2950&lsd=AVptmD4a0lY&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=082611_45Ws&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data="; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ZGK2uU6brs2a4Gul15UV1FcR0wtL-g:eQcZdT8BR3TyO-JdConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0B0vPdk3IpqcSox8E_q8Nz2wLssDTWXWBOu0gT2h_tt20EZI2MTbm8UXF8AkQV5M9CHwko HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ekoK9fyXGR34izif_yKQJB9oyWWUjg:a1eFC4uVWLjRc3mz"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp0nXQPra7FuF8uOCpfPavLUMX6fVejX_R-eVSU5LVvhVNmvZBQuBMRX4gdYr8Sy-ZgPCAce&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1140865632%3A1705854377196110&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ekoK9fyXGR34izif_yKQJB9oyWWUjg:a1eFC4uVWLjRc3mz"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ekoK9fyXGR34izif_yKQJB9oyWWUjg:a1eFC4uVWLjRc3mz"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=3876101231521923552&bl=boq_identityfrontendauthuiserver_20240114.08_p0&hl=en-US&_reqid=59241&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1140865632:1705854377196110",null,null,"ASKXGp0nXQPra7FuF8uOCpfPavLUMX6fVejX_R-eVSU5LVvhVNmvZBQuBMRX4gdYr8Sy-ZgPCAce"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:ekoK9fyXGR34izif_yKQJB9oyWWUjg:a1eFC4uVWLjRc3mz"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ekoK9fyXGR34izif_yKQJB9oyWWUjg:a1eFC4uVWLjRc3mz"; in File: "SSL") Found requests in header "GET /generate_204?rVAI5A HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:B9soYtqEJjO_nOTvRoJZ8RG72tr9ww:YcCOI0ZRAVygxCxj; OTZ=7392447_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yc/l/0,cross/lHaJ-fsT0au.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ys/r/0gi59GnvylN.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yo/l/0,cross/h5VjgH_K65B.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yh/l/0,cross/BpswDIn4KwJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/4lCu2zih0ca.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL")63:T5f1,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp")64:T76c3,Found string "!This program cannot be run in DOS mode.$.text`.rdata@.data.00cfg@.tls.rsrc@.reloc^_[]^_[]^_[]^_[]^_[]null^_[]8Nonedeciimal3J^_[]^_[]V|QRP|$0WVD$(PL$ PWT$ rT$ QRPWLQRPD$ }t$ j^_[]T$ RPD$4WVw$QP^_[] ^_[]^_[]H^_[]6QVP^_[]AQVPL^_[]s7SPQ^_[]SWVP^_[]$;L$^_[],^_[]^_[]^_[]AQSP^_[]^_[]uz;C^_[]s PQ^_[]SWVP^_[]^_[]N(+O@OH+O@^_[]@ nameOH+O@N(+K@N,+K@N(+H@N,+H@GH;GD^_[]8nut8rt;^_[]s>PQsXSVQ^_[]6SVQ^_[]GBP13^_[]9F }t^_[]|$lj`D$|,jXhX?RPQ7jEh`L$TfL$TfC&VQPame=ilen"; ffT$Tfj@j PT$TfD$@SD$Pf;D$@PA9L$@9D$D$$;D$t$$QisRTfisRTfPPhXL$,Pt$0Spingsendf ^_[]L$ 1^_[](^_[]^_[]\^_[]QQWPj^_[]^_[],^_[]^_[]$^_[]?PQV^_[]indentattion\$pPWSL$LVL$LRWSPucj0ullyD$4j0D$D D$H/D$4hL$,1QRWPhL$,1^_[]SShfCSW1~pWPQRPW^pSPhPQPjPQPj^pSPhPQPjPQPj~pWh~pWS^LSP^LSPL$ 1^_[]^LSP~pWhFcsmSVW3ntel5ineI5Genut#=`_^[3VPWhY_^[^_[]^_[]SWVP^_[]^_[]^_[]^_[]^_[]H^_[]s=GWVQ^_[]6GWVSWQR^_[]vLWj8^_[]^_[]^_[]4^_[]^_[]^_[]qLSjqLVj^_[]C0)0t PWj^_[]^_[]^_[]SWVPRSQP^_[]SWV1^_[]vLWj ^_[]^_[]N8^_[]^_[]^_[]@PWQ6PWR6PQR^_[]SWVP?QPR^_[]^_[]^_[]^_[]^_[]^_[];2v&t#8V^_[]Y8+29A8s$^_[]9A8s^_[]^_[]6RVQ@RVQ^_[]^_[]tw;E^_[]SWVP^_[]^_[]^_[]^_[]SWVP^_[]^_[]^_[] ^_[]^_[]^_[]^_[] ^_[]SWVPAQSP^_[]^_[] ^_[]^_[]^_[]^_[]^_[]SWVP^_[]^_[]^_[]^8SPR^_[]^_[]N +O@N$+O@^_[]OH+O@^_[]0^_[]^_[]D$@P)D$p^_[]@ nameD$DPL$@1^_[]^_[]D$81L$81^_[]GH;GD^_[]8aug8ru>*tw1^_[]^_[]^_[]^_[]L^_[]9^$w9^$w^_[]D$ 1|$ 99\$$-uk1L$H1^_[]L$H1^_[]T$<9L$(1<$Wh)D$@D$1L$81^_[]L$81PQh|@^_[]x^_[]ail. det forf^_[]^_[] ^_[]^_[],^_[](^_[]L$ 1^_[]L$ 1^_[]L$ 1t$,1^_[]u,Qj^_[]^_[]^_[]^_[]SWVP^_[]SWVPu:jH^_[]<8,u8.G93Wj.V^_[]WjeV4^_[]RQP?QWP^_[]^_[]^_[]0^[]6SPW^_[]^_[]^_[]^_[]^_[]92tr^_[]^_[]^_[]SWVP^_[]SWVP^_[]^_[]GBP1crashreporter.exe.extra.memory.json.gzTelemetryClientIdTelemetryServerURLTelemetrySessionId%FT%H:00:00.000Z000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff-InfinityEMCheckCompatibilityenableYAMLCompatibilityAccessibilityCrashReporterSorryAvailableSwapMemoryTotalVirtualMemoryAvailableVirtualMemoryTotalPhysicalMemoryAvailablePhysicalMemoryPurgeablePhysicalMemoryJSOutOfMemoryCrash report submitted successfullyUnknownNetAddrSocketFamilyTestKeyUnknown error, error code: 0x%08x%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x.txtCommentGrayTextCrashReporterErrorTextQuotaManagerShutdownTimeoutAsyncShutdownTimeoutUser32BeforeBlocklistBlockedDllListGraphicsStartupTestNo server URL, not sending reportCheckSendReportRestartstrictRootGPUProcessLaunchCountClassRegistrationInfoParentenvironmentTelemetryEnvironmentDesktopEnvironmenthasCrashEnvironmentAccessibilityClientAccessibilityInProcClientsignificantIpcCreateEndpointsNsresultCrashReporterDefaultstackLimitrejectDupKeysallowNumericKeysUtilityProcessStatusGPUProcessStatusVRProcessStatusRDDProcessStatusErrorDumpFileExistsErrorExtraFileExistsLowPhysicalMemoryEventsErrorBadArgumentsallowCommentscollectCommentsURLSegmentsallowSpecialFloatsuseSpecialFloatsShutdownProgressPHCBaseAddressReportSubmitSuccessGraphicsNumRenderersGraphicsNumActiveRenderersdropNullPlaceholdersallowDroppedNullPlaceholdersadditional_minidumpsAdd-onsDetailsallowSingleQuotesNotesExperimentalFeaturesContentSandboxCapabilitiesstackTracesStackTracesBreadcrumbsallowTrailingCommasAppInitDLLsNull Value Passed to Value ConstructorCycleCollectoripc_channel_errorDumperErrorIPCSystemErrorGraphicsCriticalErrorJSModuleLoadErrorvendorAdapterDriverVendorStopSendingReportsForexpecting another \u token to begin the second half of a unicode surrogate pairErrorCreateDumpDirminidump-analyzerin Json::Value::duplicateAndPrefixStringValue(): Failed to allocate string value bufferin Json::Value::duplicateStringValue(): Failed to allocate string value bufferGraphicsDrawShaderGraphicsCompileShaderupload_file_minidumpIpcCreatePipeSocketPairErrnoIpcCreateTransportDupErrnoIpcCreatePipeFcntlErrnoIpcCreatePipeCloExecErrnoExtraReportInfo.jsonDeviceResetReasonIPCReadErrorReasonShutdownReasonMozCrashReasonIPCTransportFailureReasonunknown exceptionJavaExceptioninvalid string positionindentationLastInteractionDurationMissing ',' or ']' in array declarationMissing ',' or '}' in object declarationapplication-submissionversiondisplayVersionAdapterDriverVersionPluginVersionplatformVersionCPUMicrocodeVersionprecisionGMPPluginmainHasDeviceTouchScreenIsWebRenderResourcePathOverriddenSubmittedFromskipBomMacAvailableMemorySysctlMacMemoryPressureSysctlIPCFatalErrorProtocolnullGpuSandboxLevelContentSandboxLevelEventLoopNestingLevelchannelReleaseChannelXPCOMSpinEventLoopStackPHCFreeStackPHCAllocStackxpcomAbibad array new lengthGMPLibraryPathErrorNoSettingsPathcrashSecondsSinceLastCrashLastStartupWasCrashStartupCrashminidumpSha256HashMinidumpSha256HashIPCFatalErrorMsgsubmit.logCrashAddressLikelyWrongmap/set too longvector too longstring too longdeque too longin Json::Value::duplicateAndPrefixStringValue(): length too big for prefixingWindowsErrorReportingIsGarbageCollectingType is not convertible to stringEmpty escape sequence in stringBad escape sequence in stringpendingIAccessibleConfig%.*g%.*fGetThemePartSizeOOMAllocationSizePHCUsableSizeIPCMessageSizeErrorDumpFileMoveErrorExtraFileMovein Json::Value::operator[](int index): index cannot be negativetruein Json::Value::operator[](ArrayIndex)const: requires arrayValuein Json::Value::operator[](ArrayIndex): requires arrayValuein Json::Value::resolveReference(key, end): requires objectValuein Json::Value::removeMember(): requires objectValuein Json::Value::find(begin, end): requires objectValue or nullValueLauncherProcessStateIPCShutdownStateContentSandboxWin32kStatecreationDatecrashDatefalseProfilerChildShutdownPhasearchitectureLinuxUnderMemoryPressureMacMemoryPressureJSLargeAllocationFailuretypeprocessTypeProcessTypeprecisionTypeRemoteTypeStartupTimeInstallTimeMacMemoryPressureNormalTimeMacMemoryPressureCriticalTimecrashTimeCrashTimeMacMemoryPressureWarningTimePluginFilenameMissing '}' or object member nameMissing ':' after object member nameWindowsPackageFamilyNameFontNameErrorNoProductNameUtilityActorsNameJSActorNamePluginNameBackgroundTaskNameMainThreadRunnableNameIPCMessageNamecommentStyleViewReportTitleCrashReporterVendorTitleCrashReporterTitleTotalPageFileAvailablePageFileContentSandboxCapableThrottleableuseragent_localeLargestInt out of UInt rangeLargestUInt out of UInt rangedouble out of UInt rangeLargestInt out of UInt64 rangedouble out of UInt64 rangeLargestUInt out of Int64 rangedouble out of Int64 rangeSystemMemoryUsePercentageAbortMessageJSActorMessageTextureUsageEndOfLifeTestUnicodeHeadlessModeBackgroundTaskModeSafeModeJavaStackTracePHCKindIsWaylandbuildClassRegistrationInfoChildStartupCacheValidsubmittedStorageConnectionNotClosedBlocklistInitFailedReportSubmitFailedWasmLibrarySandboxMallocFailedContentSandboxEnabledDOMFissionEnabledDOMIPCEnabledpayloadErrorExtraFileReadclientIdTelemetryClientIdsessionIdTelemetrySessionIdcrashIdbuildIdLine %d, Column %dmetadataOpenThemeDataCloseThemeDatafailIfExtraMozillaMOZ_CRASHREPORTER_RESTART_ARG_MOZ_CRASHREPORTER_EVENTS_DIRECTORYMOZ_CRASHREPORTER_PING_DIRECTORYMOZ_CRASHREPORTER_DATA_DIRECTORYMOZ_CRASHREPORTER_AUTO_SUBMITUptimeTSMOZ_CRASHREPORTER_DUMP_ALL_THREADSWinsock_LSPMOZ_CRASHREPORTER_NO_DELETE_DUMPTelemetryServerURLErrorNoServerURLCheckIncludeURLMOZ_CRASHREPORTER_URLMOZ_CRASHREPORTER_RESTART_XUL_APP_FILEMOZ_CRASHREPORTER_STRINGS_OVERRIDEProductIDAdapterSubsysIDAdapterVendorIDDistributionIDAdapterDeviceIDApplicationBuildIDCrashPingUUID-1e+9999emitUTF8CrashReporterProductErrorText2CrashReporterDescriptionText2Quit2ReportDuringSubmit2ReportPreSubmit2keylength >= 2^30/submit/telemetry//crash/in Json::Value::setComment(): Comments must start with /Value is not convertible to UInt.additional six characters expected to parse unicode surrogate pair.' is not a number.Couldn't read configuration.Value is not convertible to bool.A valid JSON document must be either an array or an object value.Extra non-whitespace after JSON value.Value is not convertible to double.Syntax error: value, object or array expected.Bad unicode escape sequence in string: hexadecimal digit expected.Bad unicode escape sequence in string: four digits expected.Value is not convertible to UInt64.Value is not convertible to Int64.Exceeded stackLimit in readValue().precisionType must be 'significant' or 'decimal'commentStyle must be 'All' or 'None'Duplicate key: '"; filename="Content-Disposition: form-data; name="See Crash report submission failed: crash.submission.1 for detail.Content-Type: application/jsonContent-Type: application/octet-streamContent-Disposition: form-data; name="extra"; filename="extra.json"Unknown exceptionbad allocationbad array new lengthWakeAllConditionVariableSleepConditionVariableCSRSDSbLLD PDB.crashreporter.pdbHASH_BeginHASH_CreateHASH_DestroyHASH_EndHASH_UpdateNSS_InitializeRegCloseKeyRegCreateKeyExWRegCreateKeyWRegOpenKeyExWRegOpenKeyWRegQueryValueExWRegSetValueExWInitCommonControlsExGetStockObjectGetTextExtentPoint32WSelectObjectSetBkModeSetTextColorCoCreateGuidSHGetFolderPathWHttpAddRequestHeadersWHttpOpenRequestWHttpQueryInfoWHttpSendRequestWInternetCloseHandleInternetConnectWInternetCrackUrlWInternetOpenWInternetQueryDataAvailableInternetReadFileInternetSetOptionWPathAppendWBeginPaintCallWindowProcWCheckDlgButtonCloseClipboardDialogBoxIndirectParamWDialogBoxParamWDrawTextWEnableWindowEndDialogEndPaintFillRectGetClientRectGetClipboardDataGetDCGetDlgItemGetDlgItemTextWGetFocusGetPropWGetSysColorGetSysColorBrushGetWindowLongWGetWindowRectGetWindowTextWInvalidateRectIsClipboardFormatAvailableIsDlgButtonCheckedIsWindowEnabledLoadIconWMapWindowPointsMessageBoxWMoveWindowOpenClipboardPostMessageWRemovePropWSendDlgItemMessageWSendMessageWSetDlgItemTextWSetFocusSetPropWSetTimerSetWindowLongWSetWindowTextWShowWindow??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ??0_Lockit@std@@QAE@H@Z??0ios_base@std@@IAE@XZ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ??1_Lockit@std@@QAE@XZ??1ios_base@std@@UAE@XZ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z??Bid@locale@std@@QAEIXZ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ?_Xbad_alloc@std@@YAXXZ?_Xlength_error@std@@YAXPBD@Z?_Xout_of_range@std@@YAXPBD@Z?bad@ios_base@std@@QBE_NXZ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z?eof@ios_base@std@@QBE_NXZ?fail@ios_base@std@@QBE_NXZ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ?good@ios_base@std@@QBE_NXZ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@ZCloseHandleCompareFileTimeCreateDirectoryWCreateEventWCreateProcessWCreateThreadDeleteCriticalSectionDeleteFileWEnterCriticalSectionFindCloseFindFirstFileWFindNextFileWFindResourceWFormatMessageWFreeLibraryGetCurrentProcessGetCurrentProcessIdGetCurrentThreadIdGetFileAttributesWGetLastErrorGetModuleFileNameWGetModuleHandleWGetProcAddressGetStartupInfoWGetSystemTimeGetSystemTimeAsFileTimeGlobalAllocGlobalFreeGlobalLockGlobalUnlockInitializeCriticalSectionAndSpinCountInitializeSListHeadIsDebuggerPresentIsProcessorFeaturePresentLeaveCriticalSectionLoadLibraryWLoadResourceLocalFreeLockResourceMoveFileWMultiByteToWideCharQueryPerformanceCounterResetEventSetEventSetUnhandledExceptionFilterSizeofResourceTerminateProcessUnhandledExceptionFilterVerSetConditionMaskVerifyVersionInfoWWaitForSingleObjectWaitForSingleObjectExWideCharToMultiByte_CxxThrowException__current_exception__current_exception_context__std_exception_copy__std_exception_destroy_except_handler4_commonmemchrmemcmpmemcpymemmovememsetwcsrchr__acrt_iob_func__p__commode__stdio_common_vfprintf__stdio_common_vfscanf__stdio_common_vfwprintf__stdio_common_vsprintf__stdio_common_vswprintf_s_fseeki64_get_stream_buffer_pointe"; File: "crashreporter.exe"), Found string "!This program cannot be run in DOS mode.$.text`.rdata@.data.00cfg@.tls.rsrc@.relocs RP^_[]SWVP^_[]SWVP^_[]^_[]^_[]SPQR^_[]^_[]^_[]GBP1^_[]hflB^_[]^_[]u!;HD$(ASh`pB^XSP^XSPFxPWhPWQjhLoBhP>ASh`pB)F8)F@Fh+~H~@+~8PSFh+FpFhPSQPRSRWPQQPSRPWRQN(QP^,+^RQPW^_[]=p}BhtmB4^_[]j@PRhF\BhgaBhcaBPWj@hqeBhieBhHdBhMdBhHdBhMdBhHdBhUeBhNeBhTWBhFWBh@WBh}ZBhrZB^_[]SWVP^_[]SWVPu!;Cs1j@W^_[]s&RQs&RQ^_[]s/j@Vs&SQs"SQu!;S^_[]^_[]^_[]SWVP^_[]~#OA^_[];2v-t(8VUSWV^_[]USWV^_[]USWV^_[]sXPQhelBSWVP^_[]^_[]AQWVDWQPAQWV^_[]SWVP^_[]SWVPu!;F^_[]^_[]^_[]u!;Gu!;J^_[])D$p)D$`)D$P)D$@)D$0)D$ RPQVQPVR^_[]QRWj^_[]^_[]h`pBQPSWh`pB+SWjRQSV^_[]QPVS^_[]PVQRWSRQPV$^_[]hLoBt-f.hLoB^_[]t-f.4^_[]^_[]^_[]hLoB^_[]5@~B^_[]USWV^_[]^_[]^_[]^_[]USWV Zf9 Yu^_[]hjlBhjlB^_[]^_[]PSj@PSj@ho\BhsaBhhaB^_[]^_[]s QPSWVP^_[]^_[]^_[]^_[]^_[]u!;K^_[]soj@Q^_[]sDWQs:WQs)j@Vs&WQs"WQ^_[];8uq^_[]^_[];Q8rk^_[]Qj%PSWVP^_[]SWVP^_[]sNRQs`RQ ^_[]s&SQ^_[]SWVP^_[]s=RQ^_[]SWVP^_[]SWVP^_[]^_[]^_[]^_[]^_[];7tA^_[]\>Pf;AWRP^_[]ySPQPSPQpWPQORPQORPQ^_[]s#RQ^_[]<7|\H^_[]4^_[]^_[]hPQ@h`R@h`S@^_[]PRVW^_[]s&VQs"VQh too longvector too longdeque too longin Json::Value::duplicateAndPrefixStringValue(): length too big for prefixingIsGarbageCollectingType is not convertible to stringEmpty escape sequence in stringBad escape sequence in stringThreadIdNameMappingpendingRecordReplayHangPluginHangIAccessibleConfig%.*g%.*fGetThemePartSizeFramePoisonSizeOOMAllocationSizeProxyStreamSizeBreakpadReserveSizePHCUsableSizeIPCMessageSizecrashreporter.exeErrorDumpFileMoveErrorExtraFileMovein Json::Value::operator[](int index): index cannot be negativetruein Json::Value::operator[](ArrayIndex)const: requires arrayValuein Json::Value::operator[](ArrayIndex): requires arrayValuein Json::Value::resolveReference(key, end): requires objectValuein Json::Value::getMemberNames() value must be objectValuein Json::Value::find(begin, end): requires objectValue or nullValuein Json::Value::asCString(): requires stringValueLauncherProcessStateIPCShutdownStatecreationDatecrashDatefalseFramePoisonBasearchitectureStatFailureJSLargeAllocationFailureGetHGlobalFromStreamFailureCreateStreamOnHGlobalFailureCoMarshalInterfaceFailuretypeprocessTypeProcessTypeprecisionTypeRemoteTypeStartupTimeInstallTimecrashTimeCrashTimePluginFilenameMissing '}' or object member nameMissing ':' after object member nameErrorNoProductNamePluginNameIPCMessageNamecommentStyleAsyncShutdownModuleViewReportTitleCrashReporterVendorTitleCrashReporterTitleTotalPageFileAvailablePageFileContentSandboxCapableThrottleableuseragent_localeLargestInt out of UInt rangeLargestUInt out of UInt rangedouble out of UInt rangeLargestInt out of UInt64 rangedouble out of UInt64 rangeLargestUInt out of Int64 rangedouble out of Int64 rangeSystemMemoryUsePercentageAbortMessagePluginCpuUsageTextureUsageErrorEndOfLifeTestUnicodeSafeModeJavaStackTracePHCKindIsWaylandbuildClassRegistrationInfoChildInterfaceRegistrationInfoChildProxyStreamValidsubmittedStorageConnectionNotClosedA11yHandlerRegisteredassert json failedBlocklistInitFailedReportSubmitFailedContentSandboxEnabledDOMFissionEnabledDOMIPCEnabledDiscardedpayloadErrorExtraFileReadclientIdTelemetryClientIdsessionIdTelemetrySessionIdcrashIdbuildIdmetadataOpenThemeDataCloseThemeDataMozillaMOZ_CRASHREPORTER_RESTART_ARG_MOZ_CRASHREPORTER_EVENTS_DIRECTORYMOZ_CRASHREPORTER_PING_DIRECTORYMOZ_CRASHREPORTER_DATA_DIRECTORYMOZ_CRASHREPORTER_AUTO_SUBMITUptimeTSMOZ_CRASHREPORTER_DUMP_ALL_THREADSWinsock_LSPMOZ_CRASHREPORTER_NO_DELETE_DUMPIsWaylandDRMisRTLViewURLCrashDetailsURLTelemetryServerURLErrorNoServerURLCheckIncludeURLMOZ_CRASHREPORTER_URLMOZ_CRASHREPORTER_RESTART_XUL_APP_FILEMOZ_CRASHREPORTER_STRINGS_OVERRIDEProductIDAdapterSubsysIDAdapterVendorIDCrashIDAdapterDeviceIDBuildIDCrashPingUUID-1e+9999emitUTF8Bug_1086977CrashReporterProductErrorText2CrashReporterDescriptionText2Quit2ReportDuringSubmit2ReportPreSubmit2CpuUsageFlashProcess2CpuUsageFlashProcess1Bug_1541161/submit/telemetry//crash/in Json::Value::setComment(): Comments must start with /Value is not convertible to UInt.additional six characters expected to parse unicode surrogate pair.' is not a number.Couldn't read configuration.Value is not convertible to bool.A valid JSON document must be either an array or an object value.Value is not convertible to double.Syntax error: value object or array expected.Bad unicode escape sequence in string: hexadecimal digit expected.Bad unicode escape sequence in string: four digits expected.Value is not convertible to UInt64.Value is not convertible to Int64.Exceeded stackLimit in readValue().precisionType must be 'significant' or 'decimal'commentStyle must be 'All' or 'None'"; filename="Content-Disposition: form-data; name="Crash report submission failed: crash.submission.1Content-Type: application/octet-streamUnknown exceptionbad allocationbad array new lengthWakeAllConditionVariableInitializeConditionVariableSleepConditionVariableCSRSDSLLD PDB.z:\task_1579290903\build\src\obj-firefox\toolkit\crashreporter\client\crashreporter.pdbHASH_BeginHASH_CreateHASH_DestroyHASH_EndHASH_UpdateNSS_InitializeBeginPaintCallWindowProcWCheckDlgButtonChildWindowFromPointCloseClipboardDialogBoxIndirectParamWDialogBoxParamWDrawTextWEnableWindowEndDialogEndPaintFillRectGetClientRectGetClipboardDataGetDCGetDlgItemGetDlgItemTextWGetFocusGetPropWGetSysColorGetSysColorBrushGetWindowLongWGetWindowRectGetWindowTextWInvalidateRectIsClipboardFormatAvailableIsDlgButtonCheckedIsWindowEnabledLoadIconWMapWindowPointsMessageBoxWMoveWindowOpenClipboardPostMessageWRemovePropWSendDlgItemMessageWSendMessageWSetDlgItemTextWSetFocusSetPropWSetTimerSetWindowLongWSetWindowTextWShowWindowGetStockObjectGetTextExtentPoint32WSelectObjectSetBkModeSetTextColorRegCloseKeyRegCreateKeyExWRegCreateKeyWRegDeleteValueWRegOpenKeyExWRegOpenKeyWRegQueryValueExWRegSetValueExWInitCommonControlsExCoCreateGuidSHGetFolderPathWHttpAddRequestHeadersWHttpOpenRequestWHttpQueryInfoWHttpSendRequestWInternetCloseHandleInternetConnectWInternetCrackUrlWInternetOpenWInternetQueryDataAvailableInternetReadFileInternetSetOptionWPathAppendW??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ??0_Lockit@std@@QAE@H@Z??0ios_base@std@@IAE@XZ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ??1_Lockit@std@@QAE@XZ??1ios_base@std@@UAE@XZ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z??Bid@locale@std@@QAEIXZ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ?_Xbad_alloc@std@@YAXXZ?_Xlength_error@std@@YAXPBD@Z?_Xout_of_range@std@@YAXPBD@Z?bad@ios_base@std@@QBE_NXZ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z?eof@ios_base@std@@QBE_NXZ?fail@ios_base@std@@QBE_NXZ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ?good@ios_base@std@@QBE_NXZ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@ZCloseHandleCompareFileTimeCreateDirectoryWCreateEventWCreateProcessWCreateThreadDeleteCriticalSectionDeleteFileWEnterCriticalSectionFindCloseFindFirstFileWFindNextFileWFindResourceWFormatMessageWFreeLibraryGetCurrentProcessGetCurrentProcessIdGetCurrentThreadIdGetFileAttributesWGetLastErrorGetModuleFileNameWGetModuleHandleWGetProcAddressGetStartupInfoWGetSystemTimeGetSystemTimeAsFileTimeGlobalAllocGlobalFreeGlobalLockGlobalUnlockInitializeCriticalSectionAndSpinCountInitializeSListHeadIsDebuggerPresentIsProcessorFeaturePresentLeaveCriticalSectionLoadLibraryWLoadResourceLocalFreeLockResourceMoveFileWMultiByteToWideCharQueryPerformanceCounterResetEventSetEventSetUnhandledExceptionFilterSizeofResourceTerminateProcessUnhandledExceptionFilterVerSetConditionMaskVerifyVersionInfoWWaitForSingleObjectWaitForSingleObjectExWideCharToMultiByte_CxxThrowException__CxxFrameHandler3__std_exception_copy__std_exception_destroy_except_handler4_commonmemchrmemcmpmemcpymemmovememsetwcsrchr__acrt_iob_func__p__commode__stdio_common_vfprintf__stdio_common_vfscanf__stdio_common_vfwprintf__stdio_common_vsprintf__stdio_common_vswprintf_s_fseeki64_get_stream_buffer_pointers_set_fmode_wfopen_sfclosefflushfgetcfgetposfgetsfputcfreadfsetposfwritesetvbufungetc__setusermatherr_dtestceilmodf"; File: "crashreporter.exe")65:T896d,"GET /img/desktop/supported_browsers/yt_logo_rgb_light.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D" "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba" "GET /img/desktop/supported_browsers/dinosaur.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001X00000001�00000001�00000001�0000000160000000100007ee~,U��Y^��Fr��9~8ko��3��I��Ê��y�<�6�C��q,�ŒD�h��n��?/�^�y�-�e�,n�7Jp��$3PH��H$7`��pq��Q�S27֔lrƥ��I�ɹ��!YӀX��D4��N�|h�&J�E�*��/a(c��Mh��bN��K��q"8I�+�V�9v�R'�Y�S��oX�X��'�k N��!�.!"&��X��w��`��}�f�W��~�|�?�%��l��ڐ��֒m-A��l�/�w02�=`s�ҵ��3��xb�SS�ۤ��L��37E�3�H�)�+��,�a�$��R&�(w��?t�Ζ8xXqVd�/98>��pТ�у��9�`b�_L3!s��Y��}L�*�Z�AM�['lb*�,`��U�S��7�X�M,@��M)b4�2,�3 >�bX#glMx��M3 �VZg�uJ��X9g�*S�VL��q��7��IVi_-�o25�}s�t�3��2 �%]��k�B0��/�a��ט)�r�:%!��I��U�}��FnM��=ӛ��sWT�z��}�ӛ�ψU�d�� x��hx+��c��3*k��I�\H}�^��{�y��N��-g�d�Q�:M�ֻ�=��LT�F��0�:��?��u�u�˟:�m;D=�d�u4�C�p�˺�ݒ�/ޮ��~y��:�n��O��z�%0�`{�%�ϑ��E��.]��;z߼��O�>$�}�9��9�BQ-�A5N��)մN�[��wTŃ oQ�APG#΍v-�.�?��QUTF�M8�tI��6f)1��:��ٯ+2��97��}�N�Y!��n0�ʜd͘3![IfY��I�-E:'58>%ޥ�-d6��O��x��^ۇ��N��pB?�G)8 �ZG��g�Ā_.��Z�-��0(�~#Ja��B��;Ց��{G�ی��4�:�8�ZHlYp�C�@��s@7�YG~�*/�ri ��{�+�Hjn�EuPU��Ri�A��}��w*�\��s^`تѰ�hb�Uq_��[�ֆn��+�;��zDb_�+��i�4u�u4�;-��q��Vwr{J��UFP�K�G�u(�~$G��Kx�\�F��SA�]}��?�8��P��=*��M)�}�~.ؖs��X� o>�7rH�*Ep�Ku�C�[�+�{F�?c񅺟!��ƨzU=~W�:;�� U��?��", "000000010000000100000001�00000001s006�F�", "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 9171X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Mon 15 Jan 2024 10:54:51 GMTExpires: Tue 14 Jan 2025 10:54:51 GMTCache-Control: public max-age=31536000Age: 538282Last-Modified: Wed 16 Oct 2019 17:15:00 GMTContent-Type: image/pngAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000�PNGIHDR4d��"��PLTE��((((((((((((((((((((((((((((((((((((((((((((((((��PP�� pp��@@��``��00+.s�!tRNS@`�P��0�� p�@��0А�Pp�ఠ` q��"�IDATx��vC1Qe}n��d's71�I�̜�'�_��#��ײn)vs�n�k��p7��Wg�?��qr&��8 �"61�d��M��-�:�V�#�1bO�0��K�+~Kq�P�w��g��Co��E̺�D5��Ǳ�G@��4�yX��0�mC1Tb�I�V��R�$P�4jT�$PC��˹��Hp0�P�%�y��H�G2�x��h k��z�f ;��h �Q�� ;;��lhO��Gn4��p�h`��_��r�6@�V��'g��XB�8.��@�h��o7T��q�^�Vc1L�l�wd��B4f�.��3N��Ʃ��DC3��،S-*?��6��n�jh^)�:D��G��r��3�d?N�DC4�M�/��a��X9R�hB4D�͘�" "��4N��8�S-��n^�q��ǩ.Uu�&DC4xO��Cd��;ʹ':�!�(䫞?"��8Ѻu��^��k�3nEC4��K²F��x�gx��h��>^#�}�y�M�]!�͈��[�8N��(DC4��?5:I�Tok�>��ÑS<�D�z��,}b,J4�yN��$�E��}�@4D#��|��D_DC4|h�Sc[k�ia�V4D��?4𩱨u��>��Ʀ�L��DC4|h�ScWi��'N��?ɼ}b[gk�1��$��!d�F�h�f��m�l��Q9|�y��}U��C�!�^�R��9�+��!�*d��j�6��>��N��u��ϯh��_�h��}��1�0;Ev�A��n�nEC4��p�H�7�P~3�2Ѩ�6�?"�]�n/nEC4�;�]�=�rDC4j{J�^��}��m �aI�[�$r)�d��hT��^Z\߷-��!viPD��օw�|�!��o��'�l?��@4D��Sq��*�d��hX��їe?�nEC4l�?Z\߷+��a��8�i�j!��:8�ñ��U�;?�뿸up��ڲ�*��o��h��51]J~l\�'�ѽ�=�S��|�bUU4D�~p��u��`�V4D�{i��o�t�si�h��s��G�P�s�h�V4D�U��@4D��T�OŮ�A��h�/M��e��ح�[��}$�OMt(t��ڥ}�!ݻM8}��}��!N��\�[��!&n��k4��oWfk�.��h��)��ƪ�A�;��!�AW�[��F��f��:p+�a��W�O.��z��lr?c��!�{M��W��e�CW�h�F�7jT��\��v�U8I��k��h�ۇh��h��h`�F��>ds��O4D�6Dc1N1�^"A4DC4(�.rY�|��\�'�q^v��8I�X~��<��_�;�-IN �"�$e��ʛ��Y��w�i�tE�b�(J�Ҹ��2��n��BiPg��O��H��kmqΥ��9��ɀ�4(�jw��$�6��-��Kl��_��_(Ņ�v\yq�m��[gy;a��`�4(��9��;�4�+�6��K��r1�", "�i�Ҡ4|IA�JH�tg�s��ҿ�WҸ��F%�)ac��n�e1oF�Ai��=�\��:܁��S~��R��t;��cDi!�Fuj��)N��4��+�uZ�9�(�\�j�C��w?�4�'�6�G�!��:�~��Nt�1�Ⱥ�w+i��il��c�a� ]%��4�#�6Β�G�f�>,5Q��ޔ�aW�v��D9H,㤈\^��/�!p�Q�$^�ѣ��Ai�E�$W@�I�?sip$]d@3�U1ʂ�/�(Jc�'N��:�w��}��#��Ҙ0��p��7�(J�/�D�X��d��(ED!��ti��$�8L��,X��4^��5�5�`��1��d��!��nw�-��u4��(�G��ЇO�(�r��^�'��Ni<��v�5�Ƃ�k��>K��}GEiTQP+#�jꀲ(J#�1f��ƅ��B3��EAo��Yؠ4(��"�)�G��gCI��]�a��T^ڗ�B�4(�$8�Q⃜�]�\��O�|��w9�yxiPE�ȭx��t@b!n��=��.J��Cn;<�r8i04/��8\9��<��Ai$�b��S�/��EҀ��X��J`Z��F�$�<��M�4ܱ�Pn��>�4(�(h<~�Gi04�k�e:��*��Ҡ4�Ms��s:��La6�r��:�Tq��2�4(� pf��>�T�ۑ�q��=��a�Aiܬ=A��#J�Ni�#]w틜N�4( ;��a(�84�ҨG"*�#��TJ��1�'fJc�d�fn?�0��i��)JH�O40L�84��X��G��S��GGQ��tJc��Y�}�cK3GiP8R�31��Z��-�Li��n��ܱJq��Kl{�Ai�}�^ˋ]g�A�l�ƫ�[ڠ4RsE��*�ͼ��/֠4(��l�*�-9t4�e�>"��Li��A��V��꼈�Q8�Ai�d�bMv��a��;J�Ni��Ԉ�s�2�'J#+�uT��nE��M�4vmk^K�^��(��I��7�p�(��)d��1iW��FQ��enN��"�M�{��z��ShG�н�*2�Ai��f�sKi`C�)��r�v�*� �$��Q�҈�¢�V)th:�Qt�}�м��{�MiPF��Ұ�:Y��R��C��1Ϥ4(�YԠ/h�FR��tJ�̪<��Mt�4(T��G�^?��R[��(��[ΪP��G�s�xA��T�3j��t��h�9��+��V٩}��'�X�}��h�G�A��T/��Frm��C�;�K��4��/�q�� J��t�R�suk�g�^F��h�y��*)~�ײod�__@4z�#�3��!�P/��X��kQ|/%4��5h�F�hd�Џ��Ƌ�z�8�{傆�,��:4��F�ͭ��OI6�K�l��4@C��wz4T��/�hHG�A��*<�g`��F�う셎�-��]�P/�� 9!-��Р��!��[��$��9n�E�BWڏ4�b4��*�^�Eq��"4��2=4��Qu�l��(h�q<Ш4�!��;Ш��6I�@�Q��A4|��N�h�+b�m��#�h� I��ͱ}V��/4�\�4<��A㐕f�F��L/'��I�S�@�EV�bߝ��h�翚gˬki��<��Uֵ�{��c��>�Z��V�F�8V�q�Apа�K�[�h4�Fm�N��]V��0hd��", "9�4Ƭjи84֠qE:F4YՋ٠��p=�4�E:�4l�5mUC��hd��fh쳦��O$h�h��o��7C�{`��5h�h��~�6[��4@4~��66C�hX)�1s4��HY��1w44��z 4Y�4@4B��4��!�!;�ok��{��4K"�Y��4@4@�~4t��f�F��Q?��-��h�h�b��O~|_��<��4@4@�+У�a��m4@4@cVh��m��Q��h�F4��:h��nA4@��N��~�@�k4�C�@4@ChH�Z��4B߷��n�8��H��!4B�g��~1��D#��4@4�q4蠡?�o��h��t��o��y��U�2i��V��1�^��t��L0��@4@#"�@�׾�@#ԒH1�Ј��m��4@4@�5�k�2i��!��@��S�_�h�h��k��ACp��A4@#&O�G�4��A4@#&�<��!��?�o��0��@4@4|c]pp_��h�h��s�t��$��h<��͐�h��h�h8'@� ��A4@4��@�{�K�$r��.�:g0��2{��KB�յ6C@4@4@�n�H��N{��W�@'��(I��k�A4@4��6z�:�h�h�ƹ�!�4@4@4�@�X�h\�5��3�b��h�h��f{��6b4@4�14�F+��h�F@4z�Z�:��Ɠ�x�fh�h4�F��F+�S��h�Fh��qUl��}l4�tm��e�aa�(�sB��t��tVD@4@4�vm�fh�h�AC?�|�~4순?�N�[Bc��+�=hL�m��"4@cУ��h�F�h�vDH��И�0h<��>��c��/�hx$�@#EA��]64@#4%:�:�o�1FA�h�Ʊ��Z��q��aSh�Q�0��c��h��O)��/M�H8�@8h�h�>��y��粜V�#�//|��ʖ��I��+.�#��{W�l�l�04��W��q~�e>�G�.��;�8h��zr4F��1��(�6�_", "5�hkԽ�~r4j�h��A4D+";��D�+44/4@�g��4�YT��7=��P�(��=~/&� Xg��D|�r�H��6j(*B�jHcRi�48�Ih�_JRi(�&��4T��N�^�Q�T��/U*�p�R,e}W��|3�4��e��h��PiP>�!��*�{��g�t��@��6JGWi�4Vi�9/C��~�I+n;�?z�iSi�48͔�vf�a']�-��6�4��?z�p�QT�Hc��y9G��@z'Й4��#V�Ȏ+ssi�a��L��V��ѿ4��T*��Ւ��q��FR��X��Q㑻�4�}��R/]2�5��i�c�Jo�%��ojE�H�B<�n��j��8g��؛KÏ"��<`h\�wt�_5�j�m�Ұ��IY�ͥ1"�"�1�[Y��Zs{C�Ic��v�K��$qsi� ��rG\�2d�Z>u?~�x�(r�B��NǻK��!/�G��N~�?��T��:�/(g��~~��B?Ұ5��b�(r��yE��-��ߍ(��<3H��A3��Ұ��4\�?.��u�h��zDil�F :=?hN2�4v�D�/��7>��'n_�^~��i0�⩎�1�Dve�Kτ��'i�"d�#Isi�Z#.�zͅ��dp�ӧ�(�汝��cG��a��,�F(�ِD�a��Sz�� ؙ1�p,!�e��K��U�\A2;�(� ��9 ��%�y��3Bi��a�2�yb��CD�F!Ƥ��d�MAγ�A��k� �P�<Ûh,�f�5>�40�"��'DAq�t'Ϝjd��HC�a�*�D�:f^�e4~?0�469�ʺR 8��v��?i$��rsI�$��1gC�p�Bs��{�u?� �(r�0��6�>lA:��5M��IC�u��晤��ci`�X#�z߳&D�Ez��w��Ƌ\N"a��cr��D�5�ە��!d*�+�M�6F��sx��E�>�Q�5f��ȵ�qvkL��;��t�߮,�]�x�/jX��q��e�`ߌ`V;�H��@��)�#W�F{�Zk�K�_�;FG?k@խ}=K��D��@Y�(��ӕ4��Q�޻>/�1��ZOz}4��)��Jv<�O��4��:_h��WMit-D�Ck��4�J�6��ο{�S�V`di�+��ͥ�T�P�e42��c��2�4\�F]�aR#�>��Y갌$��zā��F�^�LjX׉4l�0�F��]�҂�Ѥ��", "V�Y�iLR�?�4��@ק�X��~�ן�GBe|�@� �G��کa��(|X-�+9+u"�$|��8�(x�O4��|��ϒO�&�i�J�_3�4ΐ�1:�c䐩�>�4��'�S*-g�N��Xiq��4|��Ɓo\�5~*\��qi� dk�ɣ;dԁ4,��H# 5�hS��S��%��v߲i�m�E��}ix��4(1'|��qC��-��j�S�N��DHu��4��e��WH�<��B=��i��*1mgA��N�a�8{k"C��4S�O0;hVC3�K�QO�v�a(G��D�U�m�H��U��7M��X��qˎ{�v#��]ixr��K$�N�p�{5n��H[�)��t�n��T��-�a�(Lx�4��f�A��tQg�T��#j�ϒ��W��8 ��L�ޥ�tMg{g`�F�j��@ܺ��5g�]C�f�{��5��΀�G��4fj��U��5��T��vIg��؎��*�X�yi, Z#Lx�s�t��>�4�Õ�2��sG��wv��4VLsg��W'��v��40E�Bn�×�7��4��p��o��O�8�P��(?��[Jn>�wItgu%d�3��Ҙy�4� 0�B��C�n��KX��Y��_��2{��Z�M(�E��gy��V��.~W�(�ܪ��}I�<ϳli�_Q*��?�b��F��$x�� w��"�J�ҙ40�q_맥QH�49�Q(��Y��A��,e�f��o�Mp;s�}��4"�gY��6��Pkh�Ը��$��3�XbbҴ�F�|S4�o��x�躤Fӌ�<�;D[��Y^',��0��pJΞ��eiG�4U�e�̠S�"i��-��Y��J!|�O��I2PY��,�)�/�o\�O�#>��w�0@��B��{Z��L>g��Z[�0��BKQ�&N��v8Yܕ��4`��.��Ｕ�]͈��[r��t�O�x�-y��u�c�1x�$�4`GVOsd]`�.^�q��i��M��jՀN`�\j��FC�p�-��V��T�W�j��8ĪJxՀ};9��'0p�أ1�?N�/[c��=�0`� �(Jd��_��uڿ%^ �o^��5�q�}�(��o��8�9F��|_18��vҐ��Ƒ�X��˳� (��IA�w!YP�y�<�b�h3�W�j�:�d��!Z�K!�W3�Dk��0v", "��E�T�j/u��G?�G�O�Y�Z��H��7A��ʿ�d��lY�^D�pp�ZeDm��gs��^��^Z[|$lE�Y��d-׭��T��,~�\օS�5Ż��u�IEND�B`�", "HTTP/1.1 302 FoundContent-Type: application/binaryX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sun, 21 Jan 2024 16:26:12 GMTLocation: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FStrict-Transport-Security: max-age=31536000X-Frame-Options: SAMEORIGINOrigin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sun, 21 Jan 2024 16:26:12 GMTStrict-Transport-Security: max-age=31536000X-Frame-Options: SAMEORIGINOrigin-Trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main"Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."Content-Encoding: gzipServer: ESFX-XSS-Protection: 0Set-Cookie: hideBrowserUpgradeBox=true; Domain=.youtube.com; Expires=Sun, 04-Feb-2024 16:26:12 GMT; Path=/; Secure; HttpOnlySet-Cookie: YSC=0lxZJFMP8Kg; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=noneSet-Cookie: VISITOR_INFO1_LIVE=bPMYAqN5wIQ; Domain=.youtube.com; Expires=Fri, 19-Jul-2024 16:26:12 GMT; Path=/; Secure; HttpOnly; SameSite=noneSet-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D; Domain=.youtube.com; Expires=Fri, 19-Jul-2024 16:26:12 GMT; Path=/; Secure; HttpOnly; SameSite=laxAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 59088X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Mon, 15 Jan 2024 11:11:55 GMTExpires: Tue, 14 Jan 2025 11:11:55 GMTCache-Control: public, max-age=31536000Age: 537258Last-Modified: Wed, 16 Oct 2019 17:15:00 GMTContent-Type: image/pngAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000�PNGIHDR� 3��IDATx�� M7Dx�ػH)�(�Wr��R%P@��"BH��$A)�T"��}�{RH@�۽�vwg��.��%Q{��"?%_�ƯlY��_ݚ8��8B��hsF��`�|��M�hg��6G��7y⃽��h�'j7�+R��ps��@oa��&�>�5Y�&jO{j�s K�<��f��>�K��wh��#W�^�;��8�W?��gr��>{��\�f��C�5�-��q��#�@7q��'D�}�1�go��Ӊ��2y��"j�zx8q��R��.}�[9�̟��~i�%q��I�>��,��ƥ�㍉@7p� �(_��JY5��z��h\�", "�{��8`�~�wPme[��X��V��T!�?w��}��=t\�ﹻ?.P3uw��>�q�)�{ɿk��e��/H��Q{p�+u�K�5d�P�ݜ�1�z[ƃ��9n�2�6��SAV\X�ͭX�Q&��@u��%]�V��j�1u�a�dB?�$oG��5��ZyM��HBNh��RxC��N�t"��ה�?}�JrFTʸ��\N��".땴(!��r��ooW�#U�C�y�F�98p��œ�e��˩�f��4H��0��l׿��HR�3��r�2 3�k��#zLr�w�}Q�$�\�V56:u��Wh̺b\��Lz��f2��g �6� � �~Cx�^ܯ�R>�Q��K��K8."I��^QT&=CH3��+�I��^��ዯI7�G35\-�1)��v8)�U��f��/�#� �Tߡ2kԋrp8)��#/ј�t�%�L�!�9Փ|p�O+�̰��q�Mm��HJ?e:`i��A$A΄�=c�~��˖��׭��nX+}o^'y�m��7I�]��[e��ۤ��z)~�^�ݻE��$y�n��n\��N�je��q�K��3J�)up:p+Z��2��(]��^W�$�>�(R�!��Ⱦ�L��g�9��eMq��MM!j�S{:=,�?�(e��l`��Y%G��6�W�וAz|�M�Iȕq٤ėro��2 uBV�7'՞��r��P�6_7"4��"s�z��j�t�L��z��=}�uᒦXeOM�?��`?��Nq�p�9��E��ށ��2��ᤜ��Z��w�/}�J��-��Q{p0V;N��E��;'�u��N�J��s�sw��fp��n@��@rmWV��", "m��Wt�f��z�l��R�J�}#q��7��w%ᄼ��<��GN` "�t��k��\�I5vB�٪1�MuN��s��S��0vaW�hO+�r�)yx{��N��[�<"!��i!e�1��|A#��tWtC��'.:\��;�迹(��&��c�?F+{��.GϿm�k��*�$d��"��vg�2h��2Lg��l�|�H�cvb��'��J��.��2-��~�O��5�'v��~��O?i��*)�9��'q�O�~�KvѺWͯz�㮳��zL]p�2f�{=Zu�T+�_�BJ�r=��E=IH�k��x^Nչ<�3jP��"��h�𕦷�ܻ�u�r��C9��L��s��{�9��;6I��D��H�"�6G��e��Ȥ��sxR簇�;��q�h;��@��^�[��n�}��p"��^y�楏��H�C�p��4\̱�߳�T��p\��w��k'��=/��?��I��J|�/d��6�i��4��wʬ�A{�Ɇ�:�+��Xb�{�2){tg:"27�3#/Ie��pRJ��^9qU��`U��[8@��r�p�w�dڃ2�w:s�#��.��ĺ��ԅ��W��O�"*e�-��^�+W�Ϯ�wDR��gN[=�[J�NH~i�S�W ��xugE�1��ȉ��^I*�\9�U2�)�&��S�I�Q��Ÿ��HBε��9��H��6B�DnA)��xg��Z��*(Z�!x 踟Iݞ(u�N\yXӵ��^��٠2^��c��~�ozq1{�/I��"�R��/��gv�V��[��oh��Ex긃�\(��9��|��ˁ�d�g��p\�k�<��:���S��ݫ�ʫ��lTf�C�@(�Dݝħ��9u��߾� ��Ҹ��Ur�2�e�rX�RF�{��F�Ϩ��960�E�o��Xy�2{�g��O�զ��|�j)��FNhmT��qLD��ٷj�:aԋr�=�5�Jz��9��؄IJ��Jf��/|w��Yr�m\J��O��k��_�X��`�]N�j�C�Z$��I�Avxz��ElTJ+̆ݿ4u��e>`�}��.x��"ި�%3�A)#��T��{A��+�b�E��*��6I" "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D" "GET /img/desktop/supported_browsers/firefox.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D" "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D" "GET /img/desktop/supported_browsers/opera.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=0lxZJFMP8Kg; VISITOR_INFO1_LIVE=bPMYAqN5wIQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYA%3D%3D" "HTTP/1.1 200 OKAccept-Ranges: bytesCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube-marketing"Report-To: {"group":"youtube-marketing","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube-marketing"}]}Content-Length: 9291X-Content-Type-Options: nosniffServer: sffeX-XSS-Protection: 0Date: Tue, 16 Jan 2024 04:17:40 GMTExpires: Wed, 15 Jan 2025 04:17:40 GMTCache-Control: public, max-age=31536000Last-Modified: Sun, 25 Jun 2023 02:58:00 GMTContent-Type: image/pngAge: 475713Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000�PNGIHDR��>a�$IDATx��\ŕ��uOT�DN6a/�^#�l��s�?��k��r�7ʛ�Q�s$rFde�4��Μ:��=u�c�H�;��z��G�w�{_j蠃:蠃:蠃:蠃:蠃:蠃:蠃:蠃w5:�[y'0��1�"n�Q� ��/=��`6]=�[�Z`YGO 趮��%]+�8��+d��Y��Az�8`��'�:��K��p��-�N�N��+��^@W+��-T�XTJ�D�0��Ǹ�C߹PDV��e�<[��f�ߋ��ٌ�̲��G�"ȡ̄��@�G'��Y�_��p��'$�Փ!�D;@A�چK�N�)�T''�H�W�`OO��2+��qͱ��{Ŋ�R��6QP(��>ۻ�Z��/��-��}��ґ�%��=D@-��BR��70g�6_��o�L:�� 8��_��R�u��j��pP@z��N\��`��o�$��V ��Wr�� "��^z�7(�̧5�&*P�r�rj�]��S��De"�8��˟�]�bu�͜+��O?i��5 KKr�lCĈ _c7b�[ĉsn,��x�^��_", "�=�ǋ�&^g�V.� �?��_N�S�ڗJ{=��w��֊?�u��Z`)%r��G�đ��ys��5�9�9�\0��|~��@�t��7�ď��%с� N�6�Vu�2�['�2��>S��rW��T�?�@��]�knf�##]*ոX��|cŋi�B��"��#^�N�5��rc\��P��*�{�ﻟ��B*P�R�u��'J�"�|AP<��l�LT=p1�C t;9��z��tmG�UF��è�4��}#>�_B��*�k+�Õ��}��g��t�a*�p�H�}�ʗ��J`=�UP�u��wpQ�ϑ�B��W��|m�j~6��r�C4�P�g��}�[��t��{�ݲJ��;��D�/�_�3yEU!R��>�Y(��}��J4��<��/��"��3�H��@�>:��>w3��>��F��` �j�Q!��N{�V��t��* ^*��/�z��]��ߦ�:J"��8��<�>��.mbDe֢�B�4��g߉��?�A��i��&��u��>YE��T��Ό�Q��9�mE��+-<"�BE9�rT6 E�z��d�p��T�v�[��P��y�$�ɚ�%=��XȬ}#ނ�."��UR��Ω�U��B�5�S��#E)ɤ)��e��{ �×?��R��81��=^��Ȅ`~.�P�Â��}'��σx��\w\�?��Q��p9�2L�KI�)��`��7�/�?\Ȧ�cm�$��#��)e�K�(��+8��x{\Y�;q`��^�?�.*�D�5��:��^�K�`��!�K.s 0B_��\PE�o�[iV��gn F$��N�(%�[�ׁʾ��_aA_��F ��(s�8�VI� ��s�ẃ�r~hI|y�l��$��ݸ�-�̆��d�k��.C�^F�z��1"�ܱ�#��=��?�qL7�Tf�F�W�6��kNFy{0B1�(?o��-K>%5-�8�vI�t�p��cXq�&��IT�G|��KNg��r��2�t��=g��~��WOdY��L-��c,8��En�tQ9С�E�Y �.��%�N�؈|v�%|�w�D�= Ǵ��е�[��@�\��/Й%�M��t�61E�7B�O�5��٩�AQ�� .�a�I��Ŭ�=M�"66:T12ad8,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com" Pattern match: "https://accounts.google.com/" Pattern match: "https://www.youtube.com" Pattern match: "pattern.rs/rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc\library\core\src\char\methods.rsX&encode_utf8" Pattern match: "interception.cc/builds/worker/checkouts/gecko/security/sandbox/chromium/base/memory/unsafe_shared_memory_region.cc/builds/worker/checkouts/gecko/security/sandbox/chromium/base/memory/platform_shared_memory_region_win.cc/builds/worker/checkouts/gecko/securi" Pattern match: "pattern.rsIu/rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc\library\core\src\char\methods.rsencode_utf8" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "upload.ffmpeg.org/incoming/" Pattern match: "http://ocsp.digicert.com0C7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0z0x0:4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0OH0F080*0(https://www.digicert.com/CPS0,|%)vhlD2DigiCert" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XL0J0H" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aU0S0QEhttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0M" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZN0L0J" Pattern match: ".dllwidevinecdm.dll/-1" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://www.mozilla.org/privacy/firefox/gro.allizom.www.ej2qmyefJ9pH+https://www.mozilla.org/en-US/firefox/central/gro.allizom.www.zREGZOiJVhiW+y1-7https://www.mozilla.org/en-US/firefox/57.0.1/firstrun/Welcome" Pattern match: "https://www.mozilla.org/en-US/firefox/57.0.1/firstrun/+https://www.mozilla.org/en-US/privacy/firefox/+https://www.mozilla.org/en-US/about/+https://www.mozilla.org/en-US/contribute/+https://www.mozilla.org/en-US/firefox/customize/+https://support.mozilla.or" Pattern match: "facebook.comdatr70WtZTQsQ9PNwHf76zTNDP7k.facebook.com/gmozilla.orgmoz-stub-attribution-codec291cmNlPShub3Qgc2V0KSZtZWRpdW09KGRpcmVjdCkmY2FtcGFpZ249KG5vdCBzZXQpJmNvbnRlbnQ9KG5vdCBzZXQpJmV4cGVyaW1lbnQ9KG5vdCBzZXQpJnZhcmlhdGlvbj0obm90IHNldCkmdWE9ZmlyZWZveCZjb" Pattern match: ".comdatr70WtZTQsQ9PNwHf76zTNDP7k.facebook.com/gmozilla.orgmoz-stub-attribution-codec291cmNlPShub3Qgc2V0KSZtZWRpdW09KGRpcmVjdCkmY2FtcGFpZ249KG5vdCBzZXQpJmNvbnRlbnQ9KG5vdCBzZXQpJmV4cGVyaW1lbnQ9KG5vdCBzZXQpJnZhcmlhdGlvbj0obm90IHNldCkmdWE9ZmlyZWZveCZjbGllbnRfa" Pattern match: "www.:https:443moc.koobecaf.www.:https:443Session9tc7vm:1705852075647nCCI5moc.koobecaf.www.:https:443moc.koobecaf.www.:https:443mutex_falco_queue_critical^$^$cdofuc:1705852046661qCCO5moc.koobecaf.www.:https:443moc.koobecaf.www.:https:443mutex_falco_queue_im" Pattern match: "d.F.dM/dK8/d3dq_6d9dv" Pattern match: "http://ocsp.digicert.com0KD0B0@:http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=604020*0" Pattern match: "http://ocsp.digicert.com0@4http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0{t0r071http://crl3.digicert.com/DigiCertGlobalRootCA.crl071http://crl4.digicert.com/DigiCertGlobalRootCA.crl00" Pattern match: "https://www.R.com//-b-d&q={L0sugCletepurlgetp'1nel" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/b9smUWnHJW6.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://www.facebook.comstorageAccessAPI" Pattern match: "http://ocsp.pki.goog/gsr10" Pattern match: "http://www.videolan.org/x264.html" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "http://mozilla.org/MPL/2.0/" Pattern match: "https://www.facebook.com/legal/license/aJoeSHn7XcN/__d" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kznecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpb" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3i7M54/yU/l/en_US/NJVgMHwCLBZ.js?_nc_x=Ij3Wp8lg5Kznecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQi" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/_BJqgRg0BU5.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y4/l/0,cross/hmGh5fRyQEQ.css?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3ihVQ4/y_/l/en_US/tmzo6-VkC78.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAA" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/qvzskUrYlYC.js?_nc_x=Ij3Wp8lg5Kznecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpb" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/I33XAWfgyPZ.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yp/r/sKtrEJAtiUM.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "http://mozilla.org/MPL/2.0/.##" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/51zpDh2VzWP.js?_nc_x=Ij3Wp8lg5Kznecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpb" Pattern match: "https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.1440.19-win-ia32.zipstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA51MIIOcTC" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/yb/r/hLRJ1GG_y0J.icostrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMIIGmDCCBYCgAwIBAgIQDCa" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/PsuSdcIEwcm.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/8sRbNudSPwb.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yI/r/r-bo8CIhM_M.pngstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMIIGmDCCBYCgAwIBAgIQ" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chainstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/onecrl.content-signature.mozilla.org-2024-02-29-06-55-20.chainstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yc/l/0,cross/gJ5YoRJgtJI.css?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://support.mozilla.org/kb/update-firefox-latest-release,where:tabshifted},type:OPEN_URL}},secondary:[{label:{string_id:cfr-doorhanger-extension-cancel-button},action:{type:CANCEL}}]},category:cfrFeatures,anchor_id:PanelUI" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/L1jOy35D0YV.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/OHZFA3AMf_e.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yK/r/Lzd-U--zeLf.js?_nc_x=Ij3Wp8lg5Kznecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpb" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y7/l/0,cross/DECVGOZYAvF.css?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAA" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/y1/r/4lCu2zih0ca.svgstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMIIGmDCCBYCgAwIBAgIQDCa" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yC/r/M08arqdo_nN.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kznecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpb" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/3FPJ9YC_wUr.js?_nc_x=Ij3Wp8lg5Kznecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpb" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/onecrl.content-signature.mozilla.org-2024-02-29-06-55-20.chain,mode:p384ecdsa,type:contentsignaturepki,signature:4RX7ukiv2xJWMSjMzgpwZdAWMJVDoZFjtx0ABjwKeqvZ610WZ_1RNfikQy_QZODsvRDE7NlHRw1JMFtd" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ym/r/RxPOZF3XHzp.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/QaeJrnKvrhz.js?_nc_x=Ij3Wp8lg5Kzstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMII" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/O287_AcFyg4.pngnecko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMIIG" Pattern match: "https://r4---sn-o097znsd.gvt1.com/edgedl/widevine-cdm/4.10.1440.19-win-ia32.zip?cms_redirect=yes&mh=F4&mip=67.218.111.202&mm=28&mn=sn-o097znsd&ms=nvh&mt=1705853935&mv=u&mvi=4&pl=19&rmhost=r3---sn-o097znsd.gvt1.com&shardbypass=sd&smhost=r1---sn-o097znss.gvt" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/url-classifier-skip-urls/records?_expected=1701090424142&_sort=-last_modified&_since=1571936118309strongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDS" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:nJKrGgLE7ea97tFh261QFeD3P11ldmSkGGVW0tuNety2S6AADVTM6VwOowZOMoiEQl5GabE" Pattern match: "rsrc.php/v3/yL/r/unHwF9CkMyM.png" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/O7nelmd9XSI.pngstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAacMIIGmDCCBYCgAwIBAgIQ" Pattern match: "opensearch.startpageweb.com/bing-search.xml,[https]opensearch.startwebsearch.com/bing-search.xml,[https]opensearch.webstartsearch.com/bing-search.xml,[https]opensearch.webofsearch.com/bing-search.xml,[profile]/searchplugins/Yahoo" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:LbuDsOJMUG5Zm12NjZyNfCis5RYGnxU-zUQoeugwaC7rdW7p0O0ACf5yuDhIT3yEg0p6-_5" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:EqEWqiu8-19WBs5ESgxPpQsFgJGBj2xJ_89rhpYDYRy-C1qbIYkz97jPmgNx8ECvwMBXNc8" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:7NvN1S-NwRXtQ1nVKKL8RcKic-Qy7uLLlbu8doTwFAIyCyJEolBQMylX94t8WoBM5W5Sc91" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:YXi0LKZ5WA7_8OHT8rkD-45S4XhooLE7sL40N5clKsMOOaDIIRR8MR6xmSfpvMKAdPU6yCG" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:xebjMbhpwZdvr5dIwhh_aMPt9uDeDWfJq_cvanHO8DFCRAIgeH8VeUS94tFyIYJ-GYBy8eo" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:tghopUxxMRyJnMMkxgwK7stEL9x4QLtDgX5xbWakwMGfm0J1Y7W91mRmXR3qNe5dtwn7kPd" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:OLMjbVWV-cBUq7cgpY-W7N5i7SLNke8ww4YQoaoBbYm1cx-CF4_Pg7pQAo8tEvAVWg4STgO" Pattern match: "https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-02-29-06-55-22.chain,mode:p384ecdsa,type:contentsignaturepki,signature:dXn6XWRMKCauejOfANptP7KDPOub4ckQh3quj5ixd3BFxHZngKWWme_VKuPAOF1-eQuTvky" Pattern match: "https://remote-settings.readthedocs.io,url:https://firefox.settings.services.mozilla.com/v1/,settings:{readonly:true,explicit_permissions:false,batch_max_requests:25},capabilities:{changes:{description:Track" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-USstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8F" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/records?collection=fxmonitor-breaches&bucket=mainstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMw" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/records?collection=whats-new-panel&bucket=mainstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmC" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/language-dictionaries/records?_expected=1673270322227&_sort=-last_modified&_since=1569410800356strongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSn" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/records?collection=cfr&bucket=mainstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgi" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/public-suffix-list/records?_expected=1575468539758&_sort=-last_modifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAA" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/whats-new-panel/records?_expected=1617030573137&_sort=-last_modifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAA" Pattern match: "https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/records?collection=cfr-fxa&bucket=mainstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+" Pattern match: "https://snippets.cdn.mozilla.net/6/Firefox/72.0.2/20200117190643/WINNT_x86-msvc/en-US/release/Windows_NT%206.1/default/default/strongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImk" Pattern match: "https://snippets.cdn.mozilla.net/us-west/bundles-pregen/Firefox/en-us/default.jsonstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAA" Pattern match: "https://search.services.mozilla.com/1/firefox/72.0.2/release/en-US/ZZ/default/default/nov17-2strongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpb" Pattern match: "https://www.facebook.com/login,title:Log" Pattern match: "https://fonts.googleapis.com/css?family=YouTube+Sans:500" Pattern match: "https://www.google.com/search?client=firefox-b-d&q=}},profile:{creationDate:17504,resetDate:19592},addons:{activeAddons:{formautofill@mozilla.org:{version:1.0,scope:1,type:extension,updateDay:19743,isSystem:true,isWebExtension:" Pattern match: "http://mozilla.org/MPL/2.0/.#" Pattern match: "https://www.[R.com/_@&q=P175042set+P195921{aXfill@P19743DWebEcForm" Pattern match: "https://www.UR.com/$?client=firefoxB&q={`Terms}RiconURL:moz-exten://ed7443f7-70b6-4439-85ec-f31d68f2cdf8/favBD.icoN`MapObj\/{}W1G},_0urlr{param0alu5" Pattern match: "testbed.herokuapp.com/*],windowT},[blockingR?]],*.santander.co.uk/*,6bobCbank?rolYpsupportis.embarc*.att.tvsteamcommunityOchatWPhttpsatch.sling`Receiv*.linkedintscp-serving/dtagads-us.rd4bsynergnhas.php,www.officeXlogout?sidcsponse$]8doh-rollou:;1.3@0" Pattern match: "https://www.mozilla.org/en-US/firefox/57.0.1strun/,title:Welcome" Pattern match: "http://r3.o.lencr.org/strongly-framedrequest-methodPOSTresponse-headHTTP/1.1" Pattern match: "http://www.mozilla.org/2005/app-update" Pattern match: "http://ocsp.digicert.com/strongly-framedrequest-methodPOSTresponse-headHTTP/1.1" Pattern match: "http://ocsp.pki.goog/gts1c3strongly-framedrequest-methodPOSTresponse-headHTTP/1.1" Pattern match: "https://hg.mozilla.org/releases/mozilla-releaseSourceStamp=326212e7271a9c9f0776153095cf48d7153260aaID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}[Gecko]MinVersion=115.0.3MaxVersion=115.0.3[XRE]EnableProfileMigrator=1[Crash" Pattern match: "https://hg.mozilla.org/releases/mozilla-releaseSourceStamp=25e0edbb0a613c3bf794c93ba3aa0985d29d5ef4ID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}[Gecko]MinVersion=72.0.2MaxVersion=72.0.2[XRE]EnableProfileMigrator=1[Crash" Pattern match: "https://www.mibbit.com/?url=%s}]},mailto:{action:4,handlers:[null,{name:Yahoo" Pattern match: "NOFORMmicrosoft.com/102433237894403108561027971357230938743SRCHUIDV=2&GUID=426377958C8445E3B4EA69482BD0E747&dmnchg=1microsoft.com/102433237894403108561027971357230938743SRCHUSRDOB=20220131microsoft.com/102433237894403108561027971357230938743SRCHHPGUSRSRCHL" Pattern match: "0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0sfacebook.com/921719569263363110175970503212931083646o0WtZdg0Tk9t8F8VW87hP-OZfacebook.com/921735013804803116412070518812931083646_js_datro0WtZbeXbiVLsS06MzNObeeLfacebook.com/1089249111884831164112133844" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217372191488031086470131223614531083646VISITOR_INFO1_LIVEbPMYAqN5wIQyoutube.com/9217158403225631119864131520015031083646VISITOR_PRIVACY_METADATACgJVUxI" Pattern match: "https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxM.woff" Pattern match: "https://fonts.google.com/license/googlerestricted@font-face" Pattern match: "0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0sfacebook.com/921719569263363110175970503212931083646o0WtZdg0Tk9t8F8VW87hP-OZfacebook.com/921735013804803116412070518812931083646datro0WtZbeXbiVLsS06MzNObeeLfacebook.com/92174564131843116412191992383431" Pattern match: "0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUYg.AWU4JOGNAswfacebook.com/921732069263363110175992023583531083650o0WtZdg0Tk9t8F8VW87hP-OZfacebook.com/921735013804803116412070518812931083646datro0WtZbeXbiVLsS06MzNObeeLfacebook.com/92174564131843116412191992383431" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217372191488031086470131223614531083646VISITOR_INFO1_LIVEbPMYAqN5wIQyoutube.com/9217158403225631119864131520015031083646" Pattern match: "https://www.facebook.com/predictor::seenpredictor::resource-countpredictor::https://static.xx.fbcdn.net/1,2,1705853017,4096predictor::https://facebook.com/1,2,1705853017,4096" Pattern match: "YcCOI0ZRAVygxCxjaccounts.google.com/92172187435520312305051391043513310836467392447_52_52_123900_48_436380accounts.google.com/1089126192742431089681139424356231083646" Pattern match: "0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0sfacebook.com/921719569263363110175970503212931083646o0WtZdg0Tk9t8F8VW87hP-OZfacebook.com/921735013804803116412070518812931083646" Pattern match: "https://hg.mozilla.org/releases/mozilla-releaseSourceStamp=326212e7271a9c9f0776153095cf48d7153260aa" Pattern match: "https://hg.mozilla.org/releases/mozilla-releaseSourceStamp=25e0edbb0a613c3bf794c93ba3aa0985d29d5ef4" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217372191488031086470131223614531083646" Pattern match: "921612306127363116210943505301331083648MUID20DD268E996464891A79328398286561msn.com/102512306127363116210943489701331083648" Pattern match: "eQcZdT8BR3TyO-Jdaccounts.google.com/9217214743552031230505135217226831083646" Pattern match: "a1eFC4uVWLjRc3mzaccounts.google.com/9217215743552031230505135451227231083646" Pattern match: "YcCOI0ZRAVygxCxjaccounts.google.com/9217218743552031230505139104351331083646" Pattern match: "0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0sfacebook.com/921719569263363110175970503212931083646" Pattern match: "MUIDB21B85B45995E6A7111FB4F4898126B5Cieonline.microsoft.com/921612106127363116210941851698431083648" Pattern match: "TESTCOOKIESENABLEDaccounts.google.com/v3/signin/1088198955878431083646139334354831083646" Pattern match: "MUIDB20DD268E996464891A79328398286561www.msn.com/921612306127363116210943505301331083648" Pattern match: "MUID20DD268E996464891A79328398286561msn.com/102512306127363116210943489701331083648" Pattern match: "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Mi" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "detectportal.firefox.com" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "attachments.prod.remote-settings.prod.webservices.mozgcp.net" Heuristic match: "autopush.prod.mozaws.net" Heuristic match: "connect.facebook.net" Heuristic match: "d228z91au11ukj.cloudfront.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "fp2e7a.wpc.phicdn.net" Heuristic match: "locprod2-elb-us-west-2.prod.mozaws.net" Heuristic match: "prod.balrog.prod.cloudops.mozgcp.net" Heuristic match: "prod.content-signature-chains.prod.webservices.mozgcp.net" Heuristic match: "prod.detectportal.prod.cloudops.mozgcp.net" Heuristic match: "prod.remote-settings.prod.webservices.mozgcp.net" Heuristic match: "safebrowsing.googleapis.com" Heuristic match: "scontent.xx.fbcdn.net" Heuristic match: "shavar.prod.mozaws.net" Heuristic match: "star-mini.c10r.facebook.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "tracking-protection.prod.mozaws.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Heuristic match: "youtube-ui.l.google.com" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language" Pattern match: "www.youtube.comDNT" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}Content-Length" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FStrict-Transport-Security" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube_main}]}Cross-Origin-Opener-Policy-Report-Only" Pattern match: "www.facebook.comDNT" Pattern match: "fb.me/p3pSet-Cookie" Pattern match: "https://*.fbsbx.com" Pattern match: "https://www.facebook.com/loginAccept-Language" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0B0vPdk3IpqcSox8E_q8Nz2wLssDTWXWBOu0gT2h_tt20EZI2MTbm8UXF8AkQV5M9CHwko" Pattern match: "https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0B0vPdk3IpqcSox8E_q8Nz2wLssDTWXWBOu0gT2h_tt20EZI2MTbm8UXF8AkQV5M9CHwkoStrict-Transport-Security" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp0nXQPra7FuF8uOCpfPavLUMX6fVejX_R-eVSU5LVvhVNmvZBQuBMRX4gdYr8Sy-ZgPCAce&passive=1209600&flowName=GlifWebS" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://www.google.com/favicon.icoStrict-Transport-Security" Pattern match: "https://accounts.google.com/Accept-Language" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInUi}]}Accept-CH" Pattern match: "https://csp.withgoogle.com/csp/report-to/AccountsSignInSignUpUi}]}Accept-CH" Pattern match: "rsrc.php/v3/yc/l/0,cross/lHaJ-fsT0au.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ys/r/0gi59GnvylN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yo/l/0,cross/h5VjgH_K65B.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/l/0,cross/BpswDIn4KwJ.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/y1/r/4lCu2zih0ca.svg" Pattern match: "rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3i7M54/yU/l/en_US/NJVgMHwCLBZ.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yK/r/Lzd-U--zeLf.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yU/r/O7nelmd9XSI.png" Pattern match: "rsrc.php/v3/yI/r/r-bo8CIhM_M.png" Pattern match: "rsrc.php/v3/yq/r/6bjw9N12j0I.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/ym/r/RxPOZF3XHzp.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yE/r/xGzxHIbkRpC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/yb/r/hLRJ1GG_y0J.ico" Pattern match: "rsrc.php/v3/yt/r/OHZFA3AMf_e.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yx/r/PsuSdcIEwcm.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yx/r/QaeJrnKvrhz.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/yh/r/8sRbNudSPwb.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "rsrc.php/v3/y2/r/O287_AcFyg4.png" Pattern match: "https://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=100Accept-Language" Pattern match: "https://fbsbx.com/security/hsts-pixel.gif?c=5reporting-endpoints" Pattern match: "https://fbcdn.net/security/hsts-pixel.gif?c=2.5reporting-endpoints" Pattern match: "https://connect.facebook.net/security/hsts-pixel.gifreporting-endpoints" Pattern match: "https://csp.withgoogle.com/csp/apps-themesCross-Origin-Resource-Policy" Pattern match: "https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signersCross-Origin-Resource-Policy" Pattern match: "https://accounts.google.comContent-Security-Policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}Content-Length" Pattern match: "s.bak/updated" Pattern match: "AddonManager.jsm/d1é" Pattern match: "AddonManager.jsm/d1" Pattern match: "NetUtil.jsmw//resource://gre/modules/ExtensionPermissions.jsmDjsloader/non-syntactic/resource/gre/modules/ExtensionPermissions.jsmB" Pattern match: "UIState.jsm/^0" Pattern match: "mozilla.org/preferences-service;1getServiceCinsIPrefServiceQueryInterfacensIPrefBranch4" Pattern match: "mozilla.org/xre/app-info;1getServiceCinsIXULRuntimeQueryInterfacensIXULAppInfoComponentsException" Pattern match: "mozilla.org/file/directory_service;1getServiceCi'nsIDirectoryServiceQueryInterfacensIProperties4" Pattern match: "mozilla.org/system-info;1getServiceCinsIPropertyBag2QueryInterfacensISystemInfo4" Pattern match: "mozilla.org/network/io-service;1getServiceCinsIIOServiceQueryInterface+nsISpeculativeConnect4" Pattern match: "mozilla.org/appshell/appShellService;1%nsIAppShellServiceappShellY@mozilla.org/netwerk/cache-storage-service;1-nsICacheStorageService" Pattern match: "mozilla.org/categorymanager;1%nsICategoryManager" Pattern match: "mozilla.org/clear-data-service;1'nsIClearDataServiceclearDataS@mozilla.org/childprocessmessagemanager;1!nsIMessageSendercpmm;@mozilla.org/consoleservice;1#nsIConsoleServiceconsole9@mozilla.org/cookiemanager;1!nsICookieManagercookiesW@mozilla.org/content/dr" Pattern match: "mozilla.org/login-manager;1nsILoginManager" Pattern match: "mozilla.org/globalmessagemanager;1nsISupportsmm?@mozilla.org/observer-service;1%nsIObserverServiceobsA@mozilla.org/permissionmanager;1" Pattern match: "mozilla.org/moz/jssubscript-loader;1+mozIJSSubScriptLoaderscriptloaderI@mozilla.org/scriptsecuritymanager;11nsIScriptSecurityManager+scriptSecurityManager=@mozilla.org/storage/service;1%mozIStorageServicestorageO@mozilla.org/dom/localStorage-manager;1" Pattern match: "mozilla.org/intl/stringbundle;1-nsIStringBundleServicestrings;@mozilla.org/base/telemetry;1nsITelemetrytelemetryA@mozilla.org/intl/texttosuburi;1nsITextToSubURItextToSubURI;@mozilla.org/thread-manager;1!nsIThreadManagertmU@mozilla.org/toolkit/URLFormatterS" Pattern match: "hg.mozilla.org/releases/mozilla-release/rev/25e0edbb0a613c3bf794c93ba3aa0985d29d5ef4'SOURCE_REVISION_URL%HAVE_USR_LIB64_DIR%HAVE_SHELL_SERVICE#MOZ_CODE_COVERAGE;TELEMETRY_PING_FORMAT_VERSION!MOZ_NEW_XULSTORE5MOZ_NEW_NOTIFICATION_STORE" Pattern match: "mozilla.org/widget/idleservice;1nsIIdleService!defineLazyGetter/_distributionCustomizerAlertsService;@mozilla.org/alerts-service;1!nsIAlertsService_initzEWQ" Pattern match: "mozilla.org/weave/service;1getServicewrappedJSObject;5" Pattern match: "mozilla.org/updates/update-service;1getServiceCi7nsIApplicationUpdateService3checkForBackgroundUpdates1" Pattern match: "mozilla.org/supports-PRBool;1createInstanceCi#nsISupportsPRBoolobsnotifyObservers5quit-application-requestedrestartdatastartup#restartInSafeModensIAppStartupeAttemptQuit6,Q;QV" Pattern match: "support.mozilla.org/kb/reset-firefox-easily-fix-most-problemstab" Pattern match: "mozilla.org/toolkit/profile-service;1getServiceCi1nsIToolkitProfileService/createdAlternateProfile" Pattern match: "mozilla.org/windows-taskbar;1CcgetServiceCinsIWinTaskbaravailableChromeUtils" Pattern match: "mozilla.org/uriloader/handler-service;1getServiceCi#nsIHandlerServiceasyncInit:Q;5" Pattern match: "mozilla.org/security/pk11tokendb;1getServiceCinsIPK11TokenDB'getInternalKeyTokenhasPasswordServicestelemetry!getHistogramById/MASTER_PASSWORD_ENABLEDaddDQ;5" Heuristic match: "0JMO.MO" Pattern match: "mozilla.org/supports-string;1createInstanceCi#nsISupportsStringdataPromiseO0;5" Pattern match: "support.mozilla.org/kb/flash-protected-mode-autodisabledtab" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulChromeUtils" Pattern match: "CustomizableUI.jsm/defineLazyServiceGetterPushService7@mozilla.org/push/Service;1nsIPushService1pdfjs.enabledCache.stateQresource:///actors/BlockedSiteParent.jsmmoduleURI" Pattern match: "SwitchDocumentDirectionChild.jsm/SwitchDocumentDirectionIresource:///modules/UITourParent.jsmGresource:///modules/UITourChild.jsmmozUITour" Pattern match: "AboutProtectionsHandler.jsm/AboutProtectionsHandlerOresource://gre/modules/AddonManager.jsmAddonManager_resource://gre/modules/AppMenuNotifications.jsm" Pattern match: "mozilla.org/timer;1createInstancensITimer_writeTimerloadobservelogreadFilewriteFilemarkAsChangedpersistsetValuehasValuegetValueremoveValueremoveDocument!getIDsEnumerator-getAttributeEnumeratorprototype%nsStringEnumerator'nsIStringEnumerator_nextIndex" Pattern match: "AutoplayChild.jsm/GloballyAutoplayBlockedAutoplay]resource://gre/actors/BrowserElementParent.jsm[resource://gre/actors/BrowserElementChild.jsmDOMWindowCloseBrowserElementSresource://gre/modules/ConduitsParent.jsmQresource://gre/modules/ConduitsChild.jsmCon" Pattern match: "KeyPressEventModelCheckerChild.jsm/CheckKeyPressEventModel3KeyPressEventModelChecker[resource://gre/modules/LoginManagerParent.jsmYresource://gre/modules/LoginManagerChild.jsm%DOMFormHasPassword+DOMInputPasswordAddedLoginManagerWresource://gre/modules/Pict" Pattern match: "SelectionSourceChild.jsm/ViewSource:GetSelectionSelectionSourcecresource://gre/actors/UnselectedTabHoverChild.jsm3UnselectedTabHover:Enable5UnselectedTabHover:Disable5Browser:UnselectedTabHover%UnselectedTabHoverprototypeconstructoraddActorppmmchildGroupsp" Pattern match: "mozilla.org/file/local;1createInstanceinitWithPathlF8Q@QQ5" Pattern match: "mozilla.org/windows-registry-key;1createInstanceCi!nsIWindowsRegKeylogdebug1root" Pattern match: "mozilla.org/mac-preferences-reader;1createInstanceCi/nsIMacPreferencesReaderpoliciesEnabled'macOSPoliciesParserreadPolicies{DWQQV@0Q;5" Pattern match: "AppConstants.jsm/defineLazyModuleGettersiresource://gre/modules/policies/WindowsGPOParser.jsm!WindowsGPOParseroresource://gre/modules/policies/macOSPoliciesParser.jsm'macOSPoliciesParserSresource:///modules/policies/Policies.jsmPoliciesresource://gre/modul" Pattern match: "mozilla.org/consoleAPI-storage;1getServiceCi" Heuristic match: "hF)6_y>5!!!!%notifyAddonChanged@.EE" Pattern match: "mozilla.org/addons/web-install-prompt;1CcgetServiceCi'amIWebInstallPromptconfirm-installNotifyObservers5addon-install-confirmationA+Q55EQ;Q" Heuristic match: "T:PHh`H-`SHa5!!!!%getUpgradeListener@}.tt" Pattern match: "mozilla.org/xre/app-info;1CcgetServiceCinsIXULRuntimeprocessType" Pattern match: "AsyncShutdown.jsm/defineLazyGlobalGettersElement/defineLazyModuleGetterscresource://gre/modules/addons/AddonRepository.jsmAddonRepositoryQresource://gre/modules/AbuseReporter.jsmAbuseReporterIresource://gre/modules/Extension.jsmExtension5defineLazyPreferen" Pattern match: "mozilla.org/timer;1createInstanceCinsITimerMathceilPromiseUtilsdefer!initWithCallback?TYPE_REPEATING_PRECISE_CAN_SKIPpromisethenSQXQ;5" Heuristic match: "QyH.PH" Pattern match: "mozilla.org/xre/app-info;1getServiceCi!nsICrashReporterx7WQV.QQ;5" Pattern match: "mozilla.org/timer;1createInstanceCinsITimer!initWithCallbackTYPE_ONE_SHOTDELAY_CRASH_MScrashAfterMSGWrong" Pattern match: "mozilla.org/xpcom/debug;1nsIDebug2" Pattern match: "mozilla.org/xre/app-info;1getServiceCinsIXULRuntimeprocessType" Pattern match: "mozilla.org/file/local;1createInstancensIFileinitWithPath+setRelativeDescriptor" Pattern match: "mozilla.org/windows-registry-key;1createInstanceCi!nsIWindowsRegKeyopen_rootKeyACCESS_READvalueCountgetValueNamensIFilereadStringValue" Pattern match: "AddonManager.jsm/defineLazyModuleGettersOresource://gre/modules/AppConstants.jsmAppConstantsQresource://gre/modules/AsyncShutdown.jsmAsyncShutdownIresource://gre/modules/Extension.jsmDictionaryExtensionLangpackIresource://gre/modules/FileUtils.jsmFileUtils" Pattern match: "mozilla.org/gecko-media-plugin-service;1getServiceCiCmozIGeckoMediaPluginChromeService" Pattern match: "mozilla.org/file/local;1createInstanceCinsIFileOSPathjoininitWithPath" Pattern match: "https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes/_deprecatedCreationDateT3WQQ" Pattern match: "mozilla.org/net/osfileconstantsservice;1getServiceCi3nsIOSFileConstantsServiceinitselfOSConstants" Pattern match: "mozilla.org/jsctypes;1createInstanceM" Pattern match: "mozilla.org/timer;1createInstanceCinsITimer" Pattern match: "XPCOMUtils.jsm/defineLazyServiceGetterInternals]@mozilla.org/toolkit/osfile/native-internals;1?nsINativeOSFileInternalsServicem,Z=`=`Q" Pattern match: "ctypes.jsm/defineLazyGlobalGettersfetch%defineModuleGetterWindowsRegistryUresource://gre/modules/WindowsRegistry.jsm%update-config.jsonupdate.localedistribution.id" Pattern match: "mozilla.org/network/file-output-stream;1createInstanceCi'nsIFileOutputStream+_initFileOutputStreamC" Pattern match: "mozilla.org/network/atomic-file-output-stream;1createInstanceCi'nsIFileOutputStream+_initFileOutputStreamC" Pattern match: "mozilla.org/network/safe-file-output-stream;1createInstanceCi'nsIFileOutputStream+_initFileOutputStreamC" Pattern match: "XPCOMUtils.jsm/defineLazyServiceGettergDirServiceK@mozilla.org/file/directory_service;1nsIPropertiesMODE_RDONLYMODE_WRONLYMODE_RDWRMODE_CREATEMODE_APPENDMODE_TRUNCATEPERMS_FILEPERMS_DIRECTORYgetFile" Pattern match: "mozilla.org/file/local;1CinsIFileinitWithPathFile-%Z=`Q" Pattern match: "mozilla.org/plugin/host;1getServiceCinsIPluginHostgetPluginTagsnextdonevaluenamedescriptionidtagspush" Pattern match: "mozilla.org/network/stream-listener-tee;1createInstanceCi" Pattern match: "mozilla.org/prompter;1getService!nsIPromptFactorygetPrompt/nsILoginManagerPrompter'nsIChannelEventSinkbadCertHandlergetInterfaceg" Pattern match: "AddonManager.jsm/defineLazyGlobalGettersTextDecoderTextEncoderfetch/defineLazyModuleGetterscresource://gre/modules/addons/AddonRepository.jsmAddonRepository_resource://gre/modules/addons/AddonSettings.jsmAddonSettingsOresource://gre/modules/AppConstants.js" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersOresource://gre/modules/AddonManager.jsmAddonManager'AddonManagerPrivatecresource://gre/modules/addons/AddonRepository.jsmAddonRepository_resource://gre/modules/addons/AddonSettings.jsmAddonSettingsOresource://gre/modu" Pattern match: "mozilla.org/file/local;1initWithPathrepositorygetLoggerProfDextensions.json3extensions.databaseSchema9extensions.autoDisableScopes9extensions.pendingOperationsxpinstall.;xpinstall.signatures.dev-root'toolkit@mozilla.org#app-system-addons'app-system-default" Pattern match: "mozilla.org/hash-property-bag;1createInstanceCi-nsIWritablePropertyBag" Pattern match: "mozilla.org/timer;1nsITimer!initWithCallback_taskFn_delayMsisArmed" Pattern match: "Services.jsm/defineLazyModuleGettersOresource://gre/modules/AddonManager.jsmAddonManager'AddonManagerPrivate_resource://gre/modules/addons/AddonSettings.jsmAddonSettingsAMTelemetryOresource://gre/modules/AppConstants.jsmAppConstantsQresource://gre/modules/" Pattern match: "mozilla.org/addons/addon-manager-startup;1-amIAddonManagerStartupaomStartupE@mozilla.org/spellchecker/engine;1/mozISpellCheckingEnginespellCheck;@mozilla.org/uuid-generator;1!nsIUUIDGeneratoruuidGen5defineLazyPreferenceGetterprocessCount=dom.ipc.processCou" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersOresource://gre/modules/AddonManager.jsmAddonManagerOresource://gre/modules/AppConstants.jsmAppConstantsQresource://gre/modules/AsyncShutdown.jsmAsyncShutdownSresource://gre/modules/ConduitsParent.jsm!BroadcastConduitO" Pattern match: "mozilla.org/network/async-stream-copier;1createInstanceCi+nsIAsyncStreamCopier2initonStartRequestonStopRequestQueryInterface" Pattern match: "mozilla.org/pipe;1createInstanceCinsIPipeinitPR_UINT32_MAX[@mozilla.org/network/simple-stream-listener;1/nsISimpleStreamListeneroutputStreamonStartRequestonStopRequestnsIInputStreamQ@mozilla.org/network/input-stream-pump;1%nsIInputStreamPumpasyncReadnsICha" Pattern match: "mozilla.org/intl/converter-input-stream;1createInstance/nsIConverterInputStreamreplacementinitreadStringclosevaluemessage" Pattern match: "mozilla.org/scriptableinputstream;11nsIScriptableInputStreamreadBytes9" Pattern match: "mozilla.org/binaryinputstream;1" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersUresource://gre/modules/ExtensionParent.jsmExtensionParentGresource://gre/modules/JSONFile.jsmJSONFileCresource://gre/modules/osfile.jsmOS!defineLazyGetterStartupCache5extension-preferences.json_update_get_getCachedget" Pattern match: "mozilla.org/network/file-input-stream;1%nsIFileInputStreaminitpathdataReady" Pattern match: "mozilla.org/supports-PRBool;1createInstanceCi#nsISupportsPRBoolServicesobsnotifyObservers5quit-application-requesteddatastartupquitnsIAppStartupeRestarteAttemptQuitK;5" Pattern match: "mozilla.org/plugin/host;1getServiceCinsIPluginHostgetPluginTagsnextdonevalue_getStateLOG" Pattern match: "mozilla.org/supports-PRBool;1createInstance#nsISupportsPRBoolnotifyObservers5quit-application-requesteddatastartupquitnsIAppStartupeRestarteAttemptQuitYEQ5" Pattern match: "mozilla.org/addons/blocklist-prompt;1CcgetServicewrappedJSObject" Pattern match: "mozilla.org/plugin/host;1getServicensIPluginHostgetPluginTags1_getPluginBlocklistState_pluginEntriesnsIPluginTagSTATE_DISABLEDenabledStatedisabledSTATE_OUTDATEDCSTATE_VULNERABLE_UPDATE_AVAILABLE5STATE_VULNERABLE_NO_UPDATE]chrome://global/skin/plugins/plugi" Pattern match: "mozilla.org/addons/blocklist-prompt;1wrappedJSObject" Pattern match: "AppConstants.jsm/defineLazyGlobalGettersXMLHttpRequest%defineModuleGetterAddonManagerOresource://gre/modules/AddonManager.jsm'AddonManagerPrivateCertUtilsIresource://gre/modules/CertUtils.jsmFileUtilsIresource://gre/modules/FileUtils.jsmOSCresource://gre/m" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersOresource://gre/modules/AppConstants.jsmAppConstants!defineLazyGetterPlatformKeysKeysvalidIS_VALIDinvalid_keyINVALID_KEY!invalid_modifier!INVALID_MODIFIER'invalid_combination'INVALID_COMBINATION%duplicate_modifier%DUPL" Pattern match: "mozilla.org/uuid-generator;1getServiceCi!nsIUUIDGeneratorgenerateUUIDtoStringsubstring" Pattern match: "mozilla.org/toolkit/crash-reporter;1getServiceCi!nsICrashReporter+setTelemetrySessionIdp+Q;5QV0V" Pattern match: "mozilla.org/windows-registry-key;1Cc'getCounters_WindowsF-WQQ=;qQVV" Pattern match: "mozilla.org/xpcom/debug;1getServiceCinsIDebug2%isDebuggerAttached" Pattern match: "mozilla.org/plugin/host;1getServiceCinsIPluginHostgetPluginTagsnameShockwave" Pattern match: "mozilla.org/xpcom/debug;1getServiceCinsIDebug2" Pattern match: "mozilla.org/base/telemetry;1nsITelemetryTelemetrynowmonotonicNow'generateSessionUUID-generateSubsessionUUID_initialized_IO_COUNTERS_kernel32+_GetProcessIoCounters%_GetCurrentProcessgetCounters'getCounters_Windows" Pattern match: "mozilla.org/widget/htmlformatconverter;1createInstanceCi%nsIFormatConverter=@mozilla.org/supports-string;1#nsISupportsStringreplace" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersOresource://gre/modules/AddonManager.jsmAddonManager'AddonManagerPrivateQresource://gre/modules/AsyncShutdown.jsmAsyncShutdownOresource://gre/modules/DeferredTask.jsmDeferredTaskGresource://gre/modules/Services.jsmServ" Pattern match: "mozilla.org/timer;1createInstanceCinsITimer!initWithCallback" Pattern match: "mozilla.org/toolkit/crashmonitor;1contractIDgenerateQICinsIObserverQueryInterfaceobserveprototype" Pattern match: "mozilla.org/process/util;1createInstancensIProcessinitstartHiddennoShellunshift" Pattern match: "mozilla.org/security/hash;1createInstanceCinsICryptoHashinit" Pattern match: "mozilla.org/toolkit/crash-reporter;1getService!nsICrashReporter!getMinidumpForIDpath#getExtraFileForIDgQuitting'runMinidumpAnalyzer!processExtraFile'computeMinidumpHash%MinidumpSha256HashaddCrashDateAsyncShutdown'profileBeforeChangeaddBlockermCrashService" Pattern match: "mozilla.org/network/file-input-stream;1createInstanceCi%nsIFileInputStreaminitU@mozilla.org/intl/converter-input-stream;1/nsIConverterInputStreamUTF-8;DEFAULT_REPLACEMENT_CHARACTERvaluereadStringclose%parseKeyValuePairs" Pattern match: "mozilla.org/uuid-generator;1getServiceCi!nsIUUIDGeneratorgenerateUUIDtoStringsliceG$=;5" Pattern match: "mozilla.org/toolkit/crash-reporter;1getServiceCi!nsICrashReporter=isAnnotationWhitelistedForPingZ" Pattern match: "mozilla.org/timer;1createInstanceCinsITimer_storeTimer" Pattern match: "mozilla.org/base/telemetry;1nsITelemetry/defineLazyModuleGettersGresource://gre/modules/ClientID.jsmClientIDOresource://gre/modules/CoveragePing.jsmCoveragePingQresource://gre/modules/AsyncShutdown.jsmAsyncShutdownWresource://gre/modules/TelemetryStorage.j" Pattern match: "mozilla.org/xre/directory-provider;1getServiceCi#nsIXREDirProvidergetInstallHashSoftware\\\Installer\" Pattern match: "mozilla.org/windows-registry-key;1createInstanceCi!nsIWindowsRegKey" Pattern match: "mozilla.org/installerprefs;1contractIDgenerateQICinsIObserverQueryInterfaceobserve-_registerPrefListeners#_cleanRegistryKey/_reflectPrefsToRegistry3_reflectOnePrefToRegistry_openRegKeyprototype\$-=QZ=`Q" Pattern match: "mozilla.org/test/startuprecorder;1CcgetServicewrappedJSObjectdonelogtrace+All" Pattern match: "prefs.js/defineLazyModuleGettersEchrome://marionette/content/log.jsLogMresource://gre/modules/Preferences.jsmPreferencesKchrome://marionette/content/server.jsTCPListener!defineLazyGetterlogget/defineLazyServiceGetterenvE@mozilla.org/process/environment;1ns" Pattern match: "mozilla.org/remote/marionette;1contractID_xpcom_factoryg" Pattern match: "PPPHMHPPPPHUHPHPPHMH5PHMH.PHMH/PHMH,PHMH.PHMH5PHMH?PPPHMHPPPHMH" Pattern match: "XPCOMUtils.jsm/defineLazyServiceGetterenvE@mozilla.org/process/environment;1nsIEnvironmentCinsIPrefBranchMarionettePrefs!EXPORTED_SYMBOLSprototypeconstructorgetsetenabledclickToStartcontentListenerportlogLeveltruncateLog!recommendedPrefsfromg29" Pattern match: "mozilla.org/toolkit/crash-reporter;1getServiceCi!nsICrashReporter'annotateCrashReport%GraphicsSanityTest1]&;5" Pattern match: "mozilla.org/toolkit/crash-reporter;1getServiceCi!nsICrashReporter7removeCrashReportAnnotation%GraphicsSanityTestX#" Pattern match: "mozilla.org/timer;1createInstanceCinsITimer!initWithCallbackTYPE_ONE_SHOTH;5" Pattern match: "mozilla.org/gfx/info;1getServiceCinsIGfxInfoprefsgetBoolPrefAL_ENABLED_PREFRUNNING_PREFsetBoolPref%DISABLE_VIDEO_PREFreportResultTEST_CRASHEDDRIVER_PREF" Pattern match: "mozilla.org/toolkit/crash-reporter;1JSONstringify" Pattern match: "mozilla.org/streamConverters;1getServiceCi3nsIStreamConverterServiceI@mozilla.org/network/stream-loader;1createInstancensIStreamLoaderinit!asyncConvertDatauncompressedgzipK@mozilla.org/io/string-input-stream;1" Pattern match: "mozilla.org/toolkit/crash-reporter;1getServiceCi!nsICrashReporterClientID#getCachedClientID_serverServicesprefsgetStringPrefTelemetryUtilsPreferences" Pattern match: "mozilla.org/intl/scriptableunicodeconvertercreateInstanceCi;nsIScriptableUnicodeConverterUTF-8charset%ConvertFromUnicodeJSONstringify" Pattern match: "mozilla.org/io/string-input-stream;1" Pattern match: "mozilla.org/process/util;1createInstancensIProcessinitstartHiddennoShellrunAsyncm%Q;5=H;5p" Pattern match: "mozilla.org/base/telemetry;1nsITelemetry'TelemetryHealthPingKresource://gre/modules/HealthPing.jsmTelemetryUtils#Toolkit.TelemetryTelemetrySend::idle-daily1quit-application-granted/quit-application-forcednsPref:changed7profile-change-net-teardownServicespr" Pattern match: "ac-ay.aI/]U0]J;z" Pattern match: "mozilla.org/security/hash;1nsICryptoHashinitWithString" Pattern match: "XPCOMUtils.jsm/defineLazyGlobalGettersXMLHttpRequestrepositorygetLoggerLevelDebugleveladdAppenderConsoleAppenderBasicFormatterprototypeconstructoropeneb" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManageractiveUpdatei2" Pattern match: "mozilla.org/intl/ospreferences;1getServiceCi#mozIOSPreferencessystemLocaleI.;5" Pattern match: "mozilla.org/intl/ospreferences;1getServiceCi#mozIOSPreferencessystemLocalesI.;5" Pattern match: "mozilla.org/intl/ospreferences;1getServiceCi#mozIOSPreferences" Pattern match: "mozilla.org/gfx/info;1getServiceCinsIGfxInfoundefined;Q;5" Pattern match: "mozilla.org/plugin/host;1getServiceCinsIPluginHostgetPluginTagsnextdonevalueMathmax!lastModifiedTimepush'limitStringToLength/MAX_ADDON_STRING_LENGTHgetMimeTypesgetTime_environment_logerroru_getActivePlugins" Pattern match: "mozilla.org/gfx/info;1getServiceCinsIGfxInfogetFeaturesfeatures_logerrorKnsIGfxInfo.getFeatures()" Pattern match: "mozilla.org/browser/shell-service;1Cc_loginfou_isDefaultBrowser" Pattern match: "mozilla.org/sandbox/sandbox-settings;1getServiceCi'mozISandboxSettings9effectiveContentSandboxLevel9effectiveContentProcessLevelw4" Pattern match: "mozilla.org/weave/service;1getServicewrappedJSObjectenabled'_getFxaSignedInUser'_currentEnvironmentservices_logerrorE_updateServicesInfo()" Pattern match: "mozilla.org/gfx/info;1getServiceCinsIGfxInfogetMonitors_logerrorKnsIGfxInfo.getMonitors()" Pattern match: "mozilla.org/mac-attribution;1getService1nsIMacAttributionServicegetReferrerUrlURLsearchParamsATTR_CODE_KEYSnextdonevalueutm_funnel_has+ATTR_CODE_VALUE_REGEXtest" Pattern match: "mozilla.org/process/environment;1getServiceCinsIEnvironment" Pattern match: "Services.jsm/defineLazyGlobalGettersURL%26%3D" Pattern match: "mozilla.org/timer;1createInstanceclear!initWithCallback" Pattern match: "mozilla.org/io/string-input-stream;1createInstanceCi" Pattern match: "mozilla.org/network/stream-loader;1nsIStreamLoaderinit!onStreamComplete#_converterService!asyncConvertDataonStartRequestonDataAvailableonStopRequest1" Pattern match: "mozilla.org/intl/scriptableunicodeconvertercreateInstanceCi;nsIScriptableUnicodeConverterUTF-8charsetAQ;5" Pattern match: "mozilla.org/streamConverters;1getServiceCi3nsIStreamConverterService" Pattern match: "FilterExpressions.jsm/defineLazyGlobalGettersfetchAservices.settings.default_bucket%services.settings" Pattern match: "mozilla.org/security/contentsignatureverifier;1createInstanceCi7nsIContentSignatureVerifierx5ufetchtext" Pattern match: "ObjectUtils.jsm/defineLazyGlobalGettersfetchremote-settingsremotesettings!defineLazyGetterconsole5defineLazyPreferenceGettergServerURL1services.settings.serverprototypeconstructorappIDtoolkitVersionemitonoffErrordownloadidentifier#lastCheckTimePrefhttpClie" Pattern match: "osfile.jsm/defineLazyGlobalGettersfetchErrorprototypeconstructordownloaddownloadAsBytes" Pattern match: "XPCOMUtils.jsm/defineLazyGlobalGettersfetch!defineLazyGetterlogY/buckets/monitor/collections/changes/recordsCHANGES_PATHhasLocalDatahasLocalDump%fetchLatestChanges^Z=`Q" Pattern match: "mozilla.org/uuid-generator;1getServiceCi!nsIUUIDGeneratorgenerateUUID:Q;5" Pattern match: "mozilla.org/file/local;1createInstanceCinsIFileinitWithPathLOGsgetUpdateBaseDirNoCreate" Pattern match: "mozilla.org/updates/update-service;1getServiceCi7nsIApplicationUpdateServiceQueryInterfacensIObserverobserve-post-update-processing5-Q:QV5QVQV" Pattern match: "mozilla.org/security/hash;1createInstanceCinsICryptoHashinitSHA1Services" Pattern match: "mozilla.org/intl/scriptableunicodeconverter;nsIScriptableUnicodeConverterUTF-8charset%convertToByteArraypathtoLowerCase" Pattern match: "mozilla.org/file/local;1createInstanceCinsIFileinitWithPath" Pattern match: "mozilla.org/windows-registry-key;1createInstanceCi!nsIWindowsRegKeyopen-ROOT_KEY_LOCAL_MACHINEGSOFTWARE\Mozilla\MaintenanceServiceACCESS_READWOW64_64readIntValueInstalledclose?isServiceInstalled" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManageractiveUpdatesaveUpdates#cleanUpUpdatesDirL3" Pattern match: "mozilla.org/scriptableinputstream;1createInstanceCi1nsIScriptableInputStreaminitreadavailableclose" Pattern match: "mozilla.org/network/file-input-stream;1createInstanceCi%nsIFileInputStreaminitFileUtilsMODE_RDONLYPERMS_FILE3readStringFromInputStreamKT" Pattern match: "mozilla.org/updates/update-service;1getServiceCi7nsIApplicationUpdateServicedownloadUpdateSTATE_NONEKhandleFallbackToCompleteUpdate" Pattern match: "mozilla.org/updates/update-processor;1createInstanceCi%nsIUpdateProcessor/fixUpdateDirectoryPerms!shouldUseServiceAttempt" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManageractiveUpdateselectedPatchtypecompletePATCH_COMPLETEpartialPATCH_PARTIALphasecheck" Pattern match: "mozilla.org/supports-interface-pointer;1createInstanceCi7nsISupportsInterfacePointerChromeUtilsgenerateQInsIProperty" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManagersaveUpdatesK@mozilla.org/updates/update-checker;1createInstance!nsIUpdateChecker!stopCurrentCheck" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManageractiveUpdatereadStatusFilegetUpdatesDirSTATE_NONEiUpdateService:_postUpdateProcessing" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManageractiveUpdateAUSTLMYpingCheckCode_pingSuffix" Pattern match: "mozilla.org/remote/marionette;1createInstancerunningCuisInAutomationServicesprefsgetBoolPrefEPREF_APP_UPDATE_DISABLEDFORTESTING8QBQ=;q2;5" Pattern match: "mozilla.org/network/file-input-stream;1createInstanceCi%nsIFileInputStreaminitPERMS_FILEUpdateManager:_loadXMLFileIntoArray" Pattern match: "mozilla.org/windows-registry-key;1createInstanceCi!nsIWindowsRegKey#SOFTWARE\Mozilla\Servicesappinfoname#\32to64DidMigrateWindowsRegistryreadRegKey+ROOT_KEY_CURRENT_USERNeverWOW64_32-ROOT_KEY_LOCAL_MACHINELOGChecker:_getCanMigrate" Pattern match: "mozilla.org/updates/update-manager;1getService!nsIUpdateManageractiveUpdate4[5WQ5WQT:WQBWQV=VQV=QVVDTQVD?QVD*QVDQV" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManagersaveUpdates_pendingRequest^" Pattern match: "mozilla.org/updates/update-manager;1getService!nsIUpdateManagersaveUpdatesDownloader:downloadUpdate" Pattern match: "mozilla.org/network/incremental-download;1createInstance-nsIIncrementalDownload_requestinit'DOWNLOAD_CHUNK_SIZEstartEBITS_IDLE_NO_PROGRESS_TIMEOUT_SECS-BITS_IDLE_POLL_RATE_MS1_bitsActiveNotifications" Pattern match: "mozilla.org/updates/update-manager;1getService!nsIUpdateManagersaveUpdates/" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManagersaveUpdatesgetPropertyinternalBytesbitsBytesDatenow!_startDownloadMs_listeners" Pattern match: "mozilla.org/updates/update-manager;1getServiceCi!nsIUpdateManageractiveUpdatesaveUpdates_listeners" Pattern match: "mozilla.org/updates/update-processor;1createInstance%nsIUpdateProcessorprocessUpdate}Downloader:onStopRequest" Pattern match: "mozilla.org/network/default-auth-prompt;1createInstanceQueryInterfaceCrNS_NOINTERFACE]6T" Pattern match: "XPCOMUtils.jsm/defineLazyGlobalGettersDOMParserXMLHttpRequest/defineLazyModuleGettersQresource://gre/modules/AsyncShutdown.jsmAsyncShutdownIresource://gre/modules/CertUtils.jsmCertUtilsCresource://gre/modules/ctypes.jsm" Pattern match: "www.mozilla.org/2005/app-updatecchrome://mozapps/locale/update/updates.propertiesXREExeFProfDUpdRootDupdates#active-update.xml#backup-update.logbt.resultlast-update.logupdates.xmlupdate.logupdate.marupdate.statusupdate.testupdate.version'update_messages.lo" Pattern match: "mozilla.org/windows-registry-key;1CcCureportErrorCr-NS_ERROR_NOT_AVAILABLE3UPDATE_SERVICE_INSTALLED_Servicestelemetry!getHistogramByIdaddcreateInstanceCi!nsIWindowsRegKeyopen-ROOT_KEY_LOCAL_MACHINEGSOFTWARE\Mozilla\MaintenanceServiceACCESS_READWOW64_64read" Pattern match: "mozilla.org/bits;1nsIBitsErrorprototypeconstructorshutdownhasShutdownnameisPending" Pattern match: "mozilla.org/scripterror;1createInstanceCinsIScriptErrorinitfileNamelineNumberwarningFlag" Pattern match: "mozilla.org/supports-string;1createInstanceCi#nsISupportsStringdata" Pattern match: "AsyncShutdown.jsm/defineLazyServiceGetterTelemetry;@mozilla.org/base/telemetry;1nsITelemetry/defineLazyModuleGetters[resource:///modules/sessionstore/RunState.jsmRunStatecresource:///modules/sessionstore/SessionStore.jsmSessionStoreeresource:///modules/ses" Pattern match: "mozilla.org/xpcom/ini-parser-factory;1getServiceCi'nsIINIParserFactorycreateINIParser_iniFile" Pattern match: "mozilla.org/pref-localizedstring;1createInstanceCi-nsIPrefLocalizedString/LocalizablePreferences-!data:text/plain,=data_prefBranchsetComplexValue-LocalizablePreferences" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersUresource://gre/modules/ExtensionParent.jsmExtensionParentmresource://gre/modules/ExtensionPreferencesManager.jsm7ExtensionPreferencesManagerMresource://gre/modules/IgnoreLists.jsmIgnoreLists_resource://gre/modules/Pri" Pattern match: "mozilla.org/supports-string;1createInstanceCi#nsISupportsStringdataMchrome,dialog=no,suppressanimation,allwindows#WINDOW_ATTRIBUTESforEachisPrivate,privateServiceswwopenWindowAppConstants%BROWSER_CHROME_URL" Pattern match: "mozilla.org/browser/clh;1getServiceCi#nsIBrowserHandlerdefaultArgsSQT5E#QT5" Pattern match: "vQ.QQ.Q.Q.p..BV//T5" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulSET_STATE" Pattern match: "mozilla.org/gfx/screenmanager;1!nsIScreenManagergScreenManager;@mozilla.org/base/telemetry;1nsITelemetryTelemetry/defineLazyModuleGettersOresource://gre/modules/AppConstants.jsmAppConstantsQresource://gre/modules/AsyncShutdown.jsmAsyncShutdownYresource:///" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersSresource://normandy/lib/AddonRollouts.jsmAddonRolloutsQresource://normandy/lib/AddonStudies.jsmAddonStudiesUresource://normandy/lib/CleanupManager.jsmCleanupManagerMresource://normandy/lib/LogManager.jsmLogManagerUres" Pattern match: "LogManager.jsm/defineLazyServiceGettertimerManagerI@mozilla.org/updates/timer-manager;1+nsIUpdateTimerManager/defineLazyModuleGetters_resource://services-settings/remote-settings.jsRemoteSettingsOresource://featuregates/FeatureGate.jsmFeatureGateGresource:" Pattern match: "L.aM/aN0aO1aP2aQ3]R4]S5]T6]U7]V8]W9]X:]Y;]Z" Pattern match: "mozilla.org/toolkit/profile-service;1getServiceCi1nsIToolkitProfileService/createdAlternateProfile5OVERRIDE_ALTERNATE_PROFILEgetCharPrefQbrowser.startup.homepage_override.mstone" Pattern match: "mozilla.org/supports-string;1createInstanceCi#nsISupportsStringdataappendElementJ" Pattern match: "mozilla.org/toolkit/profile-service;1getService1nsIToolkitProfileService/createdAlternateProfile#getNewInstallPageArrayisArrayunshift" Pattern match: "mozilla.org/array;1createInstancensIMutableArrayforEachundefinedServiceswm'getMostRecentWindownavigator:blankdocumentdocumentElementremoveAttributewindowtypedocShellQueryInterfacensILoadContext%usePrivateBrowsinglocationargumentsnextdonevalue" Pattern match: "mozilla.org/supports-string;1#nsISupportsStringdata" Pattern match: "mozilla.org/array;1createInstancensIMutableArrayappendElementServiceswwopenWindow" Pattern match: "mozilla.org/webnavigation-info;1getServiceCi" Pattern match: "AppConstants.jsm/defineLazyModuleGetters}resource:///modules/aboutpages/AboutPrivateBrowsingHandler.jsm7AboutPrivateBrowsingHandlerYresource:///modules/BrowserWindowTracker.jsm" Pattern match: "vQ.QQ.Q.Q.p..BE/=QZQT/1V" Pattern match: "mozilla.org/thread-manager;1getService%spinEventLoopUntilstateCinsICommandLine#STATE_REMOTE_AUTOpreventDefaultJ" Pattern match: "mozilla.org/preferences-service;1getServiceCinsIPrefService!getDefaultBranch!recording-outputsetCharPref" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersQchrome://remote/content/server/HTTPD.jsmHttpServerOchrome://remote/content/JSONHandler.jsmJSONHandler?chrome://remote/content/Log.jsmLogMresource://gre/modules/Preferences.jsmPreferencesechrome://remote/content/Recomm" Pattern match: "mozilla.org/file/directory_service;1getServicensIProperties;5" Pattern match: "mozilla.org/preferences-service;1getServicensIPrefBranchgetCharPref7toolkit.singletonWindowTypeServiceswm'getMostRecentWindowfocus1toolkit.defaultChromeURI;toolkit.defaultChromeFeatures" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul#firstElementChildnamespaceURIlocalNamemenupopup%nextElementSiblingI" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulownerDocument-getElementsByAttributegroupidnamespaceURIlocalNameK" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulArrayfrom-getElementsByTagNameNSlabeljoin" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xultabsitemp7" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xultabpanelsitem+WQV" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulnamespaceURIlocalNamecheckboxradiogetAttributetruecheckedcontrolselectedItem]z" Pattern match: "mozilla.org/scriptsecuritymanager;1getServiceio" Pattern match: "mozilla.org/uriloader/external-protocol-service;15nsIExternalProtocolService#isExposedProtocolloadURIpreventDefaultspec=@mozilla.org/supports-PRBool;1createInstance#nsISupportsPRBooldatashiftKeyctrlKeymetaKey" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul-getElementsByTagNameNStreecol+getBoundingClientRectwidth" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulL" Pattern match: "D.PHX/HXIHh`H`TPNh`PH`[KH$`XsHX{HXHXHPPPPHPPPPHXHX" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul-getElementsByTagNameNSwizardpage2WQQ=QV" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul#_wizardButtonDeckselectedPanel-getElementsByTagNameNS" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul!createXULElementappendChilddocumentURI%BROWSER_CHROME_URLErrorAttempt" Pattern match: "mozilla.org/process/environment;1getServiceCinsIEnvironmentget=MOZ_INSTRUMENT_CUSTOM_ELEMENTSSetWeakSetcustomElements" Pattern match: "mozilla.org/mime;1getServiceCinsIMIMEServicegetTypeFromURI/application/x-xpinstallServices+scriptSecurityManager%getSystemPrincipalAddonManager!getInstallForURLspecfile-url" Pattern match: "mozilla.org/filepicker;1createInstanceinit" Pattern match: "mozilla.org/widget/transferable;1createInstanceCinsITransferableinitgetLoadContextaddDataFlavortext/unicodeServicesclipboard5supportsSelectionClipboardgetData'kSelectionClipboard!kGlobalClipboardgetTransferDatavalueQueryInterface#nsISupportsStringdata[*&5" Pattern match: "bugzilla.mozilla.org/show_bug.cgi?id=1238180locationinitialTabimageElementbrowsingContextbrowser" Pattern match: "mozilla.org/browser/clh;1getServiceCi#nsIBrowserHandlerdefaultArgsdocumentdocumentElementgetAttributewindowtypeprivate" Pattern match: "mozilla.org/referrer-info;1createInstanceCinsIReferrerInfoinitWithNode!initWithDocumentsavesaveURLgatherTextUnderpreventDefaulttabgBrowserdocShell'mixedContentChannelServices+scriptSecurityManagermakeURInodePrincipal!originAttributes#privateBrowsingId%chec" Pattern match: "mozilla.org/supports-PRBool;1createInstanceCi#nsISupportsPRBooldataServicesobsnotifyObservers/last-pb-context-exitingEbrowser-lastwindow-close-requestedAbrowser-lastwindow-close-grantedAppConstantsplatform" Pattern match: "mozilla.org/supports-PRBool;1createInstanceCi#nsISupportsPRBoolobsnotifyObservers5quit-application-requestedrestartdatastartupquitnsIAppStartupeRestarteAttemptQuit" Pattern match: "mozilla.org/referrer-info;1nsIReferrerInfoinit" Pattern match: "mozilla.org/browser/clh;1getServiceCi#nsIBrowserHandlerdefaultArgsnsIArrayArrayfromenumerate#nsISupportsStringdataSessionStartup" Pattern match: "mozilla.org/widget/dragservice;1getServiceCinsIDragService#getCurrentSessiondocumentgetElementById" Pattern match: "mozilla.org/supports-PRBool;1createInstanceCi#nsISupportsPRBoolServicesobsnotifyObservers#offline-requesteddata~I" Pattern match: "mozilla.org/uriloader/external-protocol-service;1getServiceCi5nsIExternalProtocolServiceloadURII&5" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowserparentNode-getElementsByTagNameNStabmodalpromptArrayfrommapj1" Pattern match: "NotificationDB.jsm/defineLazyModuleGettersOresource://gre/modules/AddonManager.jsmAddonManagerAMTelemetryYresource:///modules/NewTabPagePreloading.jsm" Pattern match: "mozilla.org/content-pref/service;1-nsIContentPrefService2'ContentPrefService2O@mozilla.org/url-classifier/dbservice;1!nsIURIClassifier#classifierServiceM@mozilla.org/browser/favicon-service;1#nsIFaviconServiceFaviconsU@mozilla.org/browser/aboutnewtab-servi" Pattern match: "mozilla.org/timer;1createInstanceCinsITimer!initWithCallback%_springLoadDelayMsTYPE_ONE_SHOTpreventDefaultstopPropagation=-Q" Pattern match: "mozilla.org/timer;1createInstanceCinsITimer_closeTimer#_closingTimerNode!initWithCallback_closeDelayMsTYPE_ONE_SHOTe4&WQ55HD:Q5E%Q555HV" Pattern match: "browserPlacesViews.js/defineLazyModuleGettersgresource://activity-stream/lib/BookmarkPanelHub.jsm!BookmarkPanelHub_itemGuids_batching_isNewBookmark_isComposing_autoCloseTimer-_autoCloseTimerEnabled#_autoCloseTimeout;_removeBookmarksOnPopupHidden_element'sh" Pattern match: "mozilla.org/supports-PRBool;1createInstanceCi#nsISupportsPRBoolServicesobsnotifyObservers5quit-application-requesteddata=5" Pattern match: "mozilla.org/array;1createInstancensIMutableArray=@mozilla.org/supports-string;1#nsISupportsStringdatacharset==@mozilla.org/supports-PRBool;1#nsISupportsPRBoolA@mozilla.org/supports-PRUint32;1'nsISupportsPRUint32appendElement%frameOuterWindowIDundefinedgBro" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulmenupopuppopuphidePopupcloseMenusparentNode.=TqT5=E2QT5=D" Pattern match: "mozilla.org/array;1createInstanceCinsIMutableArray=@mozilla.org/supports-string;1#nsISupportsStringdataappendElementwwopenWindowAppConstants%BROWSER_CHROME_URL" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersYresource:///modules/BrowserWindowTracker.jsm" Pattern match: "bugzilla.mozilla.org/show_bug.cgi?id=1243643saveImageURL" Pattern match: "pdf.js/web/viewer.htmlcurrentURIschemeIsfileServices+scriptSecurityManager-createContentPrincipal!originAttributesinternalSaveapplication/pdf" Pattern match: "mozilla.org/transfer;1createInstancensITransferinitsourceURIisPrivate!DownloadListener" Pattern match: "mozilla.org/embedding/browser/nsWebBrowserPersist;1Ci" Pattern match: "mozilla.org/filepicker;1CinsIFilePickerCccreateInstance@Q=Q5QV7" Pattern match: "mozilla.org/mime;1CinsIMIMEServiceCcgetServiceMQ=Q5QV7" Pattern match: "mozilla.org/network/mime-hdrparam;1Ci%nsIMIMEHeaderParamCcgetServicevalue#getCharsetforSavegetParameterfilenamename!validateFileNametitletrimcontentType+application/xhtml+xmlapplication/xmlimage/svg+xmltext/htmltext/xmlQueryInterface" Pattern match: "mozilla.org/network/standard-url-mutator;1createInstanceCinsIURIMutatorsetSpec%http://example.comsetFilePathfinalizeQueryInterface" Pattern match: "mozilla.org/uriloader/external-protocol-service;1getService5nsIExternalProtocolService#isExposedProtocol" Pattern match: "mozilla.org/network/load-group;1createInstancensILoadGroupstartuponStartRequestonStopRequestChromeUtilsgenerateQI%nsIRequestObserver1nsISupportsWeakReferenceQueryInterfacegroupObserveronStartURIOpendoContentisPreferred!canHandleContentloadCookie+parentCont" Pattern match: "mozilla.org/embedcomp/window-watcher;1getService!nsIPromptFactorygetPrompt" Pattern match: "XPCOMUtils.jsm/defineLazyModuleGettersOresource://gre/modules/BrowserUtils.jsmBrowserUtilsIresource://gre/modules/Downloads.jsmDownloadsQresource://gre/modules/DownloadPaths.jsmDownloadPathsUresource://gre/modules/DownloadLastDir.jsmDownloadLastDirIresourc" Pattern match: "mozilla.org/network/captive-portal-service;1getServiceCi/nsICaptivePortalService_cpsstateLOCKED_PORTAL-_captivePortalDetected" Pattern match: "mozilla.org/widget/clipboardhelper;1getServiceCi%nsIClipboardHelpercopyStringgURLBarmakeURIReadablegBrowserselectedBrowsercurrentURIdisplaySpecPageActionsactionForIDcopyURL;showBrowserPageActionFeedbackCQ" Pattern match: "mozilla.org/widget/macsharingservice;1" Pattern match: "mozilla.org/appshell/component/browser-status-filter;1createInstanceCinsIWebProgress'addProgressListenerNOTIFY_ALL_tabListeners_tabFilterswebProgressmWQ" Pattern match: "5WQ..VE/QV" Pattern match: "mozilla.org/appshell/component/browser-status-filter;1createInstanceCinsIWebProgress'addProgressListenerNOTIFY_ALLwebProgress_tabListenersset_tabFilters#handleDroppedLink%droppedLinkHandler_loadURIbindloadURI!docShellIsActiveE10SUtilsNOT_REMOTE1_outerWindo" Heuristic match: "QN.PH" Pattern match: "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul_XUL_NS_tabForBrowser3_browserBindingProperties_removingTabsWeakSet+_multiSelectedTabsSet1_lastMultiSelectedTabRef5_clearMultiSelectionLocked=_clearMultiSelectionLockedOnce3_multiSelectChangeStar" Pattern match: "ab-bc.ac/ad0be1ae2]f3]g4]h5]i6]j7]k8]l9]m:]n;]o" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/0b03494e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/0b03494e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/0b03494e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/0b03494e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/72.0.2/releasenotes" Pattern match: "https://www.mozilla.org" Heuristic match: "%WINDIR%\Microsoft.NET" Heuristic match: "%PROGRAMFILES%\Mozilla Firefox\extensions\talkback@mozilla.org" Heuristic match: "Tran_Lrr|ngdatafrom__facLboo_.com" Heuristic match: ",Vu2.Vu" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com110/" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05" Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0L" Pattern match: "http://ocsp.digicert.com0N" Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://www.mozilla.com0" Pattern match: "http://mozilla" Pattern match: "www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F" Heuristic match: ";%.Om" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08" Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0" Pattern match: "https://mozilla.org0" Pattern match: "https://get.adobe.com/flashplayer/" Pattern match: "https://get.adobe.com/shockwave/" Pattern match: "https://www.facebook.com/" Pattern match: "https://ww" Pattern match: "ebook.com/loginm" Heuristic match: "incoming.telemetry.mozilla.org" Heuristic match: "vwcsource.ax" Heuristic match: "ycwebcamerasource.ax" Pattern match: "http://www.mozilla.com/en-US/blocklist/" Heuristic match: "ttps://accounts.google.com" Pattern match: "www.facebook.com/login" Heuristic match: "ww.facebook.com" Heuristic match: "ccounts.google.com" Heuristic match: "ww.youtube.com" Pattern match: "www.youtube.com/" Heuristic match: "cebook.cd" Pattern match: "www.face"67:T71b1,Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginc:\program" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginath=c:\program" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginoz_crashreporter_strings_override=c:\program" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginrgw@0)@pgwh0)ugw" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscbrowser/features/webcompat@mozilla.org.xpibrowser/features/screenshots@mozilla.org.xpibrowser/features/doh-rollout@mozilla.org.xpibrowser/visualelements/visualelements_70.pngapi-ms-win-crt-environment-l1-1-0.dllapi-ms-win-core-processthreads-l1-1-1.dllapi-ms-win-core-localization-l1-2-0.dllvu2.5.4.5vu2.5.4.6vu2.5.4.7vu2.5.4.8vu2.5.4.9n!wuxn!wu'].wuc4uumemoryqusystem]uufilerupkcs7zuupkcs12vu2.5.4.10vu2.5.4.11vu2.5.4.12vu2.5.4.13vu2.5.4.14vu2.5.4.15vu2.5.4.16vu2.5.4.17vu2.5.4.18vu2.5.4.19vu2.5.4.20vu2.5.4.21vu2.5.4.22vu2.5.4.23vu2.5.4.24vu2.5.4.25vu2.5.4.26vu2.5.4.27vu2.5.4.28vu2.5.4.29vu2.5.4.30vu2.5.4.31vu2.5.4.32vu2.5.4.33vu2.5.4.34vu2.5.4.35vu2.5.4.36vu2.5.4.37vu2.5.4.38vu2.5.4.39vu2.5.4.40vu2.5.4.42vu2.5.4.43vu2.5.29.19wu2.5.29.10vu2.5.29.21vu2.5.29.37wu2.5.29.7wu2.5.29.8wu2.5.29.17wu2.5.29.18wu2.5.29.1].wu2.5.29.35vu2.5.29.14vu2.5.29.15wu2.5.29.2vu2.5.29.4" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_events_directory=c:\users\hapubws\appdata\roaming\mozilla\firefox\crash" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginle.logcomputername=hapubws-pcfp_no_host_check=nohomepath=\users\hapubwsmoz_crashreporter_data_directory=c:\users\hapubws\appdata\roaming\mozilla\firefox\crash" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%digicert" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "http://www.mozilla.com0/" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "http://mozilla;" - Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00001816.00000000.69932.008A0000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginc:\program" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginath=c:\program" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginoz_crashreporter_strings_override=c:\program" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/login\programisualents/vielemen50.p\??\c:\program" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginrgw@0)@pgw" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscbrowser/features/webcompat@mozilla.org.xpibrowser/features/screenshots@mozilla.org.xpibrowser/features/doh-rollout@mozilla.org.xpiapi-ms-win-core-processthreads-l1-1-1.dllvu2.5.4.5vu2.5.4.6vu2.5.4.7vu2.5.4.8vu2.5.4.9n!wuxn!wu'].wuc4uumemoryqusystem]uufilerupkcs7zuupkcs12vu2.5.4.10vu2.5.4.11vu2.5.4.12vu2.5.4.13vu2.5.4.14vu2.5.4.15vu2.5.4.16vu2.5.4.17vu2.5.4.18vu2.5.4.19vu2.5.4.20vu2.5.4.21vu2.5.4.22vu2.5.4.23vu2.5.4.24vu2.5.4.25vu2.5.4.26vu2.5.4.27vu2.5.4.28vu2.5.4.29vu2.5.4.30vu2.5.4.31vu2.5.4.32vu2.5.4.33vu2.5.4.34vu2.5.4.35vu2.5.4.36vu2.5.4.37vu2.5.4.38vu2.5.4.39vu2.5.4.40vu2.5.4.42vu2.5.4.43vu2.5.29.19wu2.5.29.10vu2.5.29.21vu2.5.29.37wu2.5.29.7wu2.5.29.8wu2.5.29.17wu2.5.29.18wu2.5.29.1].wu2.5.29.35vu2.5.29.14vu2.5.29.15wu2.5.29.2vu2.5.29.4" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_events_directory=c:\users\hapubws\appdata\roaming\mozilla\firefox\crash" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "https://www.facebook.com/loginle.logcomputername=hapubws-pcfp_no_host_check=nohomepath=\users\hapubwsmoz_crashreporter_data_directory=c:\users\hapubws\appdata\roaming\mozilla\firefox\crash" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "http://mozilla;" - Source: "00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0ccs>'" - Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0digicert" - Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found URL "https://www.digicert.com/cps0azm$v0t082http://crl3.digicert.com/digicertassuredidca-1.crl082http://crl4.digicert.com/digicertassuredidca-1.crl0wk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicertassuredidca-1.crt0iw!]4/(o:r" - Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found URL "https://mozilla.org0du,u25noc7s\" - Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0ccs>'" - Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0digicert" - Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found URL "https://www.digicert.com/cps0azm$v0t082http://crl3.digicert.com/digicertassuredidca-1.crl082http://crl4.digicert.com/digicertassuredidca-1.crl0wk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicertassuredidca-1.crt0iw!]4/(o:r" - Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found URL "https://mozilla.org0" - Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found URL "https://get.adobe.com/flashplayer/" - Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found URL "https://get.adobe.com/shockwave/" - Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00001816.00000001.70562.008A0000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "https://www.facebook.com/loginoz_crashreporter_strings_override=c:\program" - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msccryptsipdllismyfiletype2cryptdllexportpublickeyinfoexcryptdllimportpublickeyinfoexcryptdllencodepublickeyandparameterscryptdllconvertpublickeyinforu1.2.840.113549.1.1.1uu1.3.14.3.2.12uu1.2.840.10040.4.1uu1.2.840.10046.2.1uu1.2.840.113549.1.3.17qu1.2.840.113549.1.1.17qu1.3.14.3.2.22uu1.3.14.3.2.12uu1.2.840.10040.4.1cryptdllextractencodedsignatureparameterscryptdllsignandencodehashcryptdllverifyencodedsignaturecryptdllimportpublickeyinfoex2cryptdllexportpublickeyinfoex2certdllopensystemstoreprovcertdllregistersystemstorecertdllunregistersystemstorecertdllregisterphysicalstorecertdllunregisterphysicalstorecertdllenumphysicalstorecryptdllexportprivatekeyinfoexcryptdllimportprivatekeyinfoexcryptmsgdllcngexportkeytranscryptmsgdllcngexportkeyagreecryptmsgdllcngimportkeytranscryptmsgdllcngimportkeyagreecryptmsgdllgenencryptkeycryptmsgdllexportencryptkeycryptmsgdllimportencryptkeycryptmsgdllgencontentencryptkeycryptmsgdllexportkeytranscryptmsgdllexportkeyagreecryptmsgdllexportmaillistcryptmsgdllimportkeytranscryptmsgdllimportkeyagreecryptmsgdllimportmaillistprocessor_identifier=x86" - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0ccs>'" - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0digicert" - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "https://www.digicert.com/cps0azm$v0t082http://crl3.digicert.com/digicertassuredidca-1.crl082http://crl4.digicert.com/digicertassuredidca-1.crl0wk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicertassuredidca-1.crt0iw!]4/(o:r" - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "https://mozilla.org0du,u25noc7s\" - Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00002424.00000000.70863.00410000.00000004.mdmp") Found URL "https://www.facebook.com/hreporter_strings_override=c:\program" - Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp") Found URL "https://ww" - Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp") Found URL "https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://www.facebook.com/loginpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.msccryptsipdllismyfiletype2cryptdllexportpublickeyinfoexcryptdllimportpublickeyinfoexcryptdllencodepublickeyandparameterscryptdllconvertpublickeyinforu1.2.840.113549.1.1.1ru1.3.14.3.2.22uu1.3.14.3.2.12uu1.2.840.10040.4.1uu1.2.840.10046.2.1uu1.2.840.113549.1.3.17qu1.2.840.113549.1.1.17qu1.3.14.3.2.22uu1.3.14.3.2.12uu1.2.840.10040.4.1cryptdllextractencodedsignatureparameterscryptdllsignandencodehashcryptdllverifyencodedsignaturecryptdllimportpublickeyinfoex2cryptdllexportpublickeyinfoex2certdllopensystemstoreprovcertdllregistersystemstorecertdllunregistersystemstorecertdllregisterphysicalstorecertdllunregisterphysicalstorecertdllenumphysicalstorecryptdllexportprivatekeyinfoexcryptdllimportprivatekeyinfoexcryptmsgdllcngexportkeytranscryptmsgdllcngexportkeyagreecryptmsgdllcngimportkeytranscryptmsgdllcngimportkeyagreecryptmsgdllgenencryptkeycryptmsgdllexportencryptkeycryptmsgdllimportencryptkeycryptmsgdllgencontentencryptkeycryptmsgdllexportkeytranscryptmsgdllexportkeyagreecryptmsgdllexportmaillistcryptmsgdllimportkeytranscryptmsgdllimportkeyagreecryptmsgdllimportmaillistprocessor_identifier=x86" - Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp") Found URL "https://www.facebook.com/loginmoz_crashreporter_strings_override=c:\program" - Source: "00000000-00003276.00000000.74194.00120000.00000004.mdmp") Found URL "http://www.mozilla.com/en-us/blocklist/compile-time" - Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found URL "https://www.youtube.com/asescrollviewerle\@tyledscrollviewerelectornodefaultadiobuttonglyphxpandobuttonglyphccessiblebuttondata\?\storage" - Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00003576.00000001.67898.03370000.00000002.mdmp") Found URL "http://timevalueg" - Source: "00000000-00003840.00000000.69964.00380000.00000004.mdmp") Found URL "https://accounts.google.compathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://accounts.google.compathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://accounts.google.compathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscmoz_crashreporter_restart_arg_1=https://accounts.google.compathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscvu2.5.4.5vu2.5.4.6vu2.5.4.7vu2.5.4.8vu2.5.4.9n!wun!wu].wu" - Source: "00000000-00003840.00000000.69964.00380000.00000004.mdmp") Found URL "https://accounts.google.comappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\templocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempmoz_crashreporter_data_directory=c:\users\hapubws\appdata\roaming\mozilla\firefox\crash" - Source: "00000000-00003840.00000000.69964.00380000.00000004.mdmp") Found URL "https://accounts.google.commoz_crashreporter_data_directory=c:\users\hapubws\appdata\roaming\mozilla\firefox\crash" - Source: "00000000-00003840.00000000.69964.00380000.00000004.mdmp")68:Tcc8,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "E1D907109DDC91DA9E0EFBDCD6400664E32762C4") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "CA57A172C56B660295089D8E043B0C928ED0546E") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "1B61910C3903186F3A3C1C51422BEDA267936491") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "7FBA15937BECFB1AB2AED031F0A0AFD85C32FF59") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "036E8ACD21B2920BCD59910098A581D02CCAF41B") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "050D0DED83AF702192E1A77B6EFB2323A6A7BFDC") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "5F2F372FC56D22C4C8EAEA955E5BDE860F84C113") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "5D809EFEBA07F93818A91E959DA4C1510DB50766") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "7C5668072A22A6B2ED22E92A906F857CDABD0F0C") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "A66CCC6DC1695326078AA5DC80DC0E6E92EE1ED2") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "2B62B40227044D99651CF734EFC532DFCFBA5516") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "FC5F8A32AB05AF3AAC151EF23301DF383ACB2AB5") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "CF6A77300C9148F8201693B5CD7242A003FD24D1") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "3CE7879BF66C32394041147E2F4885110DF32CB9") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Sun, 21 Jan 2024 16:26:22 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Fri, 19 Jan 2024 17:07:44 GMTExpires: Sat, 18 Jan 2025 17:07:44 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 170313Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL")69:T294f,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwmvPD4QTT%2BMSqx%2Fk7azpE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21S" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCc21SZGmxMgAqM79mihzX3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAlwhBihEwwe7TH7AZVHAYs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCECO0Y37WzHRLPzhV9vNju HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 21 Jan 2024 16:21:15 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCR" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAPCRpfvazdAnzYNtm9aj3 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8u" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCkL8ujaUIg6AmC7iYcQAA2 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAo" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECbzjAowsPTyEMLulIc7EGw%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"6a:T2dc9,Observed string: "{"data":[{"schema":1700179207170,"feature":"fingerprinting-protection","pattern":"*.geetest.com","id":"f2a88631-c444-49d1-b377-c25608ef0018","last_modified":1701090424142},{"schema":1701082018913,"feature":"tracking-annotation","pattern":"d3vox9szr7t2nm.cloudfront.net","filter_expression":"env.version < '122'","id":"01eb9187-ab15-4851-a014-441381e3cd02","last_modified":1701090424139},{"deleted":true,"id":"a58a692d-e29c-40f7-bf74-d3accbb3a0e7","last_modified":1606870304609},{"deleted":true,"id":"8b516869-3278-4ea3-b5db-ac39f887c46c","last_modified":1606870304607},{"deleted":true,"id":"fb5ef384-fca7-4044-a9e1-9683a481592d","last_modified":1594765026508},{"deleted":true,"id":"cdf7d6c9-4270-47a2-95aa-fa51c5558c61","last_modified":1594765026504},{"deleted":true,"id":"90467a71-2510-49a2-9a51-0071af0aeafc","last_modified":1591230685127},{"deleted":true,"id":"bd824c89-4626-426c-b6bf-751f53aec05e","last_modified":1591230685125},{"deleted":true,"id":"0577200f-13aa-4954-b5c0-752ef7f71170","last_modified":1582642985640},{"deleted":true,"id":"19ba9682-4bd1-439c-bfcf-642a5dc3c3c5","last_modified":1579735982667},{"deleted":true,"id":"e8fd3b61-42b5-44e3-8745-749d1cce327d","last_modified":1579735982665},{"deleted":true,"id":"995c565d-224b-4064-be52-739a58d449e6","last_modified":1577471769850},{"deleted":true,"id":"42952881-1ea9-4a9b-8c4b-2be4e4167a8c","last_modified":1577471769847},{"deleted":true,"id":"c8e638d1-2fb1-46ca-980e-5c3cc145ef9f","last_modified":1577471769844}]}:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/url-classifier-skip-urls/records?_expected=1701090424142&_sort=-last_modified&_since=1571936118309strongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAMwFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAVeMIIFWjCCBEKgAwIBAgISA9GY462VxzkuNQVlgf2PEq9rMA0GCSqGSIb3DQEBCwUAMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJSMzAeFw0yMzEyMjUwNDE1MDNaFw0yNDAzMjQwNDE1MDJaMCYxJDAiBgNVBAMTG3JlbW90ZS1zZXR0aW5ncy5tb3ppbGxhLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKBHIX4QJYQO2KNUSE3maGgBuAX8XR+6UWte9YNYJ1mLG9mJFl24Anj2Pd4Ed50QC+1E56ZdNKq7rdd5/BEvlnHY/cUnIvd6xVfz1Ufz+EmCG3rncaJSXopuVW71MxCc9rRcnLVmie9n3qSgDgMIhEtG5smwStxlCMLlVBMBKcPJgu0FCk8FUtvLyOBbIHG03TC19XlpBnv3+6ZvKNBU1ofNmx0J511N1eUGWkm0gAq7GzAh4OlZAAIlTOM/Qx3EVuhLBaJIjwaJ5j/tWr2ldGk72O3EjUViE346Hp9/dwokhK/Hc8uCNoeAnIMxc+81voaIYJ5oUEhOMYbgIEPHUKkCAwEAAaOCAnQwggJwMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUddnN2R+fdVyotG9VH22dFZ6taugwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8wfwYDVR0RBHgwdoIlZmlyZWZveC5zZXR0aW5ncy5zZXJ2aWNlcy5tb3ppbGxhLmNvbYIwcHJvZC5yZW1vdGUtc2V0dGluZ3MucHJvZC53ZWJzZXJ2aWNlcy5tb3pnY3AubmV0ghtyZW1vdGUtc2V0dGluZ3MubW96aWxsYS5vcmcwEwYDVR0gBAwwCjAIBgZngQwBAgEwggECBgorBgEEAdZ5AgQCBIHzBIHwAO4AdAA7U3d1Pi25gE6LMFsG/kA7Z9hPw/THvQANLXJv4frUFwAAAYyfZeC+AAAEAwBFMEMCIGI5Tf2L+Mn78bXdSHWEmIRzJXU5nPolhuwz7Ntk/z3pAh9Saa/czRQHsYKPvXhje2dkVzazBYogB5mObBKRtcMAAHYAdv+IPwq2+5VRwmHM9Ye6NLSkzbsp3GhCCp/mZ0xaOnQAAAGMn2XhRAAABAMARzBFAiEAyliWeAvhZfQWNeWc7w2bSXfv+tKBcCOXtwSvKVoP6p8CIGR06mZXMdziooB98+8jGeBJEPwpa209J/RLLTcI71BAMA0GCSqGSIb3DQEBCwUAA4IBAQA8RiAek8B/Hvru0wY1MZY80lfBqP1DWAEsKuW+WQa5QdnST084mXtUol/O8IMOtC9Ml/bEn5AIBU97i4Zmgut1fucjRS1mrcZodZJ+ROMzYeQhUiOC75qfKsJuRi9nKiKIhZtFUi5KUNnIIiB9sxJwi/YiHvB7eAzGtRXUkCkAV7sLBah+cA3YAA2Lq2YEJSas8VDDz1BYnJN2fsDn4L3m9GUHjVXkBi4f848BO2lMkQKnMmGWSpwJVkQ+WaP9WvAXjCPLnkiu515peEu1mkPUut8VvdHTtDYvYgBOY30H5PyC3UDWjE8DD7tw/eCNA7+iOasvghEVGY36lgTojpgyEwEABAAAAAABAQAAAAAAAAZ4MjU1MTkAAAAOUlNBLVBTUy1TSEEyNTYAA2YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAABV4wggVaMIIEQqADAgECAhID0ZjjrZXHOS41BWWB/Y8Sr2swDQYJKoZIhvcNAQELBQAwMjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMTAlIzMB4XDTIzMTIyNTA0MTUwM1oXDTI0MDMyNDA0MTUwMlowJjEkMCIGA1UEAxMbcmVtb3RlLXNldHRpbmdzLm1vemlsbGEub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoEchfhAlhA7Yo1RITeZoaAG4BfxdH7pRa171g1gnWYsb2YkWXbgCePY93gR3nRAL7UTnpl00qrut13n8ES+Wcdj9xSci93rFV/PVR/P4SYIbeudxolJeim5VbvUzEJz2tFyctWaJ72fepKAOAwiES0bmybBK3GUIwuVUEwEpw8mC7QUKTwVS28vI4FsgcbTdMLX1eWkGe/f7pm8o0FTWh82bHQnnXU3V5QZaSbSACrsbMCHg6VkAAiVM4z9DHcRW6EsFokiPBonmP+1avaV0aTvY7cSNRWITfjoen393CiSEr8dzy4I2h4CcgzFz7zW+hohgnmhQSE4xhuAgQ8dQqQIDAQABo4ICdDCCAnAwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBR12c3ZH591XKi0b1UfbZ0Vnq1q6DAfBgNVHSMEGDAWgBQULrMXt1hWy65QCUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYBBQUHMAGGFWh0dHA6Ly9yMy5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDovL3IzLmkubGVuY3Iub3JnLzB/BgNVHREEeDB2giVmaXJlZm94LnNldHRpbmdzLnNlcnZpY2VzLm1vemlsbGEuY29tgjBwcm9kLnJlbW90ZS1zZXR0aW5ncy5wcm9kLndlYnNlcnZpY2VzLm1vemdjcC5uZXSCG3JlbW90ZS1zZXR0aW5ncy5tb3ppbGxhLm9yZzATBgNVHSAEDDAKMAgGBmeBDAECATCCAQIGCisGAQQB1nkCBAIEgfMEgfAA7gB0ADtTd3U+LbmAToswWwb+QDtn2E/D9Me9AA0tcm/h+tQXAAABjJ9l4L4AAAQDAEUwQwIgYjlN/Yv4yfvxtd1IdYSYhHMldTmc+iWG7DPs22T/PekCH1Jpr9zNFAexgo+9eGN7Z2RXNrMFiiAHmY5sEpG1wwAAdgB2/4g/Crb7lVHCYcz1h7o0tKTNuyncaEIKn+ZnTFo6dAAAAYyfZeFEAAAEAwBHMEUCIQDKWJZ4C+Fl9BY15ZzvDZtJd+/60oFwI5e3BK8pWg/qnwIgZHTqZlcx3OKigH3z7yMZ4EkQ/ClrbT0n9EstNwjvUEAwDQYJKoZIhvcNAQELBQADggEBADxGIB6TwH8e+u7TBjUxljzSV8Go/UNYASwq5b5ZBrlB2dJPTziZe1SiX87wgw60L0yX9sSfkAgFT3uLhmaC63V+5yNFLWatxmh1kn5E4zNh5CFSI4Lvmp8qwm5GL2cqIoiFm0VSLkpQ2cgiIH2zEnCL9iIe8Ht4DMa1FdSQKQBXuwsFqH5wDdgADYurZgQlJqzxUMPPUFick3Z+wOfgveb0ZQeNVeQGLh/zjwE7aUyRAqcyYZZKnAlWRD5Zo/1a8BeMI8ueSK7nXml4S7WaQ9S63xW90dO0Ni9iAE5jfQfk/ILdQNaMTwMPu3D94I0Dv6I5qy+CERUZjfqWBOiOmDJmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAUaMIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAwWhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cPR5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdxsxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8ZutmNHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxgZ3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQBgt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6WPTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wlikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQzCkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BImlJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1OyK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90IdshCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6ZvMldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqXnLRbwHOoq7hHwmYKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAABW8wggVrMIIDU6ADAgECAhEAghDPsNJA41lEY+C7Y4KLADANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0xNTA2MDQxMTA0MzhaFw0zNTA2MDQxMTA0MzhaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAregkc/QUN/ObnitXKByHvty33ziQjG485legePd1wqL+9Wpu9gBPKNveaIZsRJO2sWP9FBJrvx/S6jGbIX7RMzy6SPXded+zuP8S8SGaS8GKhnFpSmZmbI9+PHC/rSkiBvPkwOaAruJLj7eZfpQDn9NHl3yZSCNT6DiuTwpvgy7RSVeMgHS22i/QOI17A3AhG3XyMDz6j67d2mOr6xZPwo4RS37PC+j/tXcu9LJ7SuBMEiUMcI0DKaDhUyTsE9nuGb8Qs0qMP4mjYVHerIcHlPRjcewu4m9bmIHhiVw0eWx27zuQYnnm26SaLybF0BDhDt7ZEI4W+7f3qPfH5QIHmI82CJXn4jeWDTZ1nvsOcrEdm7wD+UkF2IHdBbQq1kHprAF2lQoP2N/VvRIfNS8oF2zSmMGoCWR3bkc3us6sWV5onX9y1onFBkEpPlk+3Sb1JMkRp1qjTEAfRqGZtac6UW6GO559cqcSBXhZ7T5ReBULA4+N0C8Fsj57ShxLcwUS/Mbq4FATfEOTdLPKdOeOHwEI0DDUW3E2tAe6wTAwXEi3gjuYpn1giqKjKYLMur2DBBuigwNBodYF8RvCtvCofIY7RqhIKojcdpp2vx9qpT0Zj+s482TeyCsNCij/99viFULUItAnXeF5/hjncIitTubZizrG3SdRbv+8ZPUzQ08CAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26ZtuMA0GCSqGSIb3DQEBCwUAA4ICAQBVH1ipvLKoUNAMsdgaaSAnKQisYXVcim74guVpL9X2Vku5uHMQWdMhl37nTHH7stJgrTmoC+oXIVaF8VAOWevO4FnpuskV74adj4SA9uTpkZDcF5tiG0XwZpXSfG/C6jvvH8/L1q4n8amwyK79fX6a+iIE6//Zf+qRKyKxFw6P8oo0W1jY/AHJVLm4JsyKiDOJTC2EPILf7pZXBbosu/fEt8dOO4K+Mcgic3OS0cKApDk5EDMjgkw8n4ayVZgdvimGjCKbnuJrO1c6gnBN3AnHicsKB01s6F2Oye/Oq8e7tStORdZK0CbM5XLKCGqlleMVofek7cksX6X7/6woAi6+13u743F7kBbTB15GU3w3B0KM08SWnNWZtSrglRqASK5MOQfOzEekUpUrurj7rdIzU33lHU1t1aGxx0Jv5kAnNVyjKLcHjeeNM5DnI5/7UJx5bEbVtBWzlm5+mwyWOrhSLT/WW+H7CMKE/iSoo4narGrhGCqxqENhW9Mf3DuNdvIt6I113xczbD1T+3vLQV//3KLQYTjhlrisXYs313XVM8CZEa6dQcFydYS+AkFCX2ckSJTRmye+Bz+5uE+BdFHherftnSPivuDVKAQTPDEDnt16bI/GBxjGf95Hjj8ongQGz6VUNHe97Imb6RdD31vbX/6OHleizUCdfmIi2t4YJwAAAA==request-methodresponse-headHTTP/2 200 OKserver: nginxcontent-length: 1480access-control-allow-origin: *access-control-expose-headers: Next-Page, Content-Type, Alert, Retry-After, Expires, Backoff, Pragma, Last-Modified, ETag, Content-Length, Cache-Controlx-content-type-options: nosniffcontent-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';strict-transport-security: max-age=31536000via: 1.1 googledate: Sun, 21 Jan 2024 16:28:27 GMTlast-modified: Mon, 27 Nov 2023 13:07:04 GMTetag: "1701090424142"content-type: application/jsonage: 0cache-control: public,max-age=3600alt-svc: clearX-Firefox-Spdy: h2original-response-headersserver: nginxcontent-length: 1480access-control-allow-origin: *access-control-expose-headers: Next-Page, Content-Type, Alert, Retry-After, Expires, Backoff, Pragma, Last-Modified, ETag, Content-Length, Cache-Controlx-content-type-options: nosniffcontent-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';strict-transport-security: max-age=31536000via: 1.1 googledate: Sun, 21 Jan 2024 16:28:27 GMTlast-modified: Mon, 27 Nov 2023 13:07:04 GMTetag: "1701090424142"content-type: application/jsonage: 0cache-control: public,max-age=3600alt-svc: clearX-Firefox-Spdy: h2ctidnet-response-time-onstartnet-response-time-onstop" (Indicator: ""finger") in Source: C4A21EA7D7665376DF0D3CBAFA15D36C0D722863 Observed string: "{"version":4,"lastUserContextId":5,"identities":[{"userContextId":1,"public":true,"icon":"fingerprint","color":"blue","l10nID":"userContextPersonal.label","accessKey":"userContextPersonal.accesskey","telemetryId":1},{"userContextId":2,"public":true,"icon":"briefcase","color":"orange","l10nID":"userContextWork.label","accessKey":"userContextWork.accesskey","telemetryId":2},{"userContextId":3,"public":true,"icon":"dollar","color":"green","l10nID":"userContextBanking.label","accessKey":"userContextBanking.accesskey","telemetryId":3},{"userContextId":4,"public":true,"icon":"cart","color":"pink","l10nID":"userContextShopping.label","accessKey":"userContextShopping.accesskey","telemetryId":4},{"userContextId":5,"public":false,"icon":"","color":"","name":"userContextIdInternal.thumbnail","accessKey":""},{"userContextId":4294967295,"public":false,"icon":"","color":"","name":"userContextIdInternal.webextStorageLocal","accessKey":""}]}" (Indicator: ""finger") in Source: containers.json.tmp6b:T7d9,"ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "906035817" "cx": "26" "cy": "25"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "906035817" "cx": "16" "cy": "16"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1526795028" "cx": "562" "cy": "25"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "906035817" "cx": "556" "cy": "101"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1526795028" "cx": "68" "cy": "23"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "906035817" "cx": "562" "cy": "25"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "906035817" "cx": "68" "cy": "23"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2466318801" "cx": "562" "cy": "25"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1526795028" "cx": "26" "cy": "25"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2466318801" "cx": "556" "cy": "101"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2466318801" "cx": "26" "cy": "25"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954620" "cx": "562" "cy": "25"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1526795028" "cx": "556" "cy": "101"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "151064096" "cx": "68" "cy": "23"} "ef815145211a1a34f6e93ff364b83a79.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "151064096" "cx": "26" "cy": "25"}6c:Td4e,"ef815145211a1a34f6e93ff364b83a79.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Mozilla Firefox\*.* (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter Accessible.tlb (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter AccessibleHandler.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter AccessibleMarshal.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-console-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-datetime-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-debug-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-errorhandling-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l1-2-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-file-l2-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-heap-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-interlocked-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-libraryloader-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-localization-l1-2-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-memory-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-namedpipe-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-processenvironment-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-processthreads-l1-1-1.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-profile-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-rtlsupport-l1-1-0.dll (UID: 00000000-00003576) "ef815145211a1a34f6e93ff364b83a79.exe" called "FindNextFileW" with parameter api-ms-win-core-string-l1-1-0.dll (UID: 00000000-00003576)6d:T1069,file/memory contains long string with (Indicator: "aes"; File: "freebl3.dll") file/memory contains long string with (Indicator: "base64"; File: "mozwer.dll") file/memory contains long string with (Indicator: "base64"; File: "osclientcerts.dll") file/memory contains long string with (Indicator: "aes"; File: "mozavutil.dll") file/memory contains long string with (Indicator: "base64"; File: "ipcclientcerts.dll") file/memory contains long string with (Indicator: "aes"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: "base64"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: ".decrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "base64"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "qvzskUrYlYC_1_.js") file/memory contains long string with (Indicator: "aes"; File: "77FB5EE92C576E2505C8C9FF2EC417D7727F401E") file/memory contains long string with (Indicator: "aes256"; File: "77FB5EE92C576E2505C8C9FF2EC417D7727F401E") file/memory contains long string with (Indicator: "aes"; File: "7710D1C340F6DD91AC86D41DC80EF13CD227E5B7") file/memory contains long string with (Indicator: "aes256"; File: "7710D1C340F6DD91AC86D41DC80EF13CD227E5B7") file/memory contains long string with (Indicator: "aes"; File: "0F9C2303D370F3D4096C110E6691CF4262A2F805") file/memory contains long string with (Indicator: "aes"; File: "54649DCC04D753317AADCC341395C70EF623D0B7") file/memory contains long string with (Indicator: "ecdsa"; File: "54649DCC04D753317AADCC341395C70EF623D0B7") file/memory contains long string with (Indicator: "aes"; File: "C4A21EA7D7665376DF0D3CBAFA15D36C0D722863") file/memory contains long string with (Indicator: "aes"; File: "8729AC0972834ABAE8CEE129DEF774E158AA52B1") file/memory contains long string with (Indicator: "ecdsa"; File: "8729AC0972834ABAE8CEE129DEF774E158AA52B1") file/memory contains long string with (Indicator: "aes"; File: "5D41D79B8748CC3863F7CAF355A5EE3D51C55698") file/memory contains long string with (Indicator: "aes"; File: "30F34EAA36BFA2091C6F178ED9BFE29C547FB4F6") file/memory contains long string with (Indicator: "ecdsa"; File: "30F34EAA36BFA2091C6F178ED9BFE29C547FB4F6") file/memory contains long string with (Indicator: "aes"; File: "B6753204778C4B011179D0B4F6685806061D693C") file/memory contains long string with (Indicator: "ecdsa"; File: "B6753204778C4B011179D0B4F6685806061D693C") file/memory contains long string with (Indicator: "aes"; File: "65881BB899403D651394336501D55D31D1847946") file/memory contains long string with (Indicator: "ecdsa"; File: "65881BB899403D651394336501D55D31D1847946") file/memory contains long string with (Indicator: "aes"; File: "75CFD06AE7966E6959A3558B5F8E3B9CD438077E") file/memory contains long string with (Indicator: "ecdsa"; File: "75CFD06AE7966E6959A3558B5F8E3B9CD438077E") file/memory contains long string with (Indicator: "aes"; File: "38FF788A718C79DDC3D1E23EAA975517D9BA3BB0") file/memory contains long string with (Indicator: "ecdsa"; File: "38FF788A718C79DDC3D1E23EAA975517D9BA3BB0") file/memory contains long string with (Indicator: "aes"; File: "A2D956E35E6D316B1B492B03EFA862E903E203F5") file/memory contains long string with (Indicator: "ecdsa"; File: "A2D956E35E6D316B1B492B03EFA862E903E203F5") file/memory contains long string with (Indicator: "aes"; File: "C818D0286B381C87C5AB1A97DED645DB5B218942") file/memory contains long string with (Indicator: "ecdsa"; File: "C818D0286B381C87C5AB1A97DED645DB5B218942") file/memory contains long string with (Indicator: "aes"; File: "7DED54AF67DABAAAC23A7129C81124A055D04AB8") file/memory contains long string with (Indicator: "ecdsa"; File: "7DED54AF67DABAAAC23A7129C81124A055D04AB8") file/memory contains long string with (Indicator: "aes"; File: "F8CBD54DDA10F4286A41EC6A537240712D6C2308") file/memory contains long string with (Indicator: "aes"; File: "254256B27E0C48CF9B80B695F0B3B8CA84610495") file/memory contains long string with (Indicator: "aes"; File: "340A10D652987DF5E54312E31F5C22F6E8DBA574")6e:T731,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp")6f:Tff6,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "UserInfo.dll") Found reference to API "5!!!!!!_initialized!!!!_IO_COUNTERS!!!!_kernel32!!!!+_GetProcessIoCounters!!!!%_GetCurrentProcess!!!!getCounters!!!!'getCounters_Windows!!!!!!getCounters@" (Indicator: "GetCurrentProcess"; File: "scriptCache-new.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "scriptCache-new.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp")70:T941,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")71:T78f,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "UserInfo.dll") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp, 00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003276.00000000.74194.72941000.00000020.mdmp")72:T41b,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "GetProcAddress"; File: "System.dll") file/memory contains long string with (Indicator: "GetProcAddress"; File: "UserInfo.dll") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp, 00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp")73:T112f,Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp")74:T406,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "__vcrt_GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003276.00000000.74194.72941000.00000020.mdmp")75:T76c,Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "GetUserName"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "UserInfo.dll") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003276.00000000.74194.637F1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003276.00000000.74194.637F1000.00000020.mdmp")76:T560,Found string "global-saltpassword-checkVersion" (Indicator: "password"; File: "key3.db") file/memory contains long string with (Indicator: "password"; File: "~DFE71EF4CA962D64B7.TMP") file/memory contains long string with (Indicator: "password"; File: "_5DB1495C-B871-11EE-8DCE-00505691ECAF_.dat") file/memory contains long string with (Indicator: "password"; File: "SSL") file/memory contains long string with (Indicator: "password"; File: "scriptCache-new.bin") Found string "window#openTrustedLinkIn#insecure-passwordtab!relatedToCurrentrEQT5>5" (Indicator: "password"; File: "scriptCache-new.bin") Found string "=PHh`]aHa5!!!!)get _learnMoreStringcyMNeMN!!!!.this;#__learnMoreStringstringscreateBundleechrome://passwordmgr/locale/passwordmgr.properties#GetStringFromName;insecureFieldWarningLearnMorea"WQV5 AV5" (Indicator: "password"; File: "scriptCache-new.bin"), Found string "documentcreateElementspan+generatedPasswordTextline3Textdivline3Klabel-row generated-password-autosaveclassName" (Indicator: "password"; File: "scriptCache-new.bin"), Found string "define3autocomplete-richlistitemrichlistitemextendsUautocomplete-richlistitem-insecure-warningOautocomplete-richlistitem-logins-footerEautocomplete-two-line-richlistitem?autocomplete-login-richlistitemYautocomplete-generated-password-richlistitem ?o.Q" (Indicator: "password"; File: "scriptCache-new.bin")77:T93f,"updater.exe" marked "C:\Program Files\Mozilla Firefox\updating\update.manifest" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\xul.dll.sig.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\xul.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\vcruntime140.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\updater.ini.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\updater.exe.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\tobedeleted\mozC756.tmp" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\uninstall\helper.exe.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\ucrtbase.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\softokn3.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\softokn3.chk.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\removed-files.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\qipcap.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\precomplete.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\plugin-container.exe.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\platform.ini.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\pingsender.exe.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\omni.ja.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\nssdbm3.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\nssdbm3.chk.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\nssckbi.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\nss3.dll.moz-backup" for deletion "updater.exe" marked "C:\Program Files\Mozilla Firefox\msvcp140.dll.moz-backup" for deletion78:T901,"updater.exe" opened "C:\Users\%OSUSER%\AppData\Local\Mozilla\updates\308046B0AF4A39CB\updates\0\update.log" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\firefox.exe.moz-callback" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\updating\update.manifest" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\xul.dll.sig" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\xul.dll" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\vcruntime140.dll" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\updater.ini" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\updater.exe" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\ucrtbase.dll" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\softokn3.dll" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\softokn3.chk" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\removed-files" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\qipcap.dll" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\precomplete" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\plugin-container.exe.sig" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\plugin-container.exe" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\platform.ini" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\pingsender.exe" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\omni.ja" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\nssdbm3.dll" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\nssdbm3.chk" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\nssckbi.dll" with delete access "updater.exe" opened "C:\Program Files\Mozilla Firefox\nss3.dll" with delete access79:T83f,Found string "\Device\HarddiskVolume2\Program Files\Mozilla Firefox\updater.exe" (Indicator: "\Device\"; Source: "00000000-00001816.00000000.69932.00290000.00000004.mdmp, 00000000-00001816.00000001.70562.00290000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe" (Indicator: "\Device\"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\Mozilla Firefox\pingsender.exe" (Indicator: "\Device\"; Source: "00000000-00003276.00000000.74186.00410000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp, 00000000-00003576.00000001.67898.005E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ef815145211a1a34f6e93ff364b83a79.exe" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp, 00000000-00003576.00000001.67898.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp, 00000000-00003576.00000001.67898.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp, 00000000-00003576.00000001.67898.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp, 00000000-00003576.00000001.67898.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp, 00000000-00003576.00000001.67898.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003576.00000000.65977.005E0000.00000004.mdmp, 00000000-00003576.00000001.67898.005E0000.00000004.mdmp")7a:Te68,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "UserInfo.dll") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp")7b:T117d,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "ef815145211a1a34f6e93ff364b83a79.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "EqualSid"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "FreeSid"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "InitializeSid"; File: "UserInfo.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp")7c:T85d,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp, 00000000-00001816.00000001.70562.00390000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002424.00000000.70863.000B0000.00000004.mdmp, 00000000-00002424.00000000.70869.01258000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003276.00000000.74186.0094A000.00000002.mdmp, 00000000-00003276.00000000.74186.63900000.00000002.mdmp, 00000000-00003276.00000000.74186.72951000.00000002.mdmp, 00000000-00003276.00000000.74194.64158000.00000002.mdmp, 00000000-00003276.00000000.74194.68B6A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003276.00000000.74186.63900000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003276.00000000.74194.637F1000.00000020.mdmp")7d:Tf2b,Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "ef815145211a1a34f6e93ff364b83a79.exe") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeMachineAccountPrivilege" (Indicator: "SeMachineAccountPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeSyncAgentPrivilege" (Indicator: "SeSyncAgentPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeIncreaseWorkingSetPrivilege" (Indicator: "SeIncreaseWorkingSetPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeTrustedCredManAccessPrivilege" (Indicator: "SeTrustedCredManAccessPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeRemoteShutdownPrivilege" (Indicator: "SeRemoteShutdownPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeEnableDelegationPrivilege" (Indicator: "SeEnableDelegationPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeRelabelPrivilege" (Indicator: "SeRelabelPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeUndockPrivilege" (Indicator: "SeUndockPrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp") Found reference to API "SeTimeZonePrivilege" (Indicator: "SeTimeZonePrivilege"; Source: "00000000-00001816.00000001.70562.00344000.00000004.mdmp")7e:T33f8,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: ef815145211a1a34f6e93ff364b83a79.exe] Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: nss3.dll] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: nss3.dll] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: nss3.dll] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nss3.dll] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: nss3.dll] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: nss3.dll] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: nss3.dll] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: nss3.dll] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: nss3.dll] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: nss3.dll] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: nss3.dll] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: nss3.dll] Observed import api "SetFileSecurityW" which can "Sets the security of a file or directory object" [Source: helper.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: default-browser-agent.exe] Observed import api "AccessCheck" which can "Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: firefox.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: firefox.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: firefox.exe] Observed import api "CreateRestrictedToken" which can "Creates a new access token that is a restricted version of an existing access token" [Source: firefox.exe] Observed import api "CreateWellKnownSid" which can "Creates a SID for predefined aliases" [Source: firefox.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: firefox.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: firefox.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: firefox.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: firefox.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: firefox.exe] Observed import api "GetKernelObjectSecurity" which can "Retrieves a copy of the security descriptor that protects a kernel object" [Source: firefox.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: firefox.exe] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: firefox.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: firefox.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: firefox.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: firefox.exe] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: firefox.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: firefox.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: firefox.exe] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: firefox.exe] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: firefox.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: firefox.exe] Observed import api "SetKernelObjectSecurity" which can "Sets the security of a kernel object" [Source: firefox.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: firefox.exe] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: firefox.exe] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: firefox.exe] Observed import api "SetTokenInformation" which can "Sets various types of information for a specified access token" [Source: firefox.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: updater.exe] Observed import api "AccessCheck" which can "Determines whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: plugin-container.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: plugin-container.exe] Observed import api "CreateRestrictedToken" which can "Creates a new access token that is a restricted version of an existing access token" [Source: plugin-container.exe] Observed import api "CreateWellKnownSid" which can "Creates a SID for predefined aliases" [Source: plugin-container.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: plugin-container.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: plugin-container.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: plugin-container.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: plugin-container.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: plugin-container.exe] Observed import api "GetKernelObjectSecurity" which can "Retrieves a copy of the security descriptor that protects a kernel object" [Source: plugin-container.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: plugin-container.exe] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: plugin-container.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: plugin-container.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: plugin-container.exe] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: plugin-container.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: plugin-container.exe] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: plugin-container.exe] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: plugin-container.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: plugin-container.exe] Observed import api "SetKernelObjectSecurity" which can "Sets the security of a kernel object" [Source: plugin-container.exe] Observed import api "SetTokenInformation" which can "Sets various types of information for a specified access token" [Source: plugin-container.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: maintenanceservice.exe] Observed import api "CreateWellKnownSid" which can "Creates a SID for predefined aliases" [Source: maintenanceservice.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: maintenanceservice.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: maintenanceservice.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: maintenanceservice.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: maintenanceservice.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: maintenanceservice.exe]7f:T8e4,"ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "ef815145211a1a34f6e93ff364b83a79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "updater.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "maintenanceservice_tmp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "maintenanceservice_tmp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "maintenanceservice_tmp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "maintenanceservice_tmp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "maintenanceservice_tmp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "pingsender.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "")80:T13cb,Dropped file: "scriptCache-new.bin" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\scriptCache-new.bin]- [targetUID: 00000000-00002076] Dropped file: "scriptCache-child-new.bin" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\scriptCache-child-new.bin]- [targetUID: 00000000-00002076] Dropped file: "widevinecdm.dll.lib.tmp" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\gmp-widevinecdm\4.10.1440.19\widevinecdm.dll.lib.tmp]- [targetUID: 00000000-00002076] Dropped file: "urlCache-new.bin" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\urlCache-new.bin]- [targetUID: 00000000-00002076] Dropped file: "widevinecdm.dll.sig.tmp" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\gmp-widevinecdm\4.10.1440.19\widevinecdm.dll.sig.tmp]- [targetUID: 00000000-00002076] Dropped file: "47B9FFF6B425744C883F909E9C8F388FBF4A5C50" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cache2\entries\47B9FFF6B425744C883F909E9C8F388FBF4A5C50]- [targetUID: 00000000-00002076] Dropped file: "3870112724rsegmnoittet-es.sqlite-wal" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal]- [targetUID: 00000000-00002076] Dropped file: "3870112724rsegmnoittet-es.sqlite" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite]- [targetUID: 00000000-00002076] Dropped file: "places.sqlite-wal" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\places.sqlite-wal]- [targetUID: 00000000-00002076] Dropped file: "goog-badbinurl-proto.vlpset" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\safebrowsing-updating\google4\goog-badbinurl-proto.vlpset]- [targetUID: 00000000-00002076] Dropped file: "favicons.sqlite-wal" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\favicons.sqlite-wal]- [targetUID: 00000000-00002076] Dropped file: "cookies.sqlite-wal" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cookies.sqlite-wal]- [targetUID: 00000000-00002076] Dropped file: "cookies.sqlite" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cookies.sqlite]- [targetUID: 00000000-00002076] Dropped file: "30DA536D4A5D56FF0D85DAA6CA4D6E70F41C5F38" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cache2\entries\30DA536D4A5D56FF0D85DAA6CA4D6E70F41C5F38]- [targetUID: 00000000-00002076] Dropped file: "mozstd-trackwhite-digest256.vlpset" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\safebrowsing-updating\mozstd-trackwhite-digest256.vlpset]- [targetUID: 00000000-00002076] Dropped file: "webappsstore.sqlite-wal" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\webappsstore.sqlite-wal]- [targetUID: 00000000-00002076] Dropped file: "goog-malware-proto.vlpset" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\safebrowsing-updating\google4\goog-malware-proto.vlpset]- [targetUID: 00000000-00002076] Dropped file: "C8D2B75A858279502C6F83CD7B6C8FBAC446B9F8" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cache2\entries\C8D2B75A858279502C6F83CD7B6C8FBAC446B9F8]- [targetUID: 00000000-00002076] Dropped file: "4E7D6069F756B079E56F0EE630F1FC2D255606D2" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cache2\entries\4E7D6069F756B079E56F0EE630F1FC2D255606D2]- [targetUID: 00000000-00002076] Dropped file: "goog-unwanted-proto.vlpset" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\safebrowsing-updating\google4\goog-unwanted-proto.vlpset]- [targetUID: 00000000-00002076] Dropped file: "webext.sc.lz4.tmp" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\webext.sc.lz4.tmp]- [targetUID: 00000000-00002076] Dropped file: "1D5C50371315393E551A4F53084E927C85BC2A17" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\cache2\entries\1D5C50371315393E551A4F53084E927C85BC2A17]- [targetUID: 00000000-00002076] Dropped file: "permissions.sqlite" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\permissions.sqlite]- [targetUID: 00000000-00002076] Dropped file: "revocations.txt" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\revocations.txt]- [targetUID: 00000000-00002076] Dropped file: "block-flashsubdoc-digest256.vlpset" - Location: [%LOCALAPPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\safebrowsing-updating\block-flashsubdoc-digest256.vlpset]- [targetUID: 00000000-00002076]81:T5db,"dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "VisualElements_150.png" has type "PNG image data 270 x 270 8-bit/color RGBA non-interlaced" and extension "png" "PrivateBrowsing_150.png" has type "PNG image data 270 x 270 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "VisualElements_70.png" has type "PNG image data 126 x 126 8-bit/color RGBA non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "PrivateBrowsing_70.png" has type "PNG image data 126 x 126 8-bit/color RGBA non-interlaced" and extension "png" "r-bo8CIhM_M_1_.png" has type "PNG image data 171 x 73 8-bit colormap non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "O287_AcFyg4_1_.png" has type "PNG image data 20 x 20 8-bit colormap non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1" and extension "gif"82:T1375,"POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive" with payload::==> "0Q0O0M0K0I0" HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5494 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:27 GMT Last-Modified: Sun 21 Jan 2024 14:55:53 GMT Server: ECAcc (sac/257B) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604140F80611C823161D52F28E78D4638B42CE1C6D9E2180F32....... "POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive" with payload::==> "0Q0O0M0K0I0" HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2871 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:27 GMT Last-Modified: Sun 21 Jan 2024 15:39:36 GMT Server: ECAcc (sac/253F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive" with payload::==> "0Q0O0M0K0I0" HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5587 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:28 GMT Last-Modified: Sun 21 Jan 2024 14:54:21 GMT Server: ECAcc (sac/2528) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive" with payload::==> "0Q0O0M0K0I0" HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6299 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:30 GMT Last-Modified: Sun 21 Jan 2024 14:42:31 GMT Server: ECAcc (sac/2519) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive" with payload::==> "0Q0O0M0K0I0" HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5589 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:30 GMT Last-Modified: Sun 21 Jan 2024 14:54:21 GMT Server: ECAcc (sac/2528) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "POST /gts1c3 HTTP/1.1 Host: ocsp.pki.goog User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive" with payload::==> "0R0P0N0L0J0" HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:43 GMT Cache-Control: public max-age=14400 Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "POST /gts1c3 HTTP/1.1 Host: ocsp.pki.goog User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:72.0) Gecko/20100101 Firefox/72.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive" with payload::==> "0Q0O0M0K0I0" HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Sun 21 Jan 2024 16:27:43 GMT Cache-Control: public max-age=14400 Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......83:T6053,"xul.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\xul.dll]- [targetUID: 00000000-00003008] "xul.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\xul.dll]- [targetUID: 00000000-00003008] "libGLESv2.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\libGLESv2.dll]- [targetUID: 00000000-00003084] "d3dcompiler_47.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\d3dcompiler_47.dll]- [targetUID: 00000000-00003904] "d3dcompiler_47.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\d3dcompiler_47.dll]- [targetUID: 00000000-00003904] "libGLESv2.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\libGLESv2.dll]- [targetUID: 00000000-00003084] "mozavcodec.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\mozavcodec.dll]- [targetUID: 00000000-00003704] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\nss3.dll]- [targetUID: 00000000-00003008] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\nss3.dll]- [targetUID: 00000000-00003008] "mozavcodec.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\mozavcodec.dll]- [targetUID: 00000000-00003704] "helper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\uninstall\helper.exe]- [targetUID: 00000000-00003704] "ucrtbase.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\ucrtbase.dll]- [targetUID: 00000000-00003080] "ucrtbase.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\ucrtbase.dll]- [targetUID: 00000000-00003080] "helper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\Mozilla Firefox\uninstall\helper.exe]- [targetUID: 00000000-00003704] "minidump-analyzer.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\minidump-analyzer.exe]- [targetUID: 00000000-00003704] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\mozglue.dll]- [targetUID: 00000000-00003080] "default-browser-agent.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\default-browser-agent.exe]- [targetUID: 00000000-00003596] "minidump-analyzer.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\minidump-analyzer.exe]- [targetUID: 00000000-00003704] "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\freebl3.dll]- [targetUID: 00000000-00003904] "firefox.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\firefox.exe]- [targetUID: 00000000-00003008] "firefox.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\firefox.exe]- [targetUID: 00000000-00003008] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\msvcp140.dll]- [targetUID: 00000000-00003080] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\msvcp140.dll]- [targetUID: 00000000-00003080] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\mozglue.dll]- [targetUID: 00000000-00003080] "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\freebl3.dll]- [targetUID: 00000000-00003904] "updater.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\updater.exe]- [targetUID: 00000000-00003704] "nssckbi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\nssckbi.dll]- [targetUID: 00000000-00003704] "nssckbi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\nssckbi.dll]- [targetUID: 00000000-00003704] "updater.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updater.exe]- [targetUID: 00000000-00003704] "osclientcerts.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\osclientcerts.dll]- [targetUID: 00000000-00003704] "mozwer.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\mozwer.dll]- [targetUID: 00000000-00003596] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\softokn3.dll]- [targetUID: 00000000-00003904] "plugin-container.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\plugin-container.exe]- [targetUID: 00000000-00003704] "crashreporter.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\crashreporter.exe]- [targetUID: 00000000-00003704] "plugin-container.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\plugin-container.exe]- [targetUID: 00000000-00003704] "maintenanceservice.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\maintenanceservice.exe]- [targetUID: 00000000-00002424] "maintenanceservice.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\maintenanceservice.exe]- [targetUID: 00000000-00002424] "osclientcerts.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\osclientcerts.dll]- [targetUID: 00000000-00003704] "crashreporter.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\crashreporter.exe]- [targetUID: 00000000-00003704] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\softokn3.dll]- [targetUID: 00000000-00003904] "mozavutil.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\mozavutil.dll]- [targetUID: 00000000-00003704] "ipcclientcerts.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\ipcclientcerts.dll]- [targetUID: 00000000-00003596] "maintenanceservice_installer.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\maintenanceservice_installer.exe]- [targetUID: 00000000-00003704] "mozavutil.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\mozavutil.dll]- [targetUID: 00000000-00003704] "maintenanceservice_installer.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"- Location: [%PROGRAMFILES%\Mozilla Firefox\maintenanceservice_installer.exe]- [targetUID: 00000000-00003704] "AccessibleHandler.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\AccessibleHandler.dll]- [targetUID: 00000000-00003704] "breakpadinjector.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\breakpadinjector.dll]- [targetUID: 00000000-00003704] "breakpadinjector.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\breakpadinjector.dll]- [targetUID: 00000000-00003704] "nssdbm3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\nssdbm3.dll]- [targetUID: 00000000-00003704] "clearkey.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\gmp-clearkey\0.1\clearkey.dll]- [targetUID: 00000000-00003704] "clearkey.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll]- [targetUID: 00000000-00003704] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\vcruntime140.dll]- [targetUID: 00000000-00003080] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\vcruntime140.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00003704] "IA2Marshal.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\IA2Marshal.dll]- [targetUID: 00000000-00003704] "pingsender.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\pingsender.exe]- [targetUID: 00000000-00003704] "pingsender.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\pingsender.exe]- [targetUID: 00000000-00003704] "private_browsing.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\private_browsing.exe]- [targetUID: 00000000-00003596] "notificationserver.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\notificationserver.dll]- [targetUID: 00000000-00003596] "CityHash.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsmD02B.tmp\CityHash.dll]- [targetUID: 00000000-00003704] "libEGL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\libEGL.dll]- [targetUID: 00000000-00003084] "libEGL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\libEGL.dll]- [targetUID: 00000000-00003084] "lgpllibs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\lgpllibs.dll]- [targetUID: 00000000-00003008] "lgpllibs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\lgpllibs.dll]- [targetUID: 00000000-00003008] "plugin-hang-ui.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\plugin-hang-ui.exe]- [targetUID: 00000000-00003704] "AccessibleMarshal.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\AccessibleMarshal.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00003080] "AccessibleMarshal.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\AccessibleMarshal.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00003008] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00003008] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00003080] "qipcap.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\qipcap.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00003704] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00003080] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-file-l2-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-file-l1-2-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-file-l2-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00003080] "api-ms-win-core-file-l1-2-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00003080] "qipcap.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\qipcap.dll]- [targetUID: 00000000-00003704] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsmD02B.tmp\System.dll]- [targetUID: 00000000-00003704] "liteFirewallW.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsmD02B.tmp\liteFirewallW.dll]- [targetUID: 00000000-00003704] "widevinecdm.dll.lib.tmp" has type "current ar archive"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\gmp-widevinecdm\4.10.1440.19\widevinecdm.dll.lib.tmp]- [targetUID: 00000000-00002076] "ShellLink.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsmD02B.tmp\ShellLink.dll]- [targetUID: 00000000-00003704] "ServicesHelper.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsmD02B.tmp\ServicesHelper.dll]- [targetUID: 00000000-00003704] "UserInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsmD02B.tmp\UserInfo.dll]- [targetUID: 00000000-00003704] "clearkey.dll.sig" has type "data"- Location: [%PROGRAMFILES%\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig]- [targetUID: 00000000-00003704] "clearkey.dll.sig" has type "data"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\gmp-clearkey\0.1\clearkey.dll.sig]- [targetUID: 00000000-00003704] "xul.dll.sig" has type "data"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\xul.dll.sig]- [targetUID: 00000000-00003704] "xul.dll.sig" has type "data"- Location: [%PROGRAMFILES%\Mozilla Firefox\xul.dll.sig]- [targetUID: 00000000-00003704] "widevinecdm.dll.sig.tmp" has type "data"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\gmp-widevinecdm\4.10.1440.19\widevinecdm.dll.sig.tmp]- [targetUID: 00000000-00002076] "maintenanceservice.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Maintenance Service\maintenanceservice.exe]- [targetUID: 00000000-00002424] "maintenanceservice_tmp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Maintenance Service\maintenanceservice_tmp.exe]- [targetUID: 00000000-00002424] "AccessibleHandler.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\AccessibleHandler.dll]- [targetUID: 00000000-00003704] "nssdbm3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\nssdbm3.dll]- [targetUID: 00000000-00003704] "IA2Marshal.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\IA2Marshal.dll]- [targetUID: 00000000-00003704] "plugin-hang-ui.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PROGRAMFILES%\Mozilla Firefox\updated\plugin-hang-ui.exe]- [targetUID: 00000000-00003704]84:T6b29,"updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\vcruntime140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 12288 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\softokn3.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\qipcap.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\plugin-container.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "updater.exe" wrote 24576 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\osclientcerts.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "updater.exe" wrote 53248 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\nssdbm3.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 45056 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\mozavutil.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 28672 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 24576 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\maintenanceservice.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "updater.exe" wrote 36864 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\libEGL.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\lgpllibs.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\crashreporter.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "updater.exe" wrote 57344 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\breakpadinjector.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 24576 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 28672 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20480 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 4096 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\IA2Marshal.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "updater.exe" wrote 24576 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "updater.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010800 ... "helper.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmD02B.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "helper.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmD02B.tmp\CityHash.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "helper.exe" wrote 9216 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmD02B.tmp\liteFirewallW.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "helper.exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmD02B.tmp\ShellLink.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "helper.exe" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmD02B.tmp\UserInfo.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "helper.exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmD02B.tmp\ServicesHelper.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 27848 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\AccessibleMarshal.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "updater.exe" wrote 18184 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-core-file-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 18184 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-core-file-l2-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20744 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-core-localization-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 18696 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-core-processthreads-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 18696 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-core-synch-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 18696 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-core-timezone-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 19208 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-conio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 22280 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-convert-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 18696 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-environment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20232 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-filesystem-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 19208 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 18696 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-locale-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 28936 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-math-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 26376 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-multibyte-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 19208 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-process-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 22792 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-runtime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 24328 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-stdio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 24328 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 20744 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-time-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 18696 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\api-ms-win-crt-utility-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "updater.exe" wrote 33992 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\lgpllibs.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "updater.exe" wrote 38600 bytes starting with PE header signature to file "C:\Program Files\Mozilla Firefox\updated\libEGL.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ...85:T421,TCP traffic to 142.250.72.142 on port 443 is sent without HTTP header TCP traffic to 157.240.11.35 on port 443 is sent without HTTP header TCP traffic to 142.251.2.84 on port 443 is sent without HTTP header TCP traffic to 192.229.211.108 on port 80 is sent without HTTP header TCP traffic to 142.250.189.163 on port 80 is sent without HTTP header TCP traffic to 157.240.22.25 on port 443 is sent without HTTP header TCP traffic to 157.240.22.35 on port 443 is sent without HTTP header TCP traffic to 142.250.189.234 on port 443 is sent without HTTP header TCP traffic to 142.250.188.3 on port 443 is sent without HTTP header TCP traffic to 142.251.214.131 on port 443 is sent without HTTP header TCP traffic to 142.251.46.238 on port 443 is sent without HTTP header TCP traffic to 142.250.189.196 on port 443 is sent without HTTP header TCP traffic to 34.107.221.82 on port 80 is sent without HTTP header TCP traffic to 142.251.46.227 on port 80 is sent without HTTP header TCP traffic to 142.251.46.170 on port 443 is sent without HTTP header86:T11ca,Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 192.229.211.108 on port 80 (TCP); Domain: "ocsp.digicert.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 96.16.70.151 on port 443 (TCP) Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 23.44.229.238 on port 80 (TCP) Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.250.189.163 on port 80 (TCP); Domain: "ocsp.pki.goog" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.250.189.234 on port 443 (TCP); Domain: "fonts.googleapis.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.250.72.142 on port 443 (TCP); Domain: "www.youtube.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.250.188.3 on port 443 (TCP); Domain: "fonts.gstatic.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 157.240.11.35 on port 443 (TCP); Domain: "www.facebook.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 157.240.22.35 on port 443 (TCP); Domain: "star-mini.c10r.facebook.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 157.240.22.25 on port 443 (TCP); Domain: "static.xx.fbcdn.net" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.251.2.84 on port 443 (TCP); Domain: "accounts.google.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.251.214.131 on port 443 (TCP); Domain: "www.gstatic.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.251.46.238 on port 443 (TCP); Domain: "accounts.youtube.com" Process "%PROGRAMFILES%\Internet Explorer\iexplore.exe" connects to 142.250.189.196 on port 443 (TCP); Domain: "www.google.com" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.107.221.82 on port 80 (TCP); Domain: "prod.detectportal.prod.cloudops.mozgcp.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.149.100.209 on port 443 (TCP); Domain: "prod.remote-settings.prod.webservices.mozgcp.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 157.240.11.35 on port 443 (TCP); Domain: "www.facebook.com" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 44.239.34.181 on port 443 (TCP); Domain: "locprod2-elb-us-west-2.prod.mozaws.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 157.240.22.25 on port 443 (TCP); Domain: "static.xx.fbcdn.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 157.240.22.35 on port 443 (TCP); Domain: "star-mini.c10r.facebook.com" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.160.46.54 on port 443 (TCP) Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.120.208.123 on port 443 (TCP) Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 52.11.178.236 on port 443 (TCP); Domain: "shavar.prod.mozaws.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 192.229.211.108 on port 80 (TCP); Domain: "ocsp.digicert.com" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.160.144.191 on port 443 (TCP); Domain: "prod.content-signature-chains.prod.webservices.mozgcp.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.107.243.93 on port 443 (TCP); Domain: "autopush.prod.mozaws.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.120.158.37 on port 443 (TCP); Domain: "tracking-protection.prod.mozaws.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 35.244.181.201 on port 443 (TCP); Domain: "prod.balrog.prod.cloudops.mozgcp.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 142.250.189.174 on port 443 (TCP); Domain: "youtube-ui.l.google.com" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 142.251.46.170 on port 443 (TCP); Domain: "safebrowsing.googleapis.com" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 142.251.46.227 on port 80 (TCP) Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 172.217.134.137 on port 443 (TCP) Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 173.194.12.134 on port 443 (TCP) Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 34.117.121.53 on port 443 (TCP); Domain: "attachments.prod.remote-settings.prod.webservices.mozgcp.net" Process "%PROGRAMFILES%\Mozilla Firefox\firefox.exe" connects to 18.238.192.17 on port 443 (TCP); Domain: "d228z91au11ukj.cloudfront.net"87:T1ab8,Found string "i3%jazoest=2950&lsd=AVptmD4a0lY&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=082611_45Ws&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data=TRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRST" (Indicator: "login="; File: "~DFE71EF4CA962D64B7.TMP") Found string "TRSTTRSTTRSTTRSTTRSTTRST i3%jazoest=2950&lsd=AVptmD4a0lY&display=&isprivate=&return_sesso i3%TRSTTRSTTRSTTRSTTRSTTRSTTRSTion=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=082611_45Ws&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data=TRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRSTTRST" (Indicator: "login="; File: "_5DB1495C-B871-11EE-8DCE-00505691ECAF_.dat") Found string "POST /login/device-based/regular/login/?login_attempt=1&lwv=100 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: www.facebook.comContent-Length: 391DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: fr=0F6toRQTSbLcVpmVP..BlrUWj.fA.AAA.0.0.BlrUWj.AWU3EQLxF0s; sb=o0WtZdg0Tk9t8F8VW87hP-OZ; _js_datr=o0WtZbeXbiVLsS06MzNObeeLjazoest=2950&lsd=AVptmD4a0lY&display=&isprivate=&return_session=&skip_api_login=&signed_next=&trynum=1&timezone=&lgndim=eyJ3IjoxMjgwLCJoIjo4MDAsImF3IjoxMjgwLCJhaCI6NzYwLCJjIjoyNH0%3D&lgnrnd=082611_45Ws&lgnjs=n&email=&pass=&login=1&prefill_contact_point=&prefill_source=&prefill_type=&first_prefill_source=&first_prefill_type=&had_cp_prefilled=false&had_password_prefilled=false&ab_test_data=" (Indicator: "login="; File: "SSL") Found string "ObjectdefinePropertyAlertsServicewrappedJSObjectvalue9places-browser-init-complete5_placesBrowserInitCompletenotifyObservers=migrateMatchBucketsPrefForUI66?_migrateMatchBucketsPrefForUI66then3add-breaches-sync-handler/_addBreachesSyncHandler)BrowserWindowTrackergetTopWindowwhereToOpenLinkcurrenttab#openTrustedLinkInhref_disposensISearchEngineCureportErrorBrowserSearch/recordSearchInTelemetry" (Indicator: "servers="; File: "scriptCache-new.bin") Found string "!!!!resolve;%_firstWindowLoadedT0Hh`H!5;/ServicesobsaddObserver7notifications-open-settings!final-ui-startupAbrowser-delayed-startup-finished;sessionstore-windows-restored;browser:purge-session-history5quit-application-requested1quit-application-granted?OBSERVE_LASTWINDOW_CLOSE_TOPICSEbrowser-lastwindow-close-requestedAbrowser-lastwindow-close-granted'weave:service:ready+fxaccounts:onverified7fxaccounts:device_connected/fxaccounts:verify_login=fxaccounts:device_disconnected9fxaccounts:commands:open-uriCweave:engine:clients:display-urissession-save)places-init-completeGdistribution-customization-complete)handle-xul-text-link+profile-before-changekeyword-search=browser-search-engine-modified)restart-in-safe-mode#flash-plugin-hang+xpi-signature-changed)sync-ui-state:update9handlersvc-store-initialized)shield-init-complete%ActorManagerParentaddActors" (Indicator: "login="; File: "scriptCache-new.bin") Found string "!!!!BG__dispose!!!!.this!!!!os!!!!ex;1ServicesobsremoveObserver7notifications-open-settings!final-ui-startup;sessionstore-windows-restored;browser:purge-session-history5quit-application-requested1quit-application-granted)restart-in-safe-mode?OBSERVE_LASTWINDOW_CLOSE_TOPICSEbrowser-lastwindow-close-requestedAbrowser-lastwindow-close-granted'weave:service:ready+fxaccounts:onverified7fxaccounts:device_connected/fxaccounts:verify_login=fxaccounts:device_disconnected9fxaccounts:commands:open-uriCweave:engine:clients:display-urissession-save1_bookmarksBackupIdleTime_idleService%removeIdleObserver-_lateTasksIdleObserver1LATE_TASKS_IDLE_TIME_SEC%_gmpInstallManager" (Indicator: "login="; File: "scriptCache-new.bin") Found string "loggerdebugCBackground update check beginningServicesobsnotifyObservers=addons-background-update-startupdateEnabledgetAllAddonsAddonRepository+backgroundUpdateChecknextdonevaluepermissionsAddonManager!PERM_CAN_UPGRADEpushPromise" (Indicator: "servers="; File: "scriptCache-new.bin") Found string "sourceinfowrappedJSObjectpermissionsServicesobsnotifyObservers=webextension-permission-promptProxygetQ@mozilla.org/addons/web-install-prompt;1CcgetServiceCi'amIWebInstallPromptconfirm-installNotifyObservers5addon-install-confirmationA+Q55EQ;Q[[];" (Indicator: "servers="; File: "scriptCache-new.bin") Found string "h`H`TH`5!!!!e;!5browser-window-before-showdomwindowclosed1quit-application-grantedAbrowser-lastwindow-close-granted!quit-application;browser:purge-session-historyQbrowser:purge-session-history-for-domainnsPref:changedidle-daily9clear-origin-attributes-data;channel-on-may-change-process5onBeforeBrowserWindowShownonClosethen#gDebuggingEnabledServicesobsnotifyObservers=NOTIFY_DOMWINDOWCLOSED_HANDLEDsyncShutdown1onQuitApplicationGranted1onLastWindowCloseGranted#onQuitApplication+onPurgeSessionHistory9_notifyOfClosedObjectsChange#onPurgeDomainDataonPrefChangeonIdleDailyJSONparseuserContextId9_forgetTabsWithUserContextId%onMayChangeProcessK9QTQ=Hy=Hy=Hy=Hy+=Hy4=Hy@" (Indicator: "servers="; File: "scriptCache-new.bin") Found string "" (Indicator: "cmd="; File: "scriptCache-new.bin") Found string "" (Indicator: "cmd="; File: "scriptCache-new.bin") Found string "" (Indicator: "cmd="; File: "scriptCache-new.bin") Found string "" (Indicator: "cmd="; File: "scriptCache-new.bin") Found string "" (Indicator: "cmd="; File: "scriptCache-new.bin") Found string "" (Indicator: "cmd="; File: "scriptCache-new.bin") Found string "windowdocumentdocumentElementgetAttribute'ignorecaptiveportalServicesobsnotifyObservers=delayed-captive-portal-handled_cps)recheckCaptivePortal%_waitingForRecheckDatenowaddObserver;captive-portal-check-completerQ5 55" (Indicator: "servers="; File: "scriptCache-new.bin")88:T69e,"maintenanceservice_tmp.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter System" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter taskhost.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter explorer.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter VGAuthService.exe" (UID: 00000000-00002424) "maintenanceservice_tmp.exe" called "Process32NextW with parameter vm3dservice.exe" (UID: 00000000-00002424)89:T97b,file/memory contains long string with (Indicator: "ping"; File: "scriptCache-new.bin") Found string "clientaddBlocker+Waiting for ping task(WQV55" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!e;_logerrorYsubmitExternalPing - Failed to archive ping id.5" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "rejectErrortestQsubmitExternalPing - invalid ping type: Telemetry+getKeyedHistogramByIdKTELEMETRY_INVALID_PING_TYPE_SUBMITTEDadd=Invalid type string submitted." (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!e;_logerrorQaddPendingPing - Failed to archive ping id.5" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!.generator.this!!!!infosnow!!!!pingInfo!!!!ageInDays;!TelemetryStorage'loadPendingPingList_loginfoS_checkPendingPings - pending ping count:" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "return_logtraceo_cancelOutgoingRequests - aborting ping request for id aborterrors_cancelOutgoingRequests - failed to abort request for id clearu" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!.generator!!!!ex;_doPingid_loginfo#sendPings - ping 3 not sent, saving to disksavePing_currentPings" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!e;_logerrorSsendPersistedPings - failed to send ping )5" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "length!TelemetryStorage#MAXIMUM_PING_SIZEerroro_doPing - submitted ping exceeds the size limit, size: CTELEMETRY_PING_SIZE_EXCEEDED_SENDMTELEMETRY_DISCARDED_SEND_PINGS_SIZE_MBMathfloor" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!ex;_logerroropromisePendingPingActivity - ping activity had an error5" (Indicator: "ping"; File: "scriptCache-new.bin") Found string ":PHh`H`[H5;_logtraceepromisePendingPingActivity - Waiting for ping taskArrayfrom)_pendingPingActivitypushSendSchedulerwaitOnSendTaskPromiseall6QQ5" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "returnsavePing_logtraceE_persistCurrentPings - saved ping errorW_persistCurrentPings - failed to save ping" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!e;_logerrorehandleUpdateSuccess - failed to submit update ping" (Indicator: "ping"; File: "scriptCache-new.bin") Found string "!!!!e;_logerrorc_handleUpdateReady - failed to submit update ping" (Indicator: "ping"; File: "scriptCache-new.bin")8a:T68e,"mozavcodec.dll" claimed CRC 2429889 while the actual is CRC 962438 "nss3.dll" claimed CRC 2161664 while the actual is CRC 2429889 "nss3.dll" claimed CRC 2413511 while the actual is CRC 2437637 "mozavcodec.dll" claimed CRC 2117403 while the actual is CRC 2413511 "helper.exe" claimed CRC 1308738 while the actual is CRC 2117403 "ucrtbase.dll" claimed CRC 1204750 while the actual is CRC 1308738 "ucrtbase.dll" claimed CRC 1182336 while the actual is CRC 1185108 "helper.exe" claimed CRC 958781 while the actual is CRC 1182336 "minidump-analyzer.exe" claimed CRC 766098 while the actual is CRC 958781 "mozglue.dll" claimed CRC 765031 while the actual is CRC 766098 "default-browser-agent.exe" claimed CRC 683332 while the actual is CRC 765031 "minidump-analyzer.exe" claimed CRC 705978 while the actual is CRC 683332 "freebl3.dll" claimed CRC 639117 while the actual is CRC 705978 "firefox.exe" claimed CRC 643268 while the actual is CRC 639117 "firefox.exe" claimed CRC 558396 while the actual is CRC 643268 "msvcp140.dll" claimed CRC 458999 while the actual is CRC 558396 "msvcp140.dll" claimed CRC 486012 while the actual is CRC 485136 "mozglue.dll" claimed CRC 504010 while the actual is CRC 486012 "freebl3.dll" claimed CRC 427311 while the actual is CRC 504010 "updater.exe" claimed CRC 397258 while the actual is CRC 427311 "nssckbi.dll" claimed CRC 380454 while the actual is CRC 397258 "nssckbi.dll" claimed CRC 409945 while the actual is CRC 380454 "updater.exe" claimed CRC 403206 while the actual is CRC 380988 "osclientcerts.dll" claimed CRC 360429 while the actual is CRC 403206 "mozwer.dll" claimed CRC 324525 while the actual is CRC 3604298b:T8ec,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread GetSystemDirectoryW ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW FindFirstFileExW CreateFileW VirtualAllocEx GetSystemInfo Process32NextW LockResource GetCommandLineW GetCommandLineA CopyFileExW Process32FirstW GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos GetClipboardData SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto SleepConditionVariableSRW GetFileAttributesA GetTempPathA OutputDebugStringA LoadLibraryExA GetTickCount VirtualProtect GetVersionExA CreateDirectoryA DeleteFileA CreateFileMappingW FindFirstFileA CreateFileMappingA FindNextFileA CreateFileA MapViewOfFile GetModuleHandleA GetFileAttributesExW CreateProcessA GetFileAttributesExA OpenFileMappingA GetThreadContext RegEnumKeyW GetLogicalDrives GetFileSizeEx GetTickCount64 RegDeleteKeyValueW HttpQueryInfoA GetComputerNameA CreateRemoteThread VirtualProtectEx GetNativeSystemInfo NtQueryInformationProcess SetKernelObjectSecurity CreateThreadpoolTimer CreateThreadpoolWait SleepConditionVariableCS CreateThreadpoolWork StartServiceW RegCreateKeyW RegOpenKeyW FindResourceW ChangeServiceConfig2W CreateServiceW StartServiceCtrlDispatcherW ChangeServiceConfigW8c:Tc5c,"ef815145211a1a34f6e93ff364b83a79.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 480) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 480) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 480) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 428) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 428) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 428) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 432) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 432) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 432) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 32 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 728) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 52 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 728) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 4 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 728) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 32 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 684) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 52 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 684) "ef815145211a1a34f6e93ff364b83a79.exe" wrote 4 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 684) "updater.exe" wrote 32 bytes to a remote process "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" (Handle: 128) "updater.exe" wrote 52 bytes to a remote process "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" (Handle: 128) "updater.exe" wrote 4 bytes to a remote process "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" (Handle: 128) "updater.exe" wrote 32 bytes to a remote process "C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe" (Handle: 336) "updater.exe" wrote 52 bytes to a remote process "C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe" (Handle: 336) "updater.exe" wrote 4 bytes to a remote process "C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe" (Handle: 336) "updater.exe" wrote 32 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 340) "updater.exe" wrote 52 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 340) "updater.exe" wrote 4 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 340)8d:T432,"accounts.google.com" with TTL 300 "accounts.youtube.com" with TTL 105 "attachments.prod.remote-settings.prod.webservices.mozgcp.net" with TTL 207 "autopush.prod.mozaws.net" with TTL 31 "connect.facebook.net" with TTL 10 "d228z91au11ukj.cloudfront.net" with TTL 60 "detectportal.firefox.com" with TTL 42 "facebook.com" with TTL 60 "fbcdn.net" with TTL 60 "fbsbx.com" with TTL 60 "fonts.googleapis.com" with TTL 240 "fonts.gstatic.com" with TTL 30 "locprod2-elb-us-west-2.prod.mozaws.net" with TTL 5 "ocsp.pki.goog" with TTL 238 "prod.balrog.prod.cloudops.mozgcp.net" with TTL 33 "prod.content-signature-chains.prod.webservices.mozgcp.net" with TTL 29 "prod.remote-settings.prod.webservices.mozgcp.net" with TTL 223 "safebrowsing.googleapis.com" with TTL 208 "scontent.xx.fbcdn.net" with TTL 60 "shavar.prod.mozaws.net" with TTL 60 "star-mini.c10r.facebook.com" with TTL 60 "tracking-protection.prod.mozaws.net" with TTL 2 "www.google.com" with TTL 29 "www.gstatic.com" with TTL 149 "www.youtube.com" with TTL 6 "youtube-ui.l.google.com" with TTL 2448e:Tde2,"firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20171128222554" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Crash Reports\LASTCRASH" "firefox.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Crash Reports\InstallTime20171128222554" "firefox.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Crash Reports\LASTCRASH" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Crash Reports\INSTALLTIME20200117190643" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\INSTALLS.INI" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\compatibility.ini" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\parent.lock" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\XUL.MFL" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\XPC.MFL" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\scriptCache-child.bin" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\scriptCache.bin" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\startupCache.4.little" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\urlCache.bin" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\webext.sc.lz4" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\STARTUPCACHE.4.LITTLE" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\prefs.js" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\user.js" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\SCRIPTCACHE-CHILD.BIN" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\SCRIPTCACHE-CHILD-CURRENT.BIN" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\SCRIPTCACHE.BIN" "firefox.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\startupCache\SCRIPTCACHE-CURRENT.BIN" "firefox.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\mj0wtyin.default-1692790883487\xulstore.json"8f:T58b,Spawned process "ef815145211a1a34f6e93ff364b83a79.exe" (UID: 00000000-00003576) Spawned process "updater.exe" with commandline "%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0 "%PROGRAMFILES%\\Mozilla Firefox" "%PROGRAMFILES%\\Mozilla Firefox" 3012 C:\\ "%PROGRAMFILES%\\Mozilla Firefox\\firefox.exe" https://www.facebook.com/login" (UID: 00000000-00001816) Spawned process "updater.exe" with commandline "%LOCALAPPDATA%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0 "%PROGRAMFILES%\\Mozilla Firefox" "%PROGRAMFILES%\\Mozilla Firefox" 3080 C:\\ "%PROGRAMFILES%\\Mozilla Firefox\\firefox.exe" https://accounts.google.com" (UID: 00000000-00003840) Spawned process "helper.exe" with commandline "argv0ignored /PostUpdate" (UID: 00000000-00003704) Spawned process "maintenanceservice_tmp.exe" with commandline "dummyparam.exe upgrade" (UID: 00000000-00002424) Spawned process "updater.exe" with commandline "%ALLUSERSPROFILE%\\Mozilla\\updates\\308046B0AF4A39CB\\updates\\0 "%PROGRAMFILES%\\Mozilla Firefox" "%PROGRAMFILES%\\Mozilla Firefox\\updated" -1" (UID: 00000000-00003596) Spawned process "pingsender.exe" with commandline "undefined/submit/telemetry/85896c6f-e8e3-4885-93fe-698c3c54d581/update/Firefox/72.0.2/release/20200117190643?v=4 %APPDATA%\\Mozilla\\Firefox\\Profiles\\mj0wtyin.default-1692790883487\\saved-telemetry-pings\\85896c6f-e8e3-4885-93fe-698c3c54d581" (UID: 00000000-00003276)90:T8c3,""referenceLocator": "https://github.com/actions/virtual-environments"" (Indicator: "github.com") ""name": "github.com/ugorji/go/codec"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/ugorji/go/codec@v1.2.7"" (Indicator: "github.com") ""name": "github.com/go-playground/validator/v10"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/go-playground/validator/v10@v10.10.0"" (Indicator: "github.com") ""name": "github.com/census-instrumentation/opencensus-proto"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/census-instrumentation/opencensus-proto@v0.2.1"" (Indicator: "github.com") ""name": "github.com/leodido/go-urn"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/leodido/go-urn@v1.2.1"" (Indicator: "github.com") ""name": "github.com/gin-contrib/pprof"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/gin-contrib/pprof@v1.4.0"" (Indicator: "github.com") ""name": "github.com/Azure/go-autorest/autorest/azure/cli"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/azure/go-autorest/autorest/azure/cli@v0.3.1"" (Indicator: "github.com") ""name": "github.com/Azure/go-autorest/logger"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/azure/go-autorest/logger@v0.2.1"" (Indicator: "github.com") ""name": "github.com/google/go-cmp"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/google/go-cmp@v0.5.6"" (Indicator: "github.com") ""name": "github.com/Azure/go-autorest/tracing"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/azure/go-autorest/tracing@v0.6.0"" (Indicator: "github.com") ""name": "github.com/envoyproxy/protoc-gen-validate"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v0.1.0"" (Indicator: "github.com") ""name": "github.com/modern-go/reflect2"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/modern-go/reflect2@v1.0.2"" (Indicator: "github.com") ""name": "github.com/stretchr/testify"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/stretchr/testify@v1.7.1"" (Indicator: "github.com")91:Te02,Found reference to API ""supplier": "Organization: Sindre Sorhus (sindresorhus@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Heather Arthur (fayearthur@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Einar Otto Stangvik (einaros@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Brian J. Brennan (brianloveswords@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Craig Spence (craigspence0@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Ernesto Garcia (gnapse@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Alex Reardon (alexreardon@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Titus Wormer (tituswormer@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Roman Shtylman (shtylman@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Jordan Harband (ljharb@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: 'Julian Viereck' (julian.viereck@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Jason Quense (monastic.panic@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Valentin 7rulnik Semirulnik (v7rulnik@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Oleg Slobodskoi (oleg008@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Jens Taylor (jensyt@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Gary Court (gary.court@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Mario Beltrn Alarcn (belco90@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Ariya Hidayat (ariya.hidayat@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Eugene Sharygin (eush77@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: AfterWind (spmushroom@hotmail.com)"" (Indicator: "@hotmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: John-David Dalton (john.david.dalton@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Vladimir Zapparov (dervus.grim@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Lupo Montero (lupomontero@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Thorsten Lorenz (thlorenz@gmx.de)"" (Indicator: "@gmx."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Mikeal Rogers (mikeal.rogers@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json")92:T5ae,Found string "+ncalrpc:[OLEA78D583341FA292F3CA43A579747]" (Indicator: "ncalrpc"; Source: "00000000-00005492.00000000.67218.037E0000.00000004.mdmp, 00000000-00005492.00000001.69137.037E0000.00000004.mdmp") Found string "F+ncalrpc:[OLEC08B58E3102ADAA377F064E7B87F]" (Indicator: "ncalrpc"; Source: "00000000-00005492.00000000.67218.037E0000.00000004.mdmp, 00000000-00005492.00000001.69137.037E0000.00000004.mdmp") Found string "+ncalrpc:[OLE98DB4E786FA682A3F75D262AFA33]" (Indicator: "ncalrpc"; Source: "00000000-00005492.00000000.67218.037E0000.00000004.mdmp, 00000000-00005492.00000001.69137.037E0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005492.00000000.67218.037E0000.00000004.mdmp, 00000000-00005492.00000001.69137.037E0000.00000004.mdmp") Found string "+ncalrpc:[OLEC08B58E3102ADAA377F064E7B87F]" (Indicator: "ncalrpc"; Source: "00000000-00005492.00000000.67218.037E0000.00000004.mdmp, 00000000-00005492.00000001.69137.037E0000.00000004.mdmp") Found string "036-0d22-48aa-ba69-b619480f38cb@ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00005492.00000000.67218.037E0000.00000004.mdmp, 00000000-00005492.00000001.69137.037E0000.00000004.mdmp") Found string "B+ncalrpc:[OLEA78D583341FA292F3CA43A579747]" (Indicator: "ncalrpc"; Source: "00000000-00005492.00000000.67218.037E0000.00000004.mdmp, 00000000-00005492.00000001.69137.037E0000.00000004.mdmp")93:T4001,"initAft()