26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T478,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Symmi.Generic Sample 77759718bf46… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 77759718bf46…. Malware family: Symmi.Generic. Threat score 85/100. 11/25 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/77759718bf4686d4cd5d44f739f1ef98dd7389dec31dbe3f7f03f3ad09729ec9","keywords":["Malicious","Symmi.Generic","malware analysis","sandbox report","threat intelligence","77759718bf4686d4cd5d44f739f1ef98dd7389dec31dbe3f7f03f3ad09729ec9"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"77759718bf4686d4cd5d44f739f1ef98dd7389dec31dbe3f7f03f3ad09729ec9","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Symmi.Generic","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2690,Assembly shows XOR instruction xor dl byte ptr [esp+ecx+04h] in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor edi BE641466h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor ebx 02h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor edi FFEB3C46h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor al E2h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor eax FFEB3C46h in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor byte ptr [ebx] ch in Stream UID: 00000000-00004352-39504-630-012B17E0 Assembly shows XOR instruction xor al byte ptr [edx] in Stream UID: 00000000-00004352-39504-151-012CDF10 Assembly shows XOR instruction xor al DAh in Stream UID: 00000000-00004352-39504-151-012CDF10 Assembly shows XOR instruction xor edx ebp in Stream UID: 00000000-00004352-39504-2141-0129C2EB Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00004352-39504-460-012BAB80 Assembly shows XOR instruction xor edi 000000B6h in Stream UID: 00000000-00004352-39504-460-012BAB80 Assembly shows XOR instruction xor edx 2Fh in Stream UID: 00000000-00004352-39504-199-012CB8A0 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00004352-39504-564-012B57E0 Assembly shows XOR instruction xor edx 4EBD500Bh in Stream UID: 00000000-00004352-39504-564-012B57E0 Assembly shows XOR instruction xor ebx 62h in Stream UID: 00000000-00004352-39504-418-012BBBA0 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00004352-39504-418-012BBBA0 Assembly shows XOR instruction xor byte ptr [ebx+ebp+2BC21101h] bh in Stream UID: 00000000-00004352-39504-418-012BBBA0 Assembly shows XOR instruction xor al C2h in Stream UID: 00000000-00004352-39504-418-012BBBA0 Assembly shows XOR instruction xor ecx dword ptr [012D896Ch] in Stream UID: 00000000-00004352-39504-323-012BE960 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00004352-39504-477-012B9B60 Assembly shows XOR instruction xor edi 438510AEh in Stream UID: 00000000-00004352-39504-477-012B9B60 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00004352-39504-477-012B9B60 Assembly shows XOR instruction xor edx 211CD423h in Stream UID: 00000000-00004352-39504-552-012B5FA0 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00004352-39504-552-012B5FA0 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00004352-39504-552-012B5FA0 Assembly shows XOR instruction xor eax dword ptr [012D5DA4h] in Stream UID: 00000000-00004352-39504-2176-0129C4D7 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00004352-39504-950-0129B6C0 Assembly shows XOR instruction xor eax 000000F4h in Stream UID: 00000000-00004352-39504-950-0129B6C0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00004352-39504-950-0129B6C0 Assembly shows XOR instruction xor cl 35h in Stream UID: 00000000-00004352-39504-950-0129B6C0 Assembly shows XOR instruction xor dword ptr [edx+73h] ebx in Stream UID: 00000000-00004352-39504-950-0129B6C0 Assembly shows XOR instruction xor edx 000000FFh in Stream UID: 00000000-00004352-39504-461-012BAAF0 Assembly shows XOR instruction xor esi 01h in Stream UID: 00000000-00004352-39504-461-012BAAF0 Assembly shows XOR instruction xor ecx 0993E0AFh in Stream UID: 00000000-00004352-39504-1643-012C0B03 Assembly shows XOR instruction xor ecx 7021DDCBh in Stream UID: 00000000-00004352-39504-1643-012C0B03 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00004352-39504-201-012CA2C0 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00004352-39504-201-012CA2C0 Assembly shows XOR instruction xor ecx dword ptr [012D5F64h] in Stream UID: 00000000-00004352-39504-1188-0129CD47 Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00004352-39504-952-0129B2A0 Assembly shows XOR instruction xor bl byte ptr [esp+ecx-000000ABh] in Stream UID: 00000000-00004352-39504-563-012B5880 Assembly shows XOR instruction xor bl 30h in Stream UID: 00000000-00004352-39504-563-012B5880 Assembly shows XOR instruction xor eax 09h in Stream UID: 00000000-00004352-39504-563-012B5880 Assembly shows XOR instruction xor ecx dword ptr [012D5D6Ch] in Stream UID: 00000000-00004352-39504-941-0129C220 Assembly shows XOR instruction xor eax dword ptr [esi+08h] in Stream UID: 00000000-00004352-39504-317-012BEC70 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00004352-39504-939-0129C3C0 Assembly shows XOR instruction xor edx dword ptr [012D5D8Ch] in Stream UID: 00000000-00004352-39504-2177-0129C523 Assembly shows XOR instruction xor esi dword ptr [ebp-2Ch] in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor eax dword ptr [ebp-1Ch] in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor eax 08h in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor esi 12477CDFh in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor edx 12477CDFh in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor edx esi in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor eax 20012B94h in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor byte ptr [ebp-6ACFFED5h] dl in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor byte ptr [ebp-6ACDFED5h] dl in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor byte ptr [ebp+0001012Bh] dl in Stream UID: 00000000-00004352-39504-474-012B9EF0 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00004352-39504-1586-012B9CB0 Assembly shows XOR instruction xor edi 438510AEh in Stream UID: 00000000-00004352-39504-1586-012B9CB0 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00004352-39504-1586-012B9CB0 Assembly shows XOR instruction xor cl byte ptr [esp+eax+00000290h] in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ebx 00000099h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor bl byte ptr [esp+edx+00000290h] in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ebx A0B993EBh in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ecx 00000099h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor cl byte ptr [esp+ebx+00000290h] in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edi 4Ch in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edi FFFFFFFEh in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ecx 02h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ebx esi in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ebx 18h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edx F38814F3h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor esi 01h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edi 01h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edi 02h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor ecx 7Ah in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor al byte ptr [esp+edx+2Ch] in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor dl byte ptr [esp+ecx+2Ch] in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor esi 59h in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor bl byte ptr [esi-61C4FED6h] in Stream UID: 00000000-00004352-39504-790-012AB150 Assembly shows XOR instruction xor eax 55012AD5h in Stream UID: 00000000-00004352-39504-790-012AB15028:T112a,"file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000002b0025001e02000000000000000000006880b30000000000200000000000000000000000d059b500587db300787eb30038b4b5002082b3000000000010f54300000000006cf7430045582477f0751d00feffffff0ce41f7772e11f7764c5ce74d0422077000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c5ce7438b4b50064c5ce7400000000 (UID: 00000000-00004352) "file.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004352) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050fa43000a7ac8760200000025e01f77ccfa430011c8c676340000c058dcffff2404e96f63dc46011800000000000000a4fa4300400000000000000090fa4300000000000000000000000000000000000c00000002000000010143000e40ea74000000000000b300a0bfb500118250fe58dcffff28005e000b0000002061b5000000000000000000c8bcb5000100000098bfb500ecfa4300a3e01f77ffffffff20fb43001d2eb300 (UID: 00000000-00004352) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000050f14300def51f777c56417700000000b0cdb5000000237418001a00d8000000e0000000e000237411000000a812820000008200a81482004558247770691d00feffffff000000002f000000b8f143001100000000008200a8128200b8f14300e73320771634207700574177020000000c02820000008200500182000002000000000000500182005cf34300fcee207714f143002f000000000320775001820014132374382682000000000040000000b8f600001100000000000000000000003829b30050f143000000000040000040c4008200440000447665437269746963 (UID: 00000000-00004352) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a1fd1e773c3dc67600000000683dc676ea8350fe1d2eb3001d2eb300 (UID: 00000000-00004352) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f831f574149001efbcfa4300316c0000c1f7c893c1f70000a402000000000000 (UID: 00000000-00004352) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004352)29:T840,"file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2a:T51c,"file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")2b:Tba0,"file.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004352) "file.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004352)2c:T45ff,"file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00004352) "file.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00004352)2d:Taa5,"file.exe" loaded module "GDI32.DLL" at base 76cb0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76870000 "file.exe" loaded module "USER32.DLL" at base 76770000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 746b0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "file.exe" loaded module "KERNEL32" at base 74e90000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72f10000 "file.exe" loaded module "ADVAPI32.DLL" at base 75a40000 "file.exe" loaded module "NTDLL.DLL" at base 771d0000 "file.exe" loaded module "WINMM.DLL" at base 74230000 "file.exe" loaded module "NTDLL" at base 771d0000 "file.exe" loaded module "KERNEL32.DLL" at base 74e90000 "file.exe" loaded module "SHELL32.DLL" at base 75b20000 "file.exe" loaded module "OLE32.DLL" at base 74d30000 "file.exe" loaded module "OLEAUT32.DLL" at base 75560000 "file.exe" loaded module "CRYPT32.DLL" at base 757e0000 "file.exe" loaded module "WS2_32.DLL" at base 74c50000 "file.exe" loaded module "WINHTTP.DLL" at base 736f0000 "file.exe" loaded module "SHLWAPI.DLL" at base 759e0000 "file.exe" loaded module "SSPICLI.DLL" at base 74a70000 "file.exe" loaded module "CRYPTSP.DLL" at base 72ed0000 "file.exe" loaded module "RPCRT4.DLL" at base 74b60000 "file.exe" loaded module "CREDSSP.DLL" at base 72ec0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73010000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73000000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 72ee0000 "file.exe" loaded module "DNSAPI.DLL" at base 742b0000 "file.exe" loaded module "IPHLPAPI.DLL" at base 741f0000 "file.exe" loaded module "RASADHLP.DLL" at base 72ed0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72e80000 "file.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 71d80000 "file.exe" loaded module "SECUR32.DLL" at base 72e70000 "file.exe" loaded module "NCRYPT.DLL" at base 71d40000 "file.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 71ce0000 "file.exe" loaded module "USERENV.DLL" at base 768d0000 "file.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76bd0000 "file.exe" loaded module "GPAPI.DLL" at base 71cc0000 "file.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76bd0000 "file.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76bd0000 "file.exe" loaded module "CRYPTSP.DLL" at base 71ca0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71c60000 "file.exe" loaded module "CRYPTBASE.DLL" at base 74a600002e:T481,"0c000d00382448737cfb260529e4f672@WS2_32.dll" "0a000b009ca1c57438f02605fca0c574@mswsock.dll" "15001600f2480373b8ed26058a990173@DNSAPI.dll" "100011001849037388ef26058a990173@DNSAPI.dll" "0b000c002c49037364ef26058a990173@DNSAPI.dll" "0b000c003a49037350ed26058a990173@DNSAPI.dll" "1d001e00b4772e7464ec260590712c74@IPHLPAPI.DLL" "1500160098a3c574ecf0260524a3c574@rasadhlp.dll" "1500160080a3c574ecf0260536a3c574@rasadhlp.dll" "1d001e0060a3c574ecf0260548a3c574@rasadhlp.dll" "0a000b000a490373f4f026058a990173@DNSAPI.dll" "07000800484903733ced26058a990173@DNSAPI.dll" "1000110028a4c57444f1260504a4c574@fwpuclnt.dll" "0a000b00742448736cfa260529e4f672@WS2_32.dll" "080009004824487368fa260529e4f672@WS2_32.dll" "0d000e0028244873b8fb260529e4f672@WS2_32.dll" "14001500840da87438f92605dfb0a874@schannel.dll" "0d000e00843bfa725cf32605f850f872@IPHLPAPI.DLL" "0f001000dc3bfa725cf32605f850f872@IPHLPAPI.DLL" "0c000d00243cfa725cf32605f850f872@IPHLPAPI.DLL" "140015006c3cfa725cf32605f850f872@IPHLPAPI.DLL" "0c000d00e03cfa725cf32605f850f872@IPHLPAPI.DLL" "15001600c02efa725cf32605f850f872@ADVAPI32.dll" "0e000f00702ffa725cf32605f850f872@ADVAPI32.dll"2f:T8a2,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: FF:A0:0E:D8:AB:E3:C5:6D:F0:4D:FD:A8:BB:5D:3A:01:7D:C6:DB:C2; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 9B:D0:9B:32:A6:C6:2F:43:E0:34:DD:94:57:A9:D5:FA:D1:0D:3D:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 20:76:A1:22:59:D3:DD:53:3D:33:69:76:AC:DD:48:6A:AE:EA:4A:A4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 34:39:A6:21:57:BE:C9:70:A9:C6:06:22:EF:3D:19:1B:40:B6:8E:04; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: B1:28:84:62:AC:1C:02:07:B8:F9:D7:0E:21:82:54:A8:C9:59:73:95; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: BE:59:78:66:BE:62:AF:55:63:DF:71:F1:C9:7D:A0:2C:57:32:09:9A; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 04:4D:9B:08:10:C4:E2:0F:E1:DB:70:16:07:D9:8A:7A:1F:D2:4F:D1; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: F0:EA:D1:BC:7A:5B:8F:3D:86:B3:B3:14:06:98:75:E7:02:2A:F1:B9; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 5E:19:AB:77:03:0D:1C:A1:75:44:9A:57:F8:63:46:E1:2B:CE:EA:89; see report for more information)30:T53e,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")31:T4bd,"file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "file.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "file.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "file.exe" trying to touch file "C:\FLTLIB.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "file.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "file.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "file.exe" trying to touch file "SICE" "file.exe" trying to touch file "SIWVID" "file.exe" trying to touch file "NTICE" "file.exe" trying to touch file "C:\winmm.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll"32:T568,"file.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to access non-existent file "C:\winmm.dll" "file.exe" trying to access non-existent file "C:\cryptsp.dll" "file.exe" trying to access non-existent file "C:\credssp.dll" "file.exe" trying to access non-existent file "C:\DNSAPI.dll" "file.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "file.exe" trying to access non-existent file "C:\WINNSI.DLL" "file.exe" trying to access non-existent file "C:\rasadhlp.dll" "file.exe" trying to access non-existent file "C:\secur32.dll" "file.exe" trying to access non-existent file "C:\ncrypt.dll" "file.exe" trying to access non-existent file "C:\bcrypt.dll" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\qagentrt.dll" "file.exe" trying to access non-existent file "C:\GPAPI.dll" "file.exe" trying to access non-existent file "C:\CRYPTSP.dll" "file.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL"33:T801,"file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b83c80" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b863d8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b83b20" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b863a0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "bf9cb0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b82bf8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "bf9cb0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "c15ce0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"}34:T371c,Heuristic match: "^9.ne" Heuristic match: "marshal-zhukov.com" Pattern match: "www.sysinternals.com" Heuristic match: "steamcommunity.com" Pattern match: "https://community.cloudflare.steamstatic.com/" Pattern match: "https://steamcommunity.com/workshop/" Pattern match: "https://steamcommunity.com/p" Pattern match: "community.com/linkfilter/?u=http%3a%2f%2fwww.geonames.org" Pattern match: "https://property-imper.sbs/api" Heuristic match: "ntrust.net" Pattern match: "http://o.pki.goog/s/we1/35q0%" Pattern match: "http://i.pki.goog/we1.crt03" Pattern match: "http://c.pki.goog/we1/o1fiiaeftlk.crl0" Pattern match: "http://i.pki.goog/r4.crt0+" Pattern match: "http://c.pki.goog/r/r4.crl0" Pattern match: "http://i.pki.goog/gsr1.crt0-" Pattern match: "http://c.pki.goog/r/gsr1.crl0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0" Pattern match: "crl3.digicert.com/digicertglobalrootca.crl07" Pattern match: "crl4.digicert.com/digicertglobalrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.usertrust.com1" Pattern match: "https://secure.comodo.com/cps0" Pattern match: "crl.comodoca.com/utn-userfirst-hardware.crl06" Pattern match: "crl.comodo.net/utn-userfirst-hardware.crl0q" Pattern match: "http://crt.comodoca.com/utnaddtrustserverca.crt0$" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "www.google.com0" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/cps/omniroot.html0" Pattern match: "www.public-trust.com/cgi-bin/crl/2018/cdp.crl0" Pattern match: "2www.entrust.net/cps" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/domovlatestcrl.crl0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0" Pattern match: "www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0d" Pattern match: "https://www.verisign.com/rpa0" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://ocsp.entrust.net0d" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1+0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Heuristic match: "iq.si" Heuristic match: "_^.ru" Heuristic match: "dl.lr" Heuristic match: "*.marshal-zhukov.com" Pattern match: "https://steamcommunity.com/profiles/76561199724331900" Pattern match: "marshal-zhukov.com/api" Pattern match: "motion-treesz.sbs/api" Pattern match: "https://story-tense-faz.sbs/api" Heuristic match: "arshal-zhukov.com" Pattern match: "disobey-curly.sbs/api" Pattern match: "powerful-avoids.sbs/api" Pattern match: "http://o.pki.goog/s/we1/lci0%" Pattern match: "http://i.pki.goog/we1.crt05" Pattern match: "http://c.pki.goog/we1/btvd66z9uqy.crl0" Pattern match: "http://o.pki.goog/s/we1/bnw0%" Pattern match: "http://c.pki.goog/we1/dpczcgunpbe.crl0" Heuristic match: "rshal-zhukov.com" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1402" Pattern match: "http://o.pki.goog/s/we1/nls0%" Pattern match: "http://c.pki.goog/we1/0b07lkysgu0.crl0" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://o.pki.goog/s/we1/pss0%" Pattern match: "http://i.pki.goog/we1.crt01" Pattern match: "http://c.pki.goog/we1/vrbdoflardo.crl0" Pattern match: "http://o.pki.goog/s/we1/fac0%" Pattern match: "http://c.pki.goog/we1/c9egy9ikpsu.crl0" Pattern match: "http://ocsp.digicert.com0k" Heuristic match: "store.steampowered.com" Pattern match: "www.valvesoftware.com" Heuristic match: "underlords.com" Heuristic match: "support.steampowered.com" Heuristic match: "partner.steampowered.com" Heuristic match: "partner.steamgames.com" Heuristic match: "login.steampowered.com" Heuristic match: "help.steampowered.com" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/sha2-ev-server-g3.crl04" Pattern match: "http://crl4.digicert.com/sha2-ev-server-g3.crl0" Pattern match: "http://ocsp.digicert.com0r" Pattern match: "cacerts.digicert.com/digicertsha2extendedvalidationserverca.crt0" Pattern match: "http://store.steampowered.com/privacy_agreement/" Pattern match: "https://store.steampowered.com/legal/" Pattern match: "http://store.steampowered.com/subscriber_agreement/" Pattern match: "http://store.steampowered.com/account/cookiepreferences/" Heuristic match: "host: marshal-zhukov.com" Pattern match: "https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=i_iupuat8lxn&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/css/skin_1/modalcontent.css?v=wxauslhcldit&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1vaydrxeeyo&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8r9p&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=inizalwvdibb&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=n4_f9jkda7wp&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=ezbg2deumydh&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" Pattern match: "https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" Pattern match: "community.steam-api.com/websocket/" Pattern match: "https://steamcommunity.com/profiles/76561199724331900/badges" Pattern match: "https://steamcommunity.com/profiles/76561199724331900/inventory/" Pattern match: "https://community.cloudflare.steamstatic.com/public/images/skin_1/footerlogo_valve.png?v=1" Pattern match: "https://steam" Pattern match: "https://www.valvesoftware.com/en/contact?contact-person=translation%20team%20feedback" Pattern match: "https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ieg2cbkgfluu&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=1aq3i0yi2lxn&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b7af69.js?v=ykspfdumdfct&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=cjx2-olbm8rg&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=g3utkghh4xld&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=bpfp7zu77ikn&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npjelbnreo6w&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdakocdigbc&l=english&_cdn=cloudflare&load=effects,controls,slider,dragdrop" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=3w_ge11szngf&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gqhvlrk4-jx-&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=qykt4es5mbtn&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=0y-qdz9kefmk&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6qbwi-5-j2s&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/modalcontent.js?v=xfyrwi9zuc4b&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zbxeuexvq0fz&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdmzrdiz&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=igfw_jmulccz&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lzqrarogjr8&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=utrrjicyvmwz&l=english&_cdn=cloudflare" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvqi85mxnrzh&l=english&_cdn=cloudflare" Pattern match: "https://steamcommunity.com/login/home/?goto=profiles%2f76561199724331900" Pattern match: "https://store.steampowered.com/" Pattern match: "https://store.steampowered.com/explore/" Pattern match: "https://steamcommunity.com/my/wishlist/" Pattern match: "https://store.steampowered.com/points/shop/" Pattern match: "https://store.steampowered.com/news/" Pattern match: "https://store.steampowered.com/stats/" Pattern match: "https://steamcommunity.com/" Pattern match: "https://steamcommunity.com/discussions/" Pattern match: "https://steamcommunity.com/market/" Pattern match: "https://steamcommunity.com/?subsection=broadcasts" Pattern match: "https://store.steampowered.com/about/" Pattern match: "https://help.steampowered.com/en/" Pattern match: "https://store.steampowered.com/mobile" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png" Pattern match: "https://store.steampowered.com/privacy_agreement/" Pattern match: "http://www.valvesoftware.com/legal.htm" Pattern match: "https://store.steampowered.com/subscriber_agreement/" Pattern match: "https://store.steampowered.com/steam_refunds/" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png" Pattern match: "https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016" Pattern match: "https://steamcommunity.com/linkfilter/?u=http%3a%2f%2fwww.geonames.org"35:Tdebb,Found URL "https://property-imper.sbs/apiproperty-imper.sbsroperty-imper.sbs\windows\syste:935/egotiateasic" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "https://property-imper.sbs/api.t" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/35q0%http://i.pki.goog/we1.crt03property-imper.sbs*.property-imper.sbs0/0-0+%http://c.pki.goog/we1/o1fiiaeftlk.crl0j<_qrh1u9," - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:tto" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/35q0%http://i.pki.goog/we1.crt03property-imper.sbs*.property-imper.sbs0/0-0+%http://c.pki.goog/we1/o1fiiaeftlk.crl0j<_qrh1u9decd0.!z&r'hm," - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vj" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:1lssquuuquuuquuuquuutls-server-end-point:d,1,0,]ahsmahsm" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:ldapprovopenstore0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcglobalsign" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;ac60addtrust" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0jq:/p1<92a@ef_wp" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9njqrpjq(r(" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com00c0!h.$j>qq1jq07nej-+\lu>gvpob\hzagxr" - Source: "00000000-00004352.00000000.199960.00B30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?mnk't" - Source: "00000000-00004352.00000000.199960.00BD2000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00004352.00000000.199960.00BD2000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00004352.00000000.199960.00BD2000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199724331900powerful-avoids.sbspowerful-avoids.sbs)ohttps://marshal-zhukov.com/apimicrosoft" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "https://motion-treesz.sbs/apioccupy-blushi.sbsstory-tense-faz.sbsstory-tense-faz.sbstory-tense-faz.sbsmarshal-zhukov.comleg-sate-boat.sbshttps://property-imper.sbs/apimotion-treesz.sbsproperty-imper.sbsroperty-imper.sbs\windows\syste:asic" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "https://story-tense-faz.sbs/apidisobey-curly.sbsmotion-treesz.sbsertigna:\0f78b956-909d-45b2-8b8d-2e5e1d522649:\0f78b956-909d-45b2-8b8d-2e5e1d522649467-41trustedoogle" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "https://powerful-avoids.sbs/apimicrosoft" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/lci0%http://i.pki.goog/we1.crt05story-tense-faz.sbs*.story-tense-faz.sbs0/0-0+%http://c.pki.goog/we1/btvd66z9uqy.crl0," - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:endphhtepsche3lssruuukssmlcgojj^" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/bnw0%http://i.pki.goog/we1.crt05powerful-avoids.sbs*.powerful-avoids.sbs0/0-0+%http://c.pki.goog/we1/dpczcgunpbe.crl0(" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:6v" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:tto" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/35q0%http://i.pki.goog/we1.crt03property-imper.sbs*.property-imper.sbs0/0-0+%http://c.pki.goog/we1/o1fiiaeftlk.crl0j<_qrh1u9," - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/35q0%http://i.pki.goog/we1.crt03property-imper.sbs*.property-imper.sbs0/0-0+%http://c.pki.goog/we1/o1fiiaeftlk.crl0j<_qrh1u9decd0.!z&r'hm," - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vj" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:1lssquuutls-server-end-point:d,1,0,]assm2.5.29.15%2.5.29.372.5.29.192.5.29.14" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:ldapprovopenstore0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcglobalsign" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;ac60addtrust" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0jq:/p1<92a@ef_wp" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9njqrpjq(r(" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0>qq1jq07nej-+\lu>gvpob\hzagxr" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?mnk't" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/nls0%http://i.pki.goog/we1.crt03marshal-zhukov.com*.marshal-zhukov.com0/0-0+%http://c.pki.goog/we1/0b07lkysgu0.crl0^o1gtln/," - Source: "00000000-00004352.00000001.200574.00B30000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:)f8kq2p