26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 98:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.NSISDrp Sample 7b024deda9a2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7b024deda9a2…. Malware family: Trojan.NSISDrp. Threat score 100/100. 3/26 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7b024deda9a285ce08cdea266a351c5714ca61e6799cf12aa474ccdf04363a68","keywords":["Malicious","Trojan.NSISDrp","malware analysis","sandbox report","threat intelligence","7b024deda9a285ce08cdea266a351c5714ca61e6799cf12aa474ccdf04363a68"],"about":{"@type":"SoftwareApplication","name":"PPTV(pplive)_forap_1084_9993.exe","applicationCategory":["compressed","7zip"],"identifier":"7b024deda9a285ce08cdea266a351c5714ca61e6799cf12aa474ccdf04363a68","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.NSISDrp","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":12,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d5,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp")28:T541,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")29:T504,"regsvr32.exe" called "LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268636592'}" (UID: 00000000-00002124) "regsvr32.exe" called "LoadResource with parameter {'hModule': '6442450944', 'hResInfo': '6442869608'}" (UID: 00000000-00007680) "regsvr32.exe" called "LoadResource with parameter {'hModule': '6442450944', 'hResInfo': '6442869624'}" (UID: 00000000-00007680) "PPAP.exe" called "LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268879832'}" (UID: 00000000-00003096) "hwcheck.exe" called "LoadResource with parameter {'hModule': '1900609536', 'hResInfo': '1901650976'}" (UID: 00000000-00006328) "hwcheck.exe" called "LoadResource with parameter {'hModule': '1900609536', 'hResInfo': '1901651056'}" (UID: 00000000-00006328) "hwcheck.exe" called "LoadResource with parameter {'hModule': '1900609536', 'hResInfo': '1901650992'}" (UID: 00000000-00006328) "hwcheck.exe" called "LoadResource with parameter {'hModule': '1900609536', 'hResInfo': '1901650960'}" (UID: 00000000-00006328) "hwcheck.exe" called "LoadResource with parameter {'hModule': '1900609536', 'hResInfo': '1901651008'}" (UID: 00000000-00006328) "hwcheck.exe" called "LoadResource with parameter {'hModule': '1900609536', 'hResInfo': '1901651072'}" (UID: 00000000-00006328)2a:T1067,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000600.00000000.309551.03390000.00000004.mdmp"), Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00000600.00000000.309551.03390000.00000004.mdmp"), Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000000.308794.727C1000.00000020.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000000.308794.727C1000.00000020.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001996.00000000.307730.72121000.00000020.mdmp 00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001996.00000000.307730.72121000.00000020.mdmp 00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "IcmpSendEcho2 returned error: %ld" (Indicator: "IcmpSendEcho"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Call to IcmpSendEcho2 failed." (Indicator: "IcmpSendEcho"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "IcmpSendEcho2" (Indicator: "IcmpSendEcho"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")2b:Tb22,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "AP::init LoadLibrary fail" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp 00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp")2c:Tf7e,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "client_ap.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "client_ap.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Troubleshooter.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Troubleshooter.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "ppp.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "ppp.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Live.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Live.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "CommonFuncDll.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "CommonFuncDll.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "PluginInstaller.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "PluginInstaller.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "sop.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "sop.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Converter.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Converter.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "restore.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "restore.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "logclient.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "logclient.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp")2d:Tbdb,"PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#STORAGE#VOLUME#{5781F570-2B3B-11EE-88A5-806E6F6E6963}#0000000007500000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#\PROPERTIES\{4D1EBEE8-0803-4774-9842-B77DB50265E9}\0004") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#STORAGE#VOLUME#{5781F570-2B3B-11EE-88A5-806E6F6E6963}#0000000007500000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#\PROPERTIES\{4D1EBEE8-0803-4774-9842-B77DB50265E9}\0004") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY\SHELLEX\{000214F9-0000-0000-C000-000000000046}") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\{000214F9-0000-0000-C000-000000000046}") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER\SHELLEX\{000214F9-0000-0000-C000-000000000046}") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\{000214F9-0000-0000-C000-000000000046}") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS\SHELLEX\{000214F9-0000-0000-C000-000000000046}") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\SHELLEX\{000214F9-0000-0000-C000-000000000046}") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F0AE1542-F497-484B-A175-A20DB09144BA}\TREATAS")2e:Tb6d,"PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3743663624 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3743670574 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744230597 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744238232 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744386139 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744393059 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744499357 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744505743 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744830375 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3744836749 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3745916650 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3745924163 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3747237226 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3747245921 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3747536748 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3747543339 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3748136874 [PID: 8164] "PPTV_pplive__forap_1084_9993.exe" queried SystemProcessInformation at 00000000-00008164-00000C15-3748143473 [PID: 8164] "SkinConverter.exe" queried SystemProcessInformation at 00000000-00004508-00000C15-3761832492 [PID: 4508] "SkinConverter.exe" queried SystemProcessInformation at 00000000-00004508-00000C15-3761870601 [PID: 4508] "SkinConverter.exe" queried SystemProcessInformation at 00000000-00004508-00000C15-3762336750 [PID: 4508] "SkinConverter.exe" queried SystemProcessInformation at 00000000-00004508-00000C15-3762343147 [PID: 4508] "Rundll32.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-3761866004 [PID: 796] "Rundll32.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-3761888442 [PID: 796] "Rundll32.exe" queried SystemProcessInformation at 00000000-00000796-00000C15-3762252720 [PID: 796]2f:T95a,Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00000600.00000000.309551.03390000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")30:T5de,Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002124-36973-24-00EC3A29 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002124-36973-24-00EC3A29 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002124-36973-24-00EC3A29 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002124-36973-24-00EC3A29 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002124-36973-24-00EC3A29 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002124-36973-41-00EC21BB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002124-36973-41-00EC21BB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002124-36973-42-00EC1F15 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002124-36973-42-00EC1F15 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002124-36973-44-00EC1B5F Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002124-36973-44-00EC1B5F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002124-36973-48-00EC19D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002124-36973-48-00EC19D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002124-36973-49-00EC2044 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002124-36973-49-00EC204431:T18f6,Contains base64 string in header "autostart/forqd1084/bind" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ins.pplive.comConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552" Contains base64 string in header "gzip" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552" Contains base64 string in header "MSIE" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552" Contains base64 string in header "NET4" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552" Contains base64 string in header "InfoPath" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552" Contains base64 string in header "Host" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552" Contains base64 string in header "Keep" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552" Contains base64 string in header "9485F9422DD8P552" in header "GET /config/control.xml HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pp.pplive.comConnection: Keep-AliveCache-Control: no-cacheCookie: _snstyxuid=9485F9422DD8P552"32:Tba27,Found XOR loop in file "peer.dll" at offset 1902850; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2132602; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2275972; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2406992; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2536353; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2537575; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2538161; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2569231; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2579587; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2585611; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2586797; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2587613; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2589201; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2591755; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2592547; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2594145; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2594929; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2597273; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2600257; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2600947; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2603757; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2606647; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2607165; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2611699; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2614493; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2615493; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2618853; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2621037; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2622225; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2625473; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2628017; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 2630139; code bytes = 30d0 Found XOR loop in file "peer.dll" at offset 203406; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1180244; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1180251; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1424010; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1424290; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1424312; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1424384; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1424480; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1424576; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1629311; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1629317; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1629499; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1629505; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632018; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632023; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632045; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632051; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632221; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632226; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632248; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1632254; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1670329; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1670950; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1791245; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1791672; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1792478; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1792899; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 1884169; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 2529483; code bytes = 33c1 Found XOR loop in file "peer.dll" at offset 222616; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 502311; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 806670; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 1055565; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 1714707; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2071418; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2133772; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2146122; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2542322; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2551848; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2556846; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2562358; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2566444; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2567106; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2573512; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2579548; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2582560; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2584774; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2585572; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2590030; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2590896; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2593334; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2594908; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2595718; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2597258; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2598976; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2604196; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2604668; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2606162; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2607636; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2611174; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2623504; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2624770; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2631506; code bytes = 8030 Found XOR loop in file "peer.dll" at offset 2685823; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1718643; code bytes = 30d0 Found XOR loop in file "GdiPlus.dll" at offset 1721013; code bytes = 30d0 Found XOR loop in file "GdiPlus.dll" at offset 1726943; code bytes = 30d0 Found XOR loop in file "GdiPlus.dll" at offset 1733829; code bytes = 30d0 Found XOR loop in file "GdiPlus.dll" at offset 1739295; code bytes = 30d0 Found XOR loop in file "GdiPlus.dll" at offset 35146; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 35755; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 36298; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 85812; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 100815; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 233580; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 338380; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 427519; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 918502; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1032231; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1037736; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1038730; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1109960; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1322266; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1544495; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1544855; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1741415; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 1741421; code bytes = 33c1 Found XOR loop in file "GdiPlus.dll" at offset 36037; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 38946; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 47435; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 534840; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 537438; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1544767; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1544779; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1720974; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1726904; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1739256; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1739422; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1744616; code bytes = 8030 Found XOR loop in file "GdiPlus.dll" at offset 1752959; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 905252; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 907752; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 908156; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 908628; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 970632; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1055707; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1075823; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1080681; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1083159; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1083985; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1084605; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1085665; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1086633; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1087171; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 1092095; code bytes = 30d0 Found XOR loop in file "mir.dll" at offset 166568; code bytes = 33c1 Found XOR loop in file "mir.dll" at offset 196232; code bytes = 33c1 Found XOR loop in file "mir.dll" at offset 684426; code bytes = 33c1 Found XOR loop in file "mir.dll" at offset 685025; code bytes = 33c1 Found XOR loop in file "mir.dll" at offset 798291; code bytes = 33c1 Found XOR loop in file "mir.dll" at offset 1058145; code bytes = 33c1 Found XOR loop in file "mir.dll" at offset 1073273; code bytes = 33c1 Found XOR loop in file "mir.dll" at offset 574147; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 692944; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1062460; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1069056; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1071758; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1075784; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1078274; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1080666; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1083970; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1085654; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1089272; code bytes = 8030 Found XOR loop in file "mir.dll" at offset 1113983; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 29132; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 762593; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 898604; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1002973; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1046465; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1047615; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1048743; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1053401; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1054491; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1055215; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1056095; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1056993; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1057817; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1058635; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1059463; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1060169; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1061347; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1062519; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1065399; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1066645; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1068189; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 1070883; code bytes = 30d0 Found XOR loop in file "VSFilter.dll" at offset 582403; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 583024; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 641354; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 645909; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 830917; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 831365; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 831941; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 832389; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 833221; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 833669; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 834245; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 834693; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 857690; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 863866; code bytes = 33c1 Found XOR loop in file "VSFilter.dll" at offset 776032; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 838268; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 850618; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1039694; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1040772; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1046426; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1047576; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1048704; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1053362; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1054452; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1055200; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1056982; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1058620; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1060794; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1062500; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1066616; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1068160; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1070844; code bytes = 8030 Found XOR loop in file "VSFilter.dll" at offset 1100671; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 146945; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 147332; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 872955; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 903207; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 917885; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 921003; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 922053; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 923721; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 926367; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 928183; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 929459; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 931393; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 932263; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 936107; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 937957; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 943409; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 944451; code bytes = 30d0 Found XOR loop in file "chctrl.dll" at offset 156365; code bytes = 33c1 Found XOR loop in file "chctrl.dll" at offset 156377; code bytes = 33c1 Found XOR loop in file "chctrl.dll" at offset 906039; code bytes = 33c1 Found XOR loop in file "chctrl.dll" at offset 906169; code bytes = 33c1 Found XOR loop in file "chctrl.dll" at offset 915051; code bytes = 33c1 Found XOR loop in file "chctrl.dll" at offset 903198; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 905426; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 910412; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 914604; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 922280; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 926328; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 929420; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 930546; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 939678; code bytes = 8030 Found XOR loop in file "chctrl.dll" at offset 959871; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 74520; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 74736; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 922503; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 926501; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 927009; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 927539; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 928251; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 928843; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 54996; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 55008; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 55361; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 55372; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 914259; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 916543; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 918641; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 919455; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 241047; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 914632; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 920588; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 926486; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 926998; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 928232; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 937343; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 533292; code bytes = 30d0 Found XOR loop in file "tpi.dll" at offset 48193; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 48384; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 404688; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 464125; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 478477; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 488353; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 567685; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 653536; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 666224; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 892942; code bytes = 8030 Found XOR loop in file "tpi.dll" at offset 905017; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 799473; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 849665; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 860923; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 867035; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 868845; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 869719; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 871573; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 872589; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 873501; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 876745; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 880729; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 882315; code bytes = 30d0 Found XOR loop in file "NCList.dll" at offset 463210; code bytes = 33c1 Found XOR loop in file "NCList.dll" at offset 847525; code bytes = 33c1 Found XOR loop in file "NCList.dll" at offset 853967; code bytes = 33c1 Found XOR loop in file "NCList.dll" at offset 856203; code bytes = 33c1 Found XOR loop in file "NCList.dll" at offset 828367; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 828487; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 828687; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 840331; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 840435; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 840503; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 841667; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 849488; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 858498; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 865616; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 866996; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 870588; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 871562; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 872550; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 873462; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 874434; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 875340; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 878360; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 878988; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 882276; code bytes = 8030 Found XOR loop in file "NCList.dll" at offset 895359; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 188857; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 214846; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 862119; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 862305; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 873287; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 875157; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 876075; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 876971; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 878123; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 880525; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 881259; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 881751; code bytes = 30d0 Found XOR loop in file "PPOptions.dll" at offset 477829; code bytes = 33c1 Found XOR loop in file "PPOptions.dll" at offset 155324; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 308091; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 866606; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 868620; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 875136; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 876064; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 876940; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 878110; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 878796; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 879508; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 880038; code bytes = 8030 Found XOR loop in file "PPOptions.dll" at offset 888703; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 137955; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 503921; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 578329; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 762685; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 767907; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 776605; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 777261; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 780507; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 786223; code bytes = 30d0 Found XOR loop in file "uilib.dll" at offset 70915; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 70922; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 94181; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 149484; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 149722; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 306869; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 336523; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 534400; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 538407; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 538855; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 539655; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 540098; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 768467; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 770673; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 771231; code bytes = 33c1 Found XOR loop in file "uilib.dll" at offset 30923; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 30952; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 31320; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 31349; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 31717; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 31746; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 653090; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 786204; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 786684; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 787788; code bytes = 8030 Found XOR loop in file "uilib.dll" at offset 801151; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 314056; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 314073; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 316005; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 316047; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 316258; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 317527; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 317561; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 321840; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 323532; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 625791; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 626717; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 627493; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 629169; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 631011; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 632645; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 635735; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 637089; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 640559; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 642245; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 643947; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 645541; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 649661; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 653567; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 654661; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 656927; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 661059; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 661881; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 663895; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 666031; code bytes = 30d0 Found XOR loop in file "ui.dll" at offset 328645; code bytes = 33c1 Found XOR loop in file "ui.dll" at offset 331061; code bytes = 33c1 Found XOR loop in file "ui.dll" at offset 611423; code bytes = 33c1 Found XOR loop in file "ui.dll" at offset 614127; code bytes = 33c1 Found XOR loop in file "ui.dll" at offset 605555; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 618648; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 625752; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 626678; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 627454; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 629140; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 630972; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 632606; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 634480; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 635696; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 637052; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 642206; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 645502; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 652650; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 653546; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 655904; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 658912; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 661044; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 661866; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 663434; code bytes = 8030 Found XOR loop in file "ui.dll" at offset 694143; code bytes = 8030 Found XOR loop in file "ProductUpdate.dll" at offset 21564; code bytes = 30d0 Found XOR loop in file "ProductUpdate.dll" at offset 520133; code bytes = 30d0 Found XOR loop in file "ProductUpdate.dll" at offset 527155; code bytes = 30d0 Found XOR loop in file "ProductUpdate.dll" at offset 528753; code bytes = 30d0 Found XOR loop in file "ProductUpdate.dll" at offset 528813; code bytes = 30d0 Found XOR loop in file "ProductUpdate.dll" at offset 533535; code bytes = 30d0 Found XOR loop in file "ProductUpdate.dll" at offset 175446; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 224232; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 224851; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 324847; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 387887; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 450927; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 521413; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 523355; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 527211; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 528325; code bytes = 33c1 Found XOR loop in file "ProductUpdate.dll" at offset 519706; code bytes = 8030 Found XOR loop in file "ProductUpdate.dll" at offset 526564; code bytes = 8030 Found XOR loop in file "ProductUpdate.dll" at offset 533112; code bytes = 8030 Found XOR loop in file "ProductUpdate.dll" at offset 536270; code bytes = 8030 Found XOR loop in file "ProductUpdate.dll" at offset 546175; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 375828; code bytes = 30d0 Found XOR loop in file "admodule.dll" at offset 493817; code bytes = 30d0 Found XOR loop in file "admodule.dll" at offset 494625; code bytes = 30d0 Found XOR loop in file "admodule.dll" at offset 495589; code bytes = 30d0 Found XOR loop in file "admodule.dll" at offset 499067; code bytes = 30d0 Found XOR loop in file "admodule.dll" at offset 499659; code bytes = 30d0 Found XOR loop in file "admodule.dll" at offset 51473; code bytes = 33c1 Found XOR loop in file "admodule.dll" at offset 51485; code bytes = 33c1 Found XOR loop in file "admodule.dll" at offset 62452; code bytes = 33c1 Found XOR loop in file "admodule.dll" at offset 62463; code bytes = 33c1 Found XOR loop in file "admodule.dll" at offset 176789; code bytes = 33c1 Found XOR loop in file "admodule.dll" at offset 318527; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 394591; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 464603; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 482656; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 493682; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 494616; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 495578; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 497322; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 499056; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 499640; code bytes = 8030 Found XOR loop in file "admodule.dll" at offset 513407; code bytes = 8030 Found XOR loop in file "omng.dll" at offset 496449; code bytes = 30d0 Found XOR loop in file "omng.dll" at offset 496943; code bytes = 30d0 Found XOR loop in file "omng.dll" at offset 499543; code bytes = 30d0 Found XOR loop in file "omng.dll" at offset 502451; code bytes = 30d0 Found XOR loop in file "omng.dll" at offset 231824; code bytes = 33c1 Found XOR loop in file "omng.dll" at offset 485979; code bytes = 33c1 Found XOR loop in file "omng.dll" at offset 488207; code bytes = 33c1 Found XOR loop in file "omng.dll" at offset 73596; code bytes = 8030 Found XOR loop in file "omng.dll" at offset 494214; code bytes = 8030 Found XOR loop in file "omng.dll" at offset 498574; code bytes = 8030 Found XOR loop in file "omng.dll" at offset 499504; code bytes = 8030 Found XOR loop in file "omng.dll" at offset 502412; code bytes = 8030 Found XOR loop in file "omng.dll" at offset 504382; code bytes = 8030 Found XOR loop in file "omng.dll" at offset 511959; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 77617; code bytes = 30d0 Found XOR loop in file "MngModule.dll" at offset 458791; code bytes = 30d0 Found XOR loop in file "MngModule.dll" at offset 465259; code bytes = 30d0 Found XOR loop in file "MngModule.dll" at offset 468307; code bytes = 30d0 Found XOR loop in file "MngModule.dll" at offset 473699; code bytes = 30d0 Found XOR loop in file "MngModule.dll" at offset 475597; code bytes = 30d0 Found XOR loop in file "MngModule.dll" at offset 478345; code bytes = 30d0 Found XOR loop in file "MngModule.dll" at offset 301205; code bytes = 33c1 Found XOR loop in file "MngModule.dll" at offset 443815; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 445187; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 445287; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 458782; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 469306; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 473084; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 473666; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 475078; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 476780; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 477392; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 478322; code bytes = 8030 Found XOR loop in file "MngModule.dll" at offset 482687; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 199618; code bytes = 30d0 Found XOR loop in file "PPTVSvc.dll" at offset 449085; code bytes = 30d0 Found XOR loop in file "PPTVSvc.dll" at offset 451811; code bytes = 30d0 Found XOR loop in file "PPTVSvc.dll" at offset 458965; code bytes = 30d0 Found XOR loop in file "PPTVSvc.dll" at offset 459779; code bytes = 30d0 Found XOR loop in file "PPTVSvc.dll" at offset 464735; code bytes = 30d0 Found XOR loop in file "PPTVSvc.dll" at offset 59102; code bytes = 33c1 Found XOR loop in file "PPTVSvc.dll" at offset 59721; code bytes = 33c1 Found XOR loop in file "PPTVSvc.dll" at offset 411368; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 447484; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 453606; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 456724; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 458950; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 459764; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 461594; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 464704; code bytes = 8030 Found XOR loop in file "PPTVSvc.dll" at offset 476543; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 456649; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 461219; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 463417; code bytes = 30d0 Found XOR loop in file "mframe.dll" at offset 78725; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 457015; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 460135; code bytes = 33c1 Found XOR loop in file "mframe.dll" at offset 25648; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 458392; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 461180; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 463410; code bytes = 8030 Found XOR loop in file "mframe.dll" at offset 475103; code bytes = 8030 Found XOR loop in file "client_ap.dll" at offset 83766; code bytes = 30d0 Found XOR loop in file "client_ap.dll" at offset 453835; code bytes = 30d0 Found XOR loop in file "client_ap.dll" at offset 455963; code bytes = 30d0 Found XOR loop in file "client_ap.dll" at offset 379565; code bytes = 33c1 Found XOR loop in file "client_ap.dll" at offset 444045; code bytes = 33c1 Found XOR loop in file "client_ap.dll" at offset 148020; code bytes = 8030 Found XOR loop in file "client_ap.dll" at offset 268337; code bytes = 8030 Found XOR loop in file "client_ap.dll" at offset 450270; code bytes = 8030 Found XOR loop in file "client_ap.dll" at offset 455496; code bytes = 8030 Found XOR loop in file "client_ap.dll" at offset 462207; code bytes = 8030 Found XOR loop in file "PPAP.exe" at offset 29638; code bytes = 30d0 Found XOR loop in file "PPAP.exe" at offset 41734; code bytes = 30d0 Found XOR loop in file "PPAP.exe" at offset 451097; code bytes = 30d0 Found XOR loop in file "PPAP.exe" at offset 459647; code bytes = 8030 Found XOR loop in file "PPAP.exe" at offset 460510; code bytes = 8030 Found XOR loop in file "PPLive.exe" at offset 29638; code bytes = 30d0 Found XOR loop in file "PPLive.exe" at offset 41734; code bytes = 30d0 Found XOR loop in file "PPLive.exe" at offset 451097; code bytes = 30d0 Found XOR loop in file "PPLive.exe" at offset 459647; code bytes = 8030 Found XOR loop in file "PPLive.exe" at offset 460510; code bytes = 8030 Found XOR loop in file "PPLiveU.exe" at offset 29638; code bytes = 30d0 Found XOR loop in file "PPLiveU.exe" at offset 41734; code bytes = 30d0 Found XOR loop in file "PPLiveU.exe" at offset 451097; code bytes = 30d0 Found XOR loop in file "PPLiveU.exe" at offset 459647; code bytes = 8030 Found XOR loop in file "PPLiveU.exe" at offset 460510; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 347296; code bytes = 30d0 Found XOR loop in file "PPP.dll" at offset 437515; code bytes = 30d0 Found XOR loop in file "PPP.dll" at offset 439127; code bytes = 30d0 Found XOR loop in file "PPP.dll" at offset 440933; code bytes = 30d0 Found XOR loop in file "PPP.dll" at offset 442565; code bytes = 30d0 Found XOR loop in file "PPP.dll" at offset 443389; code bytes = 30d0 Found XOR loop in file "PPP.dll" at offset 444211; code bytes = 30d0 Found XOR loop in file "PPP.dll" at offset 272388; code bytes = 33c1 Found XOR loop in file "PPP.dll" at offset 273860; code bytes = 33c1 Found XOR loop in file "PPP.dll" at offset 424237; code bytes = 33c1 Found XOR loop in file "PPP.dll" at offset 427335; code bytes = 33c1 Found XOR loop in file "PPP.dll" at offset 431917; code bytes = 33c1 Found XOR loop in file "PPP.dll" at offset 432707; code bytes = 33c1 Found XOR loop in file "PPP.dll" at offset 435409; code bytes = 33c1 Found XOR loop in file "PPP.dll" at offset 43619; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 56891; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 262359; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 361071; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 409491; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 430068; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 437476; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 442546; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 443370; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 444192; code bytes = 8030 Found XOR loop in file "PPP.dll" at offset 453503; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 440295; code bytes = 30d0 Found XOR loop in file "PPFrame.dll" at offset 292737; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 294203; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 294564; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 294777; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 295197; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 295707; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 313400; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 430169; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 431857; code bytes = 33c1 Found XOR loop in file "PPFrame.dll" at offset 198315; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 289657; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 289681; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 363308; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 363344; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 373480; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 418231; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 424067; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 424167; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 429938; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 430628; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 436844; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 439016; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 440282; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 440858; code bytes = 8030 Found XOR loop in file "PPFrame.dll" at offset 448895; code bytes = 8030 Found XOR loop in file "kindling.dll" at offset 267216; code bytes = 30d0 Found XOR loop in file "kindling.dll" at offset 309316; code bytes = 30d0 Found XOR loop in file "kindling.dll" at offset 377712; code bytes = 30d0 Found XOR loop in file "kindling.dll" at offset 101811; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 133578; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 133618; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 189801; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 190691; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 191464; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 195538; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 196698; code bytes = 33c1 Found XOR loop in file "kindling.dll" at offset 114819; code bytes = 8030 Found XOR loop in file "kindling.dll" at offset 428415; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 393583; code bytes = 30d0 Found XOR loop in file "PPVodDownload.dll" at offset 400667; code bytes = 30d0 Found XOR loop in file "PPVodDownload.dll" at offset 401567; code bytes = 30d0 Found XOR loop in file "PPVodDownload.dll" at offset 404617; code bytes = 30d0 Found XOR loop in file "PPVodDownload.dll" at offset 407719; code bytes = 30d0 Found XOR loop in file "PPVodDownload.dll" at offset 410039; code bytes = 30d0 Found XOR loop in file "PPVodDownload.dll" at offset 411743; code bytes = 30d0 Found XOR loop in file "PPVodDownload.dll" at offset 204974; code bytes = 33c1 Found XOR loop in file "PPVodDownload.dll" at offset 391143; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 391279; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 404582; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 407708; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 408482; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 409252; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 410020; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 412262; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 413640; code bytes = 8030 Found XOR loop in file "PPVodDownload.dll" at offset 419711; code bytes = 803033:T84b,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "PPTV(pplive)_forap_1084_9993.exe"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "tpi.dll"), file/memory contains long string with (Indicator: "GetLastInputInfo"; File: "client_ap.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "PPAP.exe"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "PPLive.exe"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "PPLiveU.exe"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "uninst.exe"), file/memory contains long string with (Indicator: "GetCursorPos"; File: "crashreporter.exe"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "h264_dec_filter.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "PPTVLauncher.exe"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "CommonFuncDll.dll"), file/memory contains long string with (Indicator: "GetCursorPos"; File: "IEBrowser.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "atl100.dll"), file/memory contains long string with (Indicator: "GetCursorPos"; File: "ppopt.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "pnsis.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "gtapi_signed.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "firewall.exe"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "ckdll.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "GetCommentsInfoDll.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "cknsis.dll"), file/memory contains long string with (Indicator: "GetLastInputInfo"; File: "restore.dll"), file/memory contains long string with (Indicator: "GetCommandLine"; File: "BindDLL.dll")34:T806,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp"), Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp")35:T98f,Found system information discovery API: "ExpandEnvironmentStringsA" in file "PPTV(pplive)_forap_1084_9993.exe" Found system information discovery API: "GetNativeSystemInfo (in long string)" in file "GetVersion.dll" Found system information discovery API: "GetMonitorInfoW" in "00000000-00000600.00000000.309551.03390000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00000600.00000000.309551.03390000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001080.00000000.308794.1004E000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001080.00000000.308794.1018F000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00001080.00000001.308933.72701000.00000020.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00001080.00000001.308933.72701000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001080.00000001.308933.72701000.00000020.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001996.00000000.307730.00405000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001996.00000000.307730.00405000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001996.00000001.309653.715D8000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"36:T8b9,Found reference to API "-postmessagerate" (Indicator: "postmessage"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "PPTV(pplive)_forap_1084_9993.exe"), file/memory contains long string with (Indicator: "sendmessage"; File: "uninst.exe"), file/memory contains long string with (Indicator: "sendmessage"; File: "Troubleshooter.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "crashreporter.exe"), file/memory contains long string with (Indicator: "sendmessage"; File: "pplugin2.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "ppp.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "PPTVLauncher.exe"), file/memory contains long string with (Indicator: "sendmessage"; File: "CommonFuncDll.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "IEBrowser.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "atl100.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "hwcheck.exe"), file/memory contains long string with (Indicator: "sendmessage"; File: "npplugin2.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "PluginInstaller.exe"), file/memory contains long string with (Indicator: "sendmessage"; File: "sop.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "Converter.dll"), file/memory contains long string with (Indicator: "postmessage"; File: "ppopt.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "Gallop.dll"), file/memory contains long string with (Indicator: "postmessage"; File: "gtapi_signed.dll"), file/memory contains long string with (Indicator: "sendmessage"; File: "firewall.exe"), file/memory contains long string with (Indicator: "postmessage"; File: "Loader.exe")37:T7a2,"PPTV_pplive__forap_1084_9993.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164)38:T1d17,"PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000006c611177cc56ba72f8010000000000006c611177cc56ba72f8010000000000000000000000000000f8e419001b80080080e519005806000020ec1900180000002da6c0def8010000000000009f57ba72e8e41900f801000000000000000000006c611177cc56ba72 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000e51900a3253d74d0e519005806000070ec19001800000028ec1900000000004cec19009debbb72f8010000d0e519005806000070ec19006c611177cc56ba72f8010000000000000000000000000000d8e619001b80080060e719005806000000ee1900180000000da4c0def8010000000000009f57ba7200000000f8010000 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006e00140000003f005c0170026e004c006e0038b2760028b37600acf21900b0e811779cffc599feffffff14f119006dfc1277d820c7eea0ef1900002c7a0098f11900b0e81177bce1c599feffffff04f119003170c67602100000000000000000000000100000000000000000000001000000e0ccc6763cf11900d820c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c00200000001500040038b27600d8b47600b1ca0e77d8b4760000000000280000000000000000006e00d820c7eea0ef1900d076780098f11900b0e81177bce1c599feffffff04f119003170c67602100000000000000000000000100000000000000000000001000000e0ccc6763cf11900d820c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c611177cc56ba72f801000000000000000000000000000010e319001b80080098e319005806000038ea19001800000045a0c0def8010000000000009f57ba7201000000f801000000000000000000006c611177 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c00200000000a00280038b27600f8b87600b1ca0e77f8b8760000000000280000000000000000006e00d820c7eea0ef190008857b0098f11900b0e81177bce1c599feffffff04f119003170c67602100000000000000000000000100000000000000000000001000000e0ccc6763cf11900d820c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c00200000000a00230038b27600e8b97600b1ca0e77e8b9760000000000280000000000000000006e00d820c7eea0ef190008857b0098f11900b0e81177bce1c599feffffff04f119003170c67602100000000000000000000000100000000000000000000001000000e0ccc6763cf11900d820c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c00200000000c000a0038b27600f8b57600b1ca0e77f8b5760000000000280000000000000000006e00b822c7ee80f11900d8817b0078f31900b0e81177bce1c599feffffffe4f219003170c67602100000000000000000000000100000000000000000000001000000e0ccc6761cf31900b822c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c00200000000c00050060da7c0080de7c00b1ca0e7780de7c0000000000280000000000000000006e00b822c7ee80f11900b0987b0078f31900b0e81177bce1c599feffffffe4f219003170c67602100000000000000000000000100000000000000000000001000000e0ccc6761cf31900b822c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c00200000000c00080060da7c0010dc7c00b1ca0e7710dc7c0000000000280000000000000000006e00b822c7ee80f11900589b7b0078f31900b0e81177bce1c599feffffffe4f219003170c67602100000000000000000000000100000000000000000000001000000e0ccc6761cf31900b822c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c00200000000c00150060da7c0010dc7c00b1ca0e7710dc7c0000000000280000000000000000006e00b822c7ee80f1190060937b0078f31900b0e81177bce1c599feffffffe4f219003170c67602100000000000000000000000100000000000000000000001000000e0ccc6761cf31900b822c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c002000000019000c00e880a807f885a807b1ca0e77f885a80700000000280000000000000000006e00b822c7ee80f11900c00faa0778f31900b0e81177bce1c599feffffffe4f219003170c67602100000000000000000000000100000000000000000000001000000e0ccc6761cf31900b822c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000003f003f005c002000000019001c00e880a807e886a807b1ca0e77e886a80700000000280000000000000000006e00b822c7ee80f11900380faa0778f31900b0e81177bce1c599feffffffe4f219003170c67602100000000000000000000000100000000000000000000001000000e0ccc6761cf31900b822c7ee (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164) "firewall.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002792) "hwcheck.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006328) "RepairSetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000915c790a80fd19000000000064ff1900b0e8117795937b7dfeffffffe4fe19003170c676031000000000000000000000001000000000000000000000000000000206000074ff1900915c790a (UID: 00000000-00001996) "RepairSetup.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000007470000004700000000000000000000000000c0564c000000000000000000c8e619000200000010000000c0014700000000000200000000004700010000000800000000004c00ac0b470000000000a80b470098ed1900feba0e770800000000000000080000006b760636dcef1900da91a87200004c000800000001000000 (UID: 00000000-00001996)39:T417,"PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name TrustedInstaller (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name Administrators (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name Users (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name CREATOR OWNER (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name ALL APPLICATION PACKAGES (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name ALL RESTRICTED APPLICATION PACKAGES (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LookupAccountSidW" with param Name Everyone (UID: 00000000-00008164)3a:Tab3,Found string "select * from Win32_OperatingSystem" (Indicator: "select * from "; File: "00000000-00006060.00000000.308879.00E71000.00000020.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00006328-0000271A-3788471289") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found string "SELECT * FROM PushConfig WHERE TaskID=%d;" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found string "select * from UserMap order by TextField0 DESC" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found string "SELECT * FROM MngModuleConfig" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "SELECT * FROM Win32_BaseBoard WHERE (SerialNumber IS NOT NULL)" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "SELECT * FROM Win32_PhysicalMedia WHERE (SerialNumber IS NOT NULL)" (Indicator: "select * from "; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" (Indicator: "select * from "; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found string "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0" (Indicator: "select * from "; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found string "SELECT * FROM Win32_BaseBoard WHERE (SerialNumber IS NOT NULL)" (Indicator: "select * from "; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found string "SELECT * FROM Win32_PhysicalMedia WHERE (SerialNumber IS NOT NULL)" (Indicator: "select * from "; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp")3b:T5ac,file/memory contains long string with (Indicator: "GetLocalTime"; File: "time.dll") file/memory contains long string with (Indicator: "GetSystemTime"; File: "time.dll") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000000.308794.727C1000.00000020.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001996.00000000.307730.72121000.00000020.mdmp, 00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp")3c:T598,"PPTV_pplive__forap_1084_9993.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "PPTV_pplive__forap_1084_9993.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "regsvr32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SkinConverter.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "firewall.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "firewall.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "PPAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hwcheck.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "hwcheck.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "RepairSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "netsh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3d:T774,file/memory contains long string with (Indicator: "FileTimeToLocalFileTime"; File: "time.dll") file/memory contains long string with (Indicator: "FileTimeToSystemTime"; File: "time.dll") file/memory contains long string with (Indicator: "SystemTimeToFileTime"; File: "time.dll") file/memory contains long string with (Indicator: "GetFileTime"; File: "time.dll") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000000.308794.727C1000.00000020.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001996.00000000.307730.72121000.00000020.mdmp, 00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp")3e:T5ac,file/memory contains long string with (Indicator: "GetLocalTime"; File: "time.dll") file/memory contains long string with (Indicator: "GetSystemTime"; File: "time.dll") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000000.308794.727C1000.00000020.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001996.00000000.307730.72121000.00000020.mdmp, 00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp")3f:T4ea,Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")40:T919,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "PPTV(pplive)_forap_1084_9993.exe"), file/memory contains long string with (Indicator: "GetVersionExA"; File: "GetVersion.dll"), file/memory contains long string with (Indicator: "GetVersion"; File: "GetVersion.dll"), Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "AtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp"), Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp 00000000-00001996.00000001.309653.1018F000.00000002.mdmp"), Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp 00000000-00001996.00000001.309653.1018F000.00000002.mdmp"), Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp")41:T490,Possible dll side loading: %PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\PLAYER\VSFILTER.DLL %PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\PLAYER\H264_DEC_FILTER.DLL %TEMP%\NSLDD05.TMP\GETCOMMENTSINFODLL.DLL %TEMP%\NSLDD05.TMP\BINDDLL.DLL %WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL %TEMP%\NSLDD05.TMP\CKNSIS.DLL %PROGRAMFILES%\(X86)\INTERNET EXPLORER\PPLITE\PLUGIN\1.0.1.1058\PPLUGIN2.DLL %WINDIR%\SYSTEM32\KINDLING.DLL %TEMP%\NSLDD05.TMP\PPBINDDAC.DLL %TEMP%\NSLDD05.TMP\GETVERSION.DLL %TEMP%\NSLDD05.TMP\INETLOAD.DLL %TEMP%\NSLDD05.TMP\FINDPROCDLL.DLL %PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\TROUBLESHOOTER.DLL %TEMP%\NSN533E.TMP\SYSTEM.DLL %PROGRAMFILES%\(X86)\COMMON FILES\PPLIVENETWORK\1.0.1.1058\UILIB.DLL %TEMP%\NSLDD05.TMP\PPINSTALLLOG.DLL %TEMP%\NSLDD05.TMP\SYSTEM.DLL %TEMP%\NSLDD05.TMP\COMMONFUNCDLL.DLL %TEMP%\NSLDD05.TMP\PNSIS.DLL %TEMP%\NSN533E.TMP\NSEXEC.DLL %TEMP%\NSLDD05.TMP\TIME.DLL %TEMP%\NSLDD05.TMP\KILLPROCDLL.DLL %PROGRAMFILES%\(X86)\COMMON FILES\PPLIVENETWORK\1.0.1.1058\MNGMODULE.DLL %TEMP%\NSLDD05.TMP\ASYNDOWNLOAD.DLL %WINDIR%\SYSWOW64\PPTVSVC.DLL42:Tf74,"PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3769193415 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3769769689 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770082595 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770532785 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770568649 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770599515 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770624918 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3772507145 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\std_dlg_bkclip.bmp" at 00000000-00004508-00000C17-3762532537 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\std_mainframe_top.bmp" at 00000000-00004508-00000C17-3762564124 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\std_dlg_hl_l.png" at 00000000-00004508-00000C17-3762567659 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\std_dlg_hl_r.png" at 00000000-00004508-00000C17-3762582478 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\mainframe\tabBox_down.png" at 00000000-00004508-00000C17-3762587177 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\mainframe\logo.png" at 00000000-00004508-00000C17-3762593843 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\search\edit_search_normal.png" at 00000000-00004508-00000C17-3762598605 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\search\button_search_normal.png" at 00000000-00004508-00000C17-3762603448 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\watchlog\watchRecord_normal.png" at 00000000-00004508-00000C17-3762608989 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\mainframe\shift2old_normal.png" at 00000000-00004508-00000C17-3762616020 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\mainframe\titilebar_sep.png" at 00000000-00004508-00000C17-3762621465 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\default2\mainframe\faq.png" at 00000000-00004508-00000C17-3762625713 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\std_dlg_min.png" at 00000000-00004508-00000C17-3762630096 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\std_dlg_max.png" at 00000000-00004508-00000C17-3762634412 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\std_dlg_close.png" at 00000000-00004508-00000C17-3762640469 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\stdDlg\resize_gripper.png" at 00000000-00004508-00000C17-3762644952 "SkinConverter.exe" queries volume information of "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\skins\common\dlg\nav_status_r.bmp" at 00000000-00004508-00000C17-376265107043:T5a2,"PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3769193415 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3769769689 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770082595 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770532785 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770568649 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770599515 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3770624918 "PPTV_pplive__forap_1084_9993.exe" queries volume information of "C:\" at 00000000-00008164-00000C17-3772507145 "netsh.exe" queries volume information of "C:\" at 00000000-00006064-00000C17-3778725791 "netsh.exe" queries volume information of "C:\" at 00000000-00003752-00000C17-3781168703 "netsh.exe" queries volume information of "C:\" at 00000000-00003336-00000C17-3786184815 "netsh.exe" queries volume information of "C:\" at 00000000-00006060-00000C17-3791359146 "netsh.exe" queries volume information of "C:\" at 00000000-00003832-00000C17-3797301289 "netsh.exe" queries volume information of "C:\" at 00000000-00000600-00000C17-380230628544:T431,file/memory contains long string(File: "tpi.dll") file/memory contains long string(File: "client_ap.dll") file/memory contains long string(File: "PPAP.exe") file/memory contains long string(File: "PPLive.exe") file/memory contains long string(File: "PPLiveU.exe") file/memory contains long string(File: "crashreporter.exe") file/memory contains long string(File: "h264_dec_filter.dll") file/memory contains long string(File: "PPTVLauncher.exe") file/memory contains long string(File: "CommonFuncDll.dll") file/memory contains long string(File: "atl100.dll") file/memory contains long string(File: "ppopt.dll") file/memory contains long string(File: "pnsis.dll") file/memory contains long string(File: "gtapi_signed.dll") file/memory contains long string(File: "ckdll.dll") file/memory contains long string(File: "GetCommentsInfoDll.dll") file/memory contains long string(File: "cknsis.dll") file/memory contains long string(File: "BindDLL.dll") file/memory contains long string(File: "RepairSetup.exe") file/memory contains long string(File: "nsExec.dll")45:T5d3,"PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %TEMP%\nslDD05.tmp (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %TEMP%\nslDD05.tmp\Favorites (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86) (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\PPLive (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\PPLive\PPTV (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\Common Files (UID: 00000000-00008164)46:Tcc3,"PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter "regsvr32 /s "%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%WINDIR%\SysWOW64\Rundll32.exe" "%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -i" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%WINDIR%\SysWOW64\Rundll32.exe" "%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -start" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%WINDIR%\system32\regsvr32.exe" /s %WINDIR%\system32\kindling.dll" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%TEMP%\nslDD05.tmp\firewall.exe" /PPTVPATH=C:\Program Files (x86)\PPLive\PPTV /PPTVVERSION=3.1.5.0065" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe" -s -luminanceonly "%TEMP%\hwcheck.mp4"" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" -codec" - (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 /I /L 0 /M 0 /N 0 /O 1 /P" - (UID: 00000000-00008164) "firewall.exe" called "CreateProcessA" with parameter "netsh firewall add allowedprogram "%PROGRAMFILES%\(x86)\PPLive\PPTV\PPLive.exe" PPLive Enable" - (UID: 00000000-00002792) "firewall.exe" called "CreateProcessA" with parameter "netsh firewall add allowedprogram "%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" PPLiveU Enable" - (UID: 00000000-00002792) "firewall.exe" called "CreateProcessA" with parameter "netsh firewall add allowedprogram "%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" RepairSetup.exe Enable" - (UID: 00000000-00002792) "firewall.exe" called "CreateProcessA" with parameter "netsh firewall add allowedprogram "%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\CrashReporter.exe" CrashReporter.exe Enable" - (UID: 00000000-00002792) "firewall.exe" called "CreateProcessA" with parameter "netsh firewall add allowedprogram "%WINDIR%\system32\PPTVLauncher.exe" PPTVLauncher Enable" - (UID: 00000000-00002792) "firewall.exe" called "CreateProcessA" with parameter "netsh firewall add allowedprogram "%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\PPAP.exe" PPLive Enable" - (UID: 00000000-00002792) "hwcheck.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?sa2foJ" - (UID: 00000000-00006328)47:T3f73,"PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\System.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\FindProcDLL.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\KillProcDLL.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\InetLoad.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\PPInstallLog.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\time.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\GetCommentsInfoDll.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\cknsis.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\AsynDownload.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\CommonFuncDll.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\pnsis.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\BindDLL.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter shell32 (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter SHELL32.DLL (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\GetVersion.dll (UID: 00000000-00008164) "PPTV_pplive__forap_1084_9993.exe" called "LoadLibrary" with a parameter %TEMP%\nslDD05.tmp\PPBindDAC.dll (UID: 00000000-00008164) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002124) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002124) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002124) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002124) "regsvr32.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll (UID: 00000000-00002124) "SkinConverter.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004508) "SkinConverter.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004508) "SkinConverter.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004508) "SkinConverter.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004508) "Rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000796) "Rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000796) "Rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000796) "Rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000796) "Rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005300) "Rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005300) "Rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005300) "Rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005300) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007680) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007680) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007680) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007680) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kindling.dll (UID: 00000000-00007680) "firewall.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002792) "firewall.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002792) "firewall.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002792) "firewall.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002792) "firewall.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00002792) "firewall.exe" called "LoadLibrary" with a parameter %TEMP%\nsn533E.tmp\nsExec.dll (UID: 00000000-00002792) "firewall.exe" called "LoadLibrary" with a parameter %TEMP%\nsn533E.tmp\System.dll (UID: 00000000-00002792) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\MngModule.dll (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003096) "PPAP.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003096) "hwcheck.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\oplayer.ocx (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\MP4SplitterENU.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\MP4SplitterLOC.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\MP4Splitter.ax (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\h264_dec_filter.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter libmfxhw32.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter libmfxsw32.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\AVCVideoDec.ax (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter ext-ms-win-core-resourcepolicy-l1-1-0.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter d3dx9_43.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter d3dx9_42.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter d3d9.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter dxva2.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter evr.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter AVRT.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter VSFilter.lang (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\VSFilter.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006328) "hwcheck.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006328) "RepairSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001996) "RepairSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001996) "RepairSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001996) "RepairSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001996) "RepairSetup.exe" called "LoadLibrary" with a parameter riched32.dll (UID: 00000000-00001996) "RepairSetup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\Troubleshooter.dll (UID: 00000000-00001996) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003360) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003360) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003360) "PPAP.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003360) "PPAP.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\uilib.dll (UID: 00000000-00003360) "PPAP.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\MngModule.dll (UID: 00000000-00003360) "PPAP.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003360) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006064) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006064) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006064) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006064) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00006064) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00006064) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006064) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003752) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003752) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003752) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003752) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003752) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003752) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003752) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003336) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003336) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003336) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003336) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003336) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003336) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003336) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001080) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001080) "PPAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001080) "PPAP.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001080) "PPAP.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\uilib.dll (UID: 00000000-00001080) "PPAP.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\MngModule.dll (UID: 00000000-00001080) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006060) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006060) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006060) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006060) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00006060) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00006060) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006060) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003832) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003832) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003832) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003832) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003832) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003832) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003832) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000600) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000600) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000600) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000600) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00000600) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00000600) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000600)48:T1334,"select * from Win32_OperatingSystem" (Source: 44669-90-00E78E4E, Indicator: "select * from win32_operatingsystem") "SELECT * FROM Win32_VideoController" (Source: 00000000-00006328-0000271A-3788471289, Indicator: "select * from win32_videocontroller") "SELECT * FROM Win32_VideoController" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select * from win32_videocontroller") "select id,caption,playstring,starttime,endtime from reserve" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select id,caption,playstring,starttime,endtime from reserve") "DELETE FROM reserve WHERE endtime < %q" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "delete from reserve where endtime < %q") "CREATE TABLE reserve(id TEXT PRIMARY KEY,caption TEXT,playstring TEXT,starttime INT64,endtime INT64,username TEXT);" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "create table reserve(id text primary key,caption text,playstring text,starttime int64,endtime int64,username text);"), "select Id Pos Duration SubId from Favorites where Id=" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select id pos duration subid from favorites where id="), "CREATE TABLE FreshBuble (Id INT PRIMARY KEY,SubId INT,Time INT);" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "create table freshbuble (id int primary key,subid int,time int);"), "CREATE TABLE PushConfig (TaskID INT PRIMARY KEY,Time INT);" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "create table pushconfig (taskid int primary key,time int);"), "select Id IntField5 IntField6 SubName Pos Duration SubId from Recent where Id in" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select id intfield5 intfield6 subname pos duration subid from recent where id in"), "select Id Pos Duration SubId from Favorites where Id in" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select id pos duration subid from favorites where id in"), "DELETE FROM FreshBuble WHERE Time<%q;" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "delete from freshbuble where time<%q;"), "select id from reserve" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select id from reserve"), "DELETE FROM reserve WHERE id="%s%s" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "delete from reserve where id="%s%s") "DELETE FROM reserve WHERE id = "" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "delete from reserve where id = "") "SELECT PPWnd,IntegrityLevel,Product,Caption,CurChannelID,PersonNum,LiveID FROM MngModuleConfig WHERE IntegrityLevel=%d;" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select ppwnd,integritylevel,product,caption,curchannelid,personnum,liveid from mngmoduleconfig where integritylevel=%d;") "CREATE TABLE MngModuleConfig(PPWnd INT PRIMARY KEY,IntegrityLevel INT,Product TEXT,Caption TEXT,CurChannelID INT,PersonNum INT,LiveID INT,CurCatalogID INT);" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "create table mngmoduleconfig(ppwnd int primary key,integritylevel int,product text,caption text,curchannelid int,personnum int,liveid int,curcatalogid int);"), "DELETE FROM MngModuleConfig WHERE PPWnd=%d;" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "delete from mngmoduleconfig where ppwnd=%d;"), "DELETE FROM PushConfig WHERE Time<%q;" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "delete from pushconfig where time<%q;"), "SELECT * FROM PushConfig WHERE TaskID=%d;" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select * from pushconfig where taskid=%d;"), "select * from UserMap order by TextField0 DESC" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select * from usermap order by textfield0 desc"), "INSERT INTO reserve( id, caption, playstring, starttime, endtime) VALUES (%Q,%Q,%Q,%Q,%Q)" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "insert into reserve( id, caption, playstring, starttime, endtime) values (%q,%q,%q,%q,%q)"), "SELECT * FROM MngModuleConfig" (Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp, Indicator: "select * from mngmoduleconfig"), "DELETE FROM '%q'.'%q_parent' WHERE nodeno = :1" (Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, Indicator: "delete from '%q'.'%q_parent' where nodeno = :1"), "INSERT OR REPLACE INTO '%q'.'%q_parent' VALUES(:1, :2)" (Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, Indicator: "insert or replace into '%q'.'%q_parent' values(:1, :2)")49:T4e3,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000796.00000000.307053.02DD0000.00000004.mdmp"), Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00001080.00000001.308933.00E1D000.00000002.mdmp"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")4a:T462,Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "SHCreateDirectoryExW" (Indicator: "CreateDirectory"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "SHCreateDirectoryExW" (Indicator: "CreateDirectory"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp")4b:T7c8,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "PPTV(pplive)_forap_1084_9993.exe"), file/memory contains long string with (Indicator: "CreateFile"; File: "time.dll"), Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp"), Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp"), Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")4c:Ta2a,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001080.00000001.308933.729A1000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp")4d:Tc41,Found reference to API "/LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 /I /L 0 /M 0 /N 0 /O 1 /P" (Indicator: "LoadModule"; File: "PPAP.exe") Found reference to API "/LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?sa2foJynraDkzqyZ0tKhzq+YoaPNnKqLs62i5ajhqaKcmfKX7KHoovLhlrSpzb/QucrE0N2mqMfUtrzhqZ6doKSbnqXoj7uioaGamZaLtq2dn5ysraDkmaaVoKCcmaaLuK2c" (Indicator: "LoadModule"; File: "PPAP.exe") file/memory contains long string with (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp, 00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found reference to API "/LoadModule" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp, 00000000-00001080.00000000.308794.027C0000.00000004.mdmp, 00000000-00001080.00000001.308933.00C90000.00000004.mdmp, 00000000-00001080.00000001.308933.00DE0000.00000004.mdmp") Found reference to API ""%s" /LoadModule "%s" /A PPTVConverter /C %s" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "/LoadModule Converter.dll /A PPTVConverter /C "%s" /url "%s"" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "/LoadModule Converter.dll /A DownloadInstall /ini "%s" /url "%s" /update "%d"" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API ""%s" /LoadModule ui.dll version=3 /mainxml BookBubble.xml /mainjs BookBubble.js /styleEx %d /BookTitle %s /BookTime %s /BookPlay %s" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API ""%s" /LoadModule ui.dll version=3 /mainxml FreshPushWnd.xml /mainjs FreshPushWnd.js /styleEx %d" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "SymLoadModule64" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "LoadModule" (Indicator: "LoadModule"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp") Found reference to API "" /LoadModule ProductUpdate.dll /P1 1 /C" (Indicator: "LoadModule"; Source: "00000000-00001080.00000001.308933.00E1D000.00000002.mdmp"), Found reference to API "" |/LoadModule ProductUpdate.dll /P1 1 /C" (Indicator: "LoadModule"; Source: "00000000-00001080.00000001.308933.00E1D000.00000002.mdmp") Found reference to API "SymLoadModule64" (Indicator: "LoadModule"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found reference to API "LoadModule" (Indicator: "LoadModule"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found reference to API "/LoadModule "%s"" (Indicator: "LoadModule"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "/LoadModule Troubleshooter.dll" (Indicator: "LoadModule"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")4e:T4ec,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp"), Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001996.00000000.307730.00405000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp")4f:T70f,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.72701000.00000020.mdmp"), Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp"), Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp"), Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")50:T122f,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "PPTV(pplive)_forap_1084_9993.exe"), Found reference to API "Failed to WriteFile. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Failed to InternetReadFile. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Can't open file: %s. GetLastError()==%d" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Failed to HttpQueryInfo. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Failed to HttpSendRequest. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Failed to HttpOpenRequest. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Failed to InternetConnect. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Failed to InternetOpen. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "Failed to url.CrackUrl. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp"), Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp, 00000000-00001080.00000001.308933.72701000.00000020.mdmp, 00000000-00001080.00000001.308933.729A1000.00000020.mdmp"), Found reference to API "ERROR: %s, GetLastError: %d (Address: %p)" (Indicator: "GetLastError"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp"), Found reference to API "ERROR: %s, GetLastError: %d (Address: %p)" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp"), Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp, 00000000-00001996.00000002.311573.72061000.00000020.mdmp"), Found reference to API "Failed to WriteFile. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Failed to InternetReadFile. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Can't open file: %s. GetLastError()==%d" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Failed to HttpQueryInfo. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Failed to HttpSendRequest. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Failed to HttpOpenRequest. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Failed to InternetConnect. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Failed to InternetOpen. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found reference to API "Failed to PPParseURL. GetLastError()==%u" (Indicator: "GetLastError"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")51:T1b0c,"Software\Microsoft\Windows\CurrentVersion" in Source: PPTV(pplive)_forap_1084_9993.exe "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 44669-80-00E78CD9 "SOFTWARE\Microsoft\NetSh" in Source: 44669-102-00E73E80 "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001080.00000000.308794.00C90000.00000004.mdmp 00000000-00001080.00000001.308933.00C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001080.00000000.308794.00C90000.00000004.mdmp 00000000-00001080.00000001.308933.00C90000.00000004.mdmp "Software\PPLive\PPAP\bsoddetect" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPLive\Config\PlaySet" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPLive\PPTV\bsoddetect" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PPLive" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPlive" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPLive\PPTV\WakeUp" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp "SOFTWARE\PPLive" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\Classes\" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\Classes\.htm" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\Classes\http\shell" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "system\CurrentControlSet\control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\PPLive\PPTV\Update" in Source: 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001996.00000000.307730.004C0000.00000004.mdmp 00000000-00001996.00000001.309653.004C0000.00000004.mdmp 00000000-00001996.00000002.311573.004C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001996.00000000.307730.004C0000.00000004.mdmp 00000000-00001996.00000001.309653.004C0000.00000004.mdmp 00000000-00001996.00000002.311573.004C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\PPLive" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "Software\Classes\" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Classes\.htm" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Classes\http\shell" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "system\CurrentControlSet\control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "Software\PPLive\player\codecs" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "software\PPLive\config\other" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\PPLive\config\other" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\PPLive\Download" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Ext\Settings" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\MozillaPlugins\@pptv.com/plugin\MimeTypes\application/x-pptv-plugin" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\MozillaPlugins\@pptv.com/plugin" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Ext\Settings\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\PPLive\RunState" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\PPLive\player\codecs" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp52:Ta6d,Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8164:168:WilStaging_02" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "PPLive NSIS Setup" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "Local\SM0:8164:168:WilStaging_02" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "DBWinMutex" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "Local\SM0:8164:64:WilError_03" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "Local\ZonesCacheCounterMutex" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "SM0:8164:64:WilError_03" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8164:64:WilError_03" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8164:64:WilError_03" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\PPLive NSIS Setup" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process PPTV_pplive__forap_1084_9993.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process regsvr32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2124:64:WilError_03" Process regsvr32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2124:168:WilStaging_02" Process regsvr32.exe created mutex with name "Local\SM0:2124:168:WilStaging_02" Process regsvr32.exe created mutex with name "SM0:2124:64:WilError_03" Process SkinConverter.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process SkinConverter.exe created mutex with name "DBWinMutex" Process Rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:796:168:WilStaging_02" Process Rundll32.exe created mutex with name "Local\SM0:796:168:WilStaging_02" Process Rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5300:168:WilStaging_02"53:Tbd7,Antivirus vendors marked dropped file "peer.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "GdiPlus.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "VSFilter.dll" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "chctrl.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "mframe.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "NCList.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "PPOptions.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "uilib.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "ui.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "admodule.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "omng.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "MngModule.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "PPTVSvc.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "mframe.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "client_ap.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "PPAP.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "PPLive.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "PPLiveU.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "kindling.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "crashreporter.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "pplugin2.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "PPTVLauncher.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections")54:T806,Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CL" (Indicator: "mozilla/4.0 ("; Source: "00000000-00008164-00000C9E-10132897582") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CL" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003360-00000C9E-6760951646") Found string "Mozilla/4.0 (compatible; MSIE 6.0; Win32; DAC)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp, 00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp, 00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found string "User-AgentMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Q" (Indicator: "mozilla/4.0 ("; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" (Indicator: "user-agent: "; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 6.0; Win32)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp")55:T3d47,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001080.00000000.308794.00C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001080.00000000.308794.00C90000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPLive\PPAP\bsoddetect" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPLive\Config\PlaySet" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPLive\PPTV\bsoddetect" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PPLive" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPlive" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "Software\PPLive\PPTV\WakeUp" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001080.00000000.308794.1004E000.00000002.mdmp "system\CurrentControlSet\control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SOFTWARE\PPLive" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\Classes\" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\Classes\.htm" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\Classes\http\shell" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\" in Source: 00000000-00001080.00000000.308794.1018F000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001080.00000001.308933.00C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001080.00000001.308933.00C90000.00000004.mdmp "Software\PPLive\PPTV\Update" in Source: 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001996.00000000.307730.004C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001996.00000000.307730.004C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001996.00000001.309653.004C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001996.00000001.309653.004C0000.00000004.mdmp "system\CurrentControlSet\control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SOFTWARE\PPLive" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "Software\Classes\" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "Software\Classes\.htm" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "Software\Classes\http\shell" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\" in Source: 00000000-00001996.00000001.309653.1018F000.00000002.mdmp "Software\PPLive\player\codecs" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "software\PPLive\config\other" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\PPLive\config\other" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\PPLive\Download" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Classes\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Classes\.htm" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Classes\http\shell" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Ext\Settings" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\MozillaPlugins\@pptv.com/plugin\MimeTypes\application/x-pptv-plugin" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\MozillaPlugins\@pptv.com/plugin" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Ext\Settings\" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\PPLive\RunState" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "SOFTWARE\PPLive\player\codecs" in Source: 00000000-00001996.00000001.309653.715D8000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001996.00000002.311573.004C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001996.00000002.311573.004C0000.00000004.mdmp "ISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002792.00000000.307678.004B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002792.00000001.309563.00407000.00000002.mdmp "938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002792.00000001.309563.004B0000.00000004.mdmp "stry\Machine\Software\Classes\Interface\{04987413-5E4A-472F-9899-0A092233239E}\TypeLib" in Source: 00000000-00003096.00000000.307705.011D0000.00000004.mdmp "system\CurrentControlSet\control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SOFTWARE\PPLive" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "Software\Classes\.htm" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "Software\Classes\http\shell" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\" in Source: 00000000-00003096.00000000.307705.1018F000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003360.00000000.307792.007D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003360.00000000.307792.007D0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003360.00000001.308239.007D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003360.00000001.308239.007D0000.00000004.mdmp "Software\PPLive\PPTV\Update" in Source: 00000000-00003360.00000001.308239.00E1D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003360.00000001.308239.00E1D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "Software\PPLive\PPAP\bsoddetect" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "Software\PPLive\Config\PlaySet" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "Software\PPLive\PPTV\bsoddetect" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PPLive" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "Software\PPlive" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "Software\PPLive\PPTV\WakeUp" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00003360.00000001.308239.1004E000.00000002.mdmp "system\CurrentControlSet\control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\PPLive" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "Software\Classes\.htm" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "Software\Classes\http\shell" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\" in Source: 00000000-00003360.00000001.308239.1018F000.00000002.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00003832.00000000.309217.5D33C000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00003832.00000000.309217.5D33C000.00000002.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00003832.00000000.309217.E34E4000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{C1G" in Source: 00000000-00004508.00000000.307044.01060000.00000004.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00006060.00000000.308879.00E71000.00000020.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00006060.00000000.308879.00E71000.00000020.mdmp "Software\PPLive\Config\PlaySet" in Source: 00000000-00006328.00000001.308483.00627000.00000002.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00006328.00000001.308483.00AE0000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00006328.00000001.308483.00AE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00006328.00000001.308483.1004D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00006328.00000001.308483.1004D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00006328.00000001.308483.1004D000.00000002.mdmp "Software\" in Source: 00000000-00006328.00000001.308483.1004D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00006328.00000001.308483.7154B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00006328.00000001.308483.7154B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00006328.00000001.308483.7154B000.00000002.mdmp "Software\" in Source: 00000000-00006328.00000001.308483.7154B000.00000002.mdmp "Software\PPLive\player\codecs" in Source: 00000000-00006328.00000001.308483.71847000.00000002.mdmp "Software\CoreCodec\CoreAVC Pro 3.x" in Source: 00000000-00006328.00000001.308483.71847000.00000002.mdmp "Software\PPLive\Gabest\Filters\MPC Video Decoder" in Source: 00000000-00006328.00000001.308483.71CDD000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00006328.00000001.308483.721C1000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00006328.00000001.308483.721C1000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00006328.00000001.308483.721C1000.00000020.mdmp56:T68cc,"PPTV_pplive__forap_1084_9993.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "PPTV_pplive__forap_1084_9993.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "PPTV_pplive__forap_1084_9993.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "PPTV_pplive__forap_1084_9993.exe" loaded module "KERNEL32" at base 75570000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "SHFOLDER" at base 72ab0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "KERNEL32.DLL" at base 75570000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\SYSTEM.DLL" at base 10000000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\FINDPROCDLL.DLL" at base 24e0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "PSAPI.DLL" at base 76da0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\KILLPROCDLL.DLL" at base 24e0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\INETLOAD.DLL" at base 24e0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "COMCTL32.DLL" at base 74b20000 "PPTV_pplive__forap_1084_9993.exe" loaded module "RPCRT4.DLL" at base 75130000 "PPTV_pplive__forap_1084_9993.exe" loaded module "SSPICLI.DLL" at base 73a90000 "PPTV_pplive__forap_1084_9993.exe" loaded module "USER32.DLL" at base 75910000 "PPTV_pplive__forap_1084_9993.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 729a0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 729a0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "WININET.DLL" at base 74670000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73930000 "PPTV_pplive__forap_1084_9993.exe" loaded module "WINHTTP.DLL" at base 728b0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 728a0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "MSVCRT.DLL" at base 76fc0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\PPINSTALLLOG.DLL" at base 6e80000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\TIME.DLL" at base 6ea0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\GETCOMMENTSINFODLL.DLL" at base 6fa0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\CKNSIS.DLL" at base 6fa0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\ASYNDOWNLOAD.DLL" at base 6fa0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\COMMONFUNCDLL.DLL" at base 72650000 "PPTV_pplive__forap_1084_9993.exe" loaded module "NTDLL.DLL" at base 770a0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "KERNELBASE" at base 76b20000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 744d0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\FINDPROCDLL.DLL" at base 6fb0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 723a0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\COMMONFUNCDLL.DLL" at base 72360000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\PNSIS.DLL" at base 7b50000 "PPTV_pplive__forap_1084_9993.exe" loaded module "SHELL32.DLL" at base 762f0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "NTMARTA.DLL" at base 744a0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\PNSIS.DLL" at base 7920000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73260000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b50000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 730f0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.FILEEXPLORER.COMMON.DLL" at base 722c0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "COMBASE.DLL" at base 75660000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 73190000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\PNSIS.DLL" at base 7e60000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\BINDDLL.DLL" at base 7e30000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\COMMONFUNCDLL.DLL" at base 725d0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 72460000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 71f40000 "PPTV_pplive__forap_1084_9993.exe" loaded module "CSCAPI.DLL" at base 739e0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "SHELL32" at base 762f0000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.SEARCH.DLL" at base 71e90000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\GETVERSION.DLL" at base 7f20000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\PNSIS.DLL" at base 7f10000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73260000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\GETVERSION.DLL" at base 7e60000 "PPTV_pplive__forap_1084_9993.exe" loaded module "%TEMP%\NSLDD05.TMP\PPBINDDAC.DLL" at base 7e60000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "regsvr32.exe" loaded module "KERNEL32" at base 75570000 "regsvr32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "regsvr32.exe" loaded module "EXT-MS-WIN-COM-OLE32-L1-1-0.DLL" at base 75420000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "regsvr32.exe" loaded module "%PROGRAMFILES%\(X86)\INTERNET EXPLORER\PPLITE\PLUGIN\1.0.1.1058\PPLUGIN2.DLL" at base 10000000 "regsvr32.exe" loaded module "KERNEL32.DLL" at base 75570000 "regsvr32.exe" loaded module "RPCRT4.DLL" at base 75130000 "SkinConverter.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "SkinConverter.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "SkinConverter.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "SkinConverter.exe" loaded module "KERNEL32" at base 75570000 "SkinConverter.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "SkinConverter.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "SkinConverter.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL" at base 74100000 "SkinConverter.exe" loaded module "WINDOWSCODECS.DLL" at base 72bf0000 "SkinConverter.exe" loaded module "KERNEL32.DLL" at base 75570000 "Rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "Rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "Rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "Rundll32.exe" loaded module "KERNEL32" at base 75570000 "Rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "Rundll32.exe" loaded module "%WINDIR%\SYSWOW64\PPTVSVC.DLL" at base 72460000 "Rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "Rundll32.exe" loaded module "RPCRT4.DLL" at base 75130000 "Rundll32.exe" loaded module "%WINDIR%\SYSWOW64\PPTVSVC.DLL" at base 72550000 "Rundll32.exe" loaded module "KERNEL32.DLL" at base 75570000 "regsvr32.exe" loaded module "KERNEL32" at base 7fffb2dc0000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffb2360000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffb2360000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffb2360000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fffb2bd0000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffb2360000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffb2360000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffb2360000 "regsvr32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff89e20000 "regsvr32.exe" loaded module "EXT-MS-WIN-COM-OLE32-L1-1-0.DLL" at base 7fffb4510000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffaf360000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\KINDLING.DLL" at base 180000000 "regsvr32.exe" loaded module "KERNEL32.DLL" at base 7fffb2dc0000 "regsvr32.exe" loaded module "RPCRT4.DLL" at base 7fffb2e90000 "firewall.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "firewall.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "firewall.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "firewall.exe" loaded module "KERNEL32" at base 75570000 "firewall.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "firewall.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "firewall.exe" loaded module "SHFOLDER" at base 72ab0000 "firewall.exe" loaded module "KERNEL32.DLL" at base 75570000 "firewall.exe" loaded module "%TEMP%\NSN533E.TMP\NSEXEC.DLL" at base 10000000 "firewall.exe" loaded module "NTDLL.DLL" at base 770a0000 "firewall.exe" loaded module "KERNELBASE" at base 76b20000 "firewall.exe" loaded module "%TEMP%\NSN533E.TMP\SYSTEM.DLL" at base 10000000 "firewall.exe" loaded module "%TEMP%\NSN533E.TMP\NSEXEC.DLL" at base 2390000 "PPAP.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "PPAP.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "PPAP.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "PPAP.exe" loaded module "KERNEL32" at base 75570000 "PPAP.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "PPAP.exe" loaded module "KERNEL32.DLL" at base 75570000 "PPAP.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\PPLIVENETWORK\1.0.1.1058\MNGMODULE.DLL" at base 10000000 "PPAP.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "PPAP.exe" loaded module "OLE32.DLL" at base 75420000 "PPAP.exe" loaded module "USER32.DLL" at base 75910000 "PPAP.exe" loaded module "ADVAPI32.DLL" at base 76270000 "PPAP.exe" loaded module "OLEAUT32.DLL" at base 76990000 "PPAP.exe" loaded module "RPCRT4.DLL" at base 75130000 "hwcheck.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "hwcheck.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "hwcheck.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "hwcheck.exe" loaded module "KERNEL32" at base 75570000 "hwcheck.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "hwcheck.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "hwcheck.exe" loaded module "COMCTL32.DLL" at base 74b20000 "hwcheck.exe" loaded module "KERNEL32.DLL" at base 75570000 "hwcheck.exe" loaded module "%PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\PLAYER\OPLAYER.OCX" at base 717e0000 "hwcheck.exe" loaded module "%WINDIR%\SYSWOW64\QUARTZ.DLL" at base 71eb0000 "hwcheck.exe" loaded module "RPCRT4.DLL" at base 75130000 "hwcheck.exe" loaded module "USER32.DLL" at base 75910000 "hwcheck.exe" loaded module "%PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\PLAYER\MP4SPLITTER.AX" at base 10000000 "hwcheck.exe" loaded module "%PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\PLAYER\H264_DEC_FILTER.DLL" at base 72700000 "hwcheck.exe" loaded module "%PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\PLAYER\AVCVIDEODEC.AX" at base 71ab0000 "hwcheck.exe" loaded module "D3D10WARP.DLL" at base 70bf0000 "hwcheck.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 72940000 "hwcheck.exe" loaded module "GDI32.DLL" at base 758e0000 "hwcheck.exe" loaded module "DWMAPI.DLL" at base 726d0000 "hwcheck.exe" loaded module "D3D9.DLL" at base 71930000 "hwcheck.exe" loaded module "DXVA2.DLL" at base 72610000 "hwcheck.exe" loaded module "EVR.DLL" at base 72370000 "hwcheck.exe" loaded module "AVRT.DLL" at base 724b0000 "hwcheck.exe" loaded module "%WINDIR%\SYSWOW64\EVR.DLL" at base 72370000 "hwcheck.exe" loaded module "%WINDIR%\SYSTEM32\EVR.DLL" at base 72370000 "hwcheck.exe" loaded module "%PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\PLAYER\VSFILTER.DLL" at base 71490000 "hwcheck.exe" loaded module "D3D10WARP.DLL" at base 70e90000 "hwcheck.exe" loaded module "IPHLPAPI.DLL" at base 74640000 "hwcheck.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76b20000 "hwcheck.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72600000 "hwcheck.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72720000 "hwcheck.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 713c0000 "hwcheck.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76b20000 "hwcheck.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76b20000 "hwcheck.exe" loaded module "AMSI.DLL" at base 72700000 "hwcheck.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74d90000 "hwcheck.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 721c0000 "hwcheck.exe" loaded module "%WINDIR%\SYSWOW64\8J6M1284.DLL" at base 718f0000 "hwcheck.exe" loaded module "NTDLL.DLL" at base 770a0000 "hwcheck.exe" loaded module "KERNELBASE" at base 76b20000 "RepairSetup.exe" loaded module "KERNEL32" at base 75570000 "RepairSetup.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76b20000 "RepairSetup.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76b20000 "RepairSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76b20000 "RepairSetup.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76960000 "RepairSetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "RepairSetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "RepairSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "RepairSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "RepairSetup.exe" loaded module "KERNEL32.DLL" at base 75570000 "RepairSetup.exe" loaded module "RICHED32.DLL" at base 72aa0000 "RepairSetup.exe" loaded module "%PROGRAMFILES%\(X86)\PPLIVE\PPTV\3.1.5.0065\TROUBLESHOOTER.DLL" at base 715b0000 "RepairSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "RepairSetup.exe" loaded module "USER32.DLL" at base 75910000 "RepairSetup.exe" loaded module "RPCRT4.DLL" at base 75130000 "RepairSetup.exe" loaded module "SSPICLI.DLL" at base 73a90000 "RepairSetup.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72920000 "RepairSetup.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72920000 "RepairSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73930000 "RepairSetup.exe" loaded module "WINHTTP.DLL" at base 72830000 "RepairSetup.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72690000 "RepairSetup.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72630000 "PPAP.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\PPLIVENETWORK\1.0.1.1058\UILIB.DLL" at base 10100000 "PPAP.exe" loaded module "IPHLPAPI.DLL" at base 74640000 "PPAP.exe" loaded module "SSPICLI.DLL" at base 73a90000 "PPAP.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72920000 "PPAP.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72920000 "PPAP.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73930000 "PPAP.exe" loaded module "WINHTTP.DLL" at base 72830000 "PPAP.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72690000 "PPAP.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72630000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76960000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76b20000 "netsh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76b20000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76b20000 "netsh.exe" loaded module "KERNEL32" at base 75570000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ac0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 74580000 "netsh.exe" loaded module "IFMON.DLL" at base 729c0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 75130000 "netsh.exe" loaded module "MPRAPI.DLL" at base 72940000 "netsh.exe" loaded module "MSVCRT.DLL" at base 76fc0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 727a0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 724b0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 72610000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 71f80000 "netsh.exe" loaded module "FWCFG.DLL" at base 725d0000 "netsh.exe" loaded module "HNETMON.DLL" at base 72430000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 71b90000 "netsh.exe" loaded module "NETTRACE.DLL" at base 71b30000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 71a90000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 71a30000 "netsh.exe" loaded module "NSHWFP.DLL" at base 71890000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 71770000 "netsh.exe" loaded module "RPCNSH.DLL" at base 71720000 "netsh.exe" loaded module "WHHELPER.DLL" at base 71710000 "netsh.exe" loaded module "WLANCFG.DLL" at base 716c0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 71640000 "netsh.exe" loaded module "WWANCFG.DLL" at base 71590000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 714d0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75660000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745a0000 "netsh.exe" loaded module "WCMAPI.DLL" at base 714a0000 "netsh.exe" loaded module "USERENV.DLL" at base 74620000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 71450000 "netsh.exe" loaded module "KERNEL32.DLL" at base 75570000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 760e0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 713f0000 "netsh.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 71fe0000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 76990000 "netsh.exe" loaded module "IFMON.DLL" at base 72940000 "netsh.exe" loaded module "MPRAPI.DLL" at base 727b0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 72720000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 724e0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 72620000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 724c0000 "netsh.exe" loaded module "FWCFG.DLL" at base 72610000 "netsh.exe" loaded module "HNETMON.DLL" at base 725d0000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 71950000 "netsh.exe" loaded module "NETTRACE.DLL" at base 718f0000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 718d0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 71700000 "netsh.exe" loaded module "NSHWFP.DLL" at base 71500000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 714c0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 71610000 "netsh.exe" loaded module "WHHELPER.DLL" at base 71600000 "netsh.exe" loaded module "WLANCFG.DLL" at base 71440000 "netsh.exe" loaded module "WSHELPER.DLL" at base 713c0000 "netsh.exe" loaded module "WWANCFG.DLL" at base 71360000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 712a0000 "netsh.exe" loaded module "WCMAPI.DLL" at base 71270000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 71220000 "netsh.exe" loaded module "MPRMSG.DLL" at base 711c0000 "netsh.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 71c40000 "netsh.exe" loaded module "IFMON.DLL" at base 72600000 "netsh.exe" loaded module "MPRAPI.DLL" at base 722f0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 722a0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 71890000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 72190000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 71e90000 "netsh.exe" loaded module "FWCFG.DLL" at base 71000000 "netsh.exe" loaded module "HNETMON.DLL" at base 70ff0000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 70f20000 "netsh.exe" loaded module "NETTRACE.DLL" at base 70ec0000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 70e20000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 70db0000 "netsh.exe" loaded module "NSHWFP.DLL" at base 70c10000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 70ba0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 70b60000 "netsh.exe" loaded module "WHHELPER.DLL" at base 70b50000 "netsh.exe" loaded module "WLANCFG.DLL" at base 70b00000 "netsh.exe" loaded module "WSHELPER.DLL" at base 70a80000 "netsh.exe" loaded module "WWANCFG.DLL" at base 70a20000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 70960000 "netsh.exe" loaded module "WCMAPI.DLL" at base 70930000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 708e0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 70880000 "netsh.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 71290000 "netsh.exe" loaded module "IFMON.DLL" at base 72990000 "netsh.exe" loaded module "MPRAPI.DLL" at base 724d0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 726b0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 72460000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 726a0000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 72440000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 71820000 "netsh.exe" loaded module "RPCNSH.DLL" at base 717d0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 717c0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 71770000 "netsh.exe" loaded module "WSHELPER.DLL" at base 716f0000 "netsh.exe" loaded module "WWANCFG.DLL" at base 71690000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 71540000 "netsh.exe" loaded module "WCMAPI.DLL" at base 71610000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 714f0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 714a0000 "netsh.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 71f90000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fffb2bd0000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffb2360000 "netsh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffb2360000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffb2360000 "netsh.exe" loaded module "KERNEL32" at base 7fffb2dc0000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffaa5d0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7fffb0d80000 "netsh.exe" loaded module "IFMON.DLL" at base 7fffaa0b0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7fffb2e90000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7fff8b140000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7fffb2900000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7fff8c4b0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7fff8ae40000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7fffa5d40000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7fff9c060000 "netsh.exe" loaded module "FWCFG.DLL" at base 7fff8d150000 "netsh.exe" loaded module "HNETMON.DLL" at base 7fff9db60000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7fff89e50000 "netsh.exe" loaded module "NETPROFM.DLL" at base 7fffad380000 "netsh.exe" loaded module "NETSH.EXE" at base 7ff75d330000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7fff87300000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7fff8c310000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7fff872a0000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7fff870e0000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7fff870a0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7fff9d890000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7fff87040000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7fff9d830000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7fff86ff0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7fff9d7b0000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7fff86fc0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7fff86f30000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7fffb30e0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffaf360000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7fffa9d50000 "netsh.exe" loaded module "USERENV.DLL" at base 7fffb12f0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7fff96600000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7fffb2dc0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fffb22e0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7fff86f10000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\FIREWALLAPI.DLL" at base 7fffb0770000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7fffb47f0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 72440000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 72230000 "netsh.exe" loaded module "FWCFG.DLL" at base 72430000 "netsh.exe" loaded module "HNETMON.DLL" at base 71ea0000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 71cf0000 "netsh.exe" loaded module "NETTRACE.DLL" at base 71c90000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 71bf0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 71b90000 "netsh.exe" loaded module "NSHWFP.DLL" at base 719f0000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 71980000 "netsh.exe" loaded module "RPCNSH.DLL" at base 71930000 "netsh.exe" loaded module "WHHELPER.DLL" at base 71920000 "netsh.exe" loaded module "WLANCFG.DLL" at base 718d0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 71850000 "netsh.exe" loaded module "WWANCFG.DLL" at base 717f0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 71730000 "netsh.exe" loaded module "WCMAPI.DLL" at base 71700000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 716b0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 71650000 "netsh.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 7225000057:T4ad,"PPTV_pplive__forap_1084_9993.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "regsvr32.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "SkinConverter.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "regsvr32.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at B22E0000 "firewall.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "PPAP.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "hwcheck.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "hwcheck.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72490000 "RepairSetup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "netsh.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72490000 "netsh.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 760E0000 "netsh.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 725E0000 "netsh.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at B1610000 "netsh.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at B22E0000 "netsh.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 725D000058:T12bf,"PPTV(pplive)_forap_1084_9993.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "PPTV(pplive)_forap_1084_9993.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PPTV(pplive)_forap_1084_9993.exe" was detected as "Microsoft Linker" and name: "Linker" "peer.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "peer.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "peer.dll" was detected as "Microsoft Linker" and name: "Linker" "GdiPlus.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "GdiPlus.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GdiPlus.dll" was detected as "Microsoft Linker" and name: "Linker" "mir.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "mir.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mir.dll" was detected as "Microsoft Linker" and name: "Linker" "VSFilter.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "VSFilter.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VSFilter.dll" was detected as "Microsoft Linker" and name: "Linker" "chctrl.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "chctrl.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "chctrl.dll" was detected as "Microsoft Linker" and name: "Linker" "mframe.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "mframe.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mframe.dll" was detected as "Microsoft Linker" and name: "Linker" "tpi.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "tpi.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tpi.dll" was detected as "Microsoft Linker" and name: "Linker" "NCList.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "NCList.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NCList.dll" was detected as "Microsoft Linker" and name: "Linker" "PPOptions.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "PPOptions.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PPOptions.dll" was detected as "Microsoft Linker" and name: "Linker" "uilib.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "uilib.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "uilib.dll" was detected as "Microsoft Linker" and name: "Linker" "ui.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ui.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ui.dll" was detected as "Microsoft Linker" and name: "Linker" "ProductUpdate.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ProductUpdate.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ProductUpdate.dll" was detected as "Microsoft Linker" and name: "Linker" "admodule.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "admodule.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "admodule.dll" was detected as "Microsoft Linker" and name: "Linker" "omng.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "omng.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "omng.dll" was detected as "Microsoft Linker" and name: "Linker" "MngModule.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "MngModule.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MngModule.dll" was detected as "Microsoft Linker" and name: "Linker" "PPTVSvc.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "PPTVSvc.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PPTVSvc.dll" was detected as "Microsoft Linker" and name: "Linker" "client_ap.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "client_ap.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "client_ap.dll" was detected as "Microsoft Linker" and name: "Linker" "PPAP.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "PPAP.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PPAP.exe" was detected as "Microsoft Linker" and name: "Linker" "PPLive.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "PPLive.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PPLive.exe" was detected as "Microsoft Linker" and name: "Linker"59:T195d,"PPTV_pplive__forap_1084_9993.exe" touched "Windows Search Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}") "PPTV_pplive__forap_1084_9993.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "PPTV_pplive__forap_1084_9993.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "Recycle Bin Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4A04656D-52AA-49DE-8A09-CB178760E748}\INSTANCE") "PPTV_pplive__forap_1084_9993.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "Shell Library API" (Path: "HKCU\WOW6432NODE\CLSID\{D9B3211D-E57F-4426-AAEF-30A806ADD397}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "PPTV_pplive__forap_1084_9993.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" touched "Libraries delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{896664F7-12E1-490F-8782-C0835AFD98FC}\INSTANCE") "PPTV_pplive__forap_1084_9993.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" touched "Library Folder" (Path: "HKCU\WOW6432NODE\CLSID\{A5A3563A-5755-4A6F-854E-AFA3230B199F}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "PPTV_pplive__forap_1084_9993.exe" touched "Library Property Store" (Path: "HKCU\WOW6432NODE\CLSID\{EEA0C191-DDA8-4656-8FC4-72BDEDBA8A78}\OVERRIDEFILESYSTEMPROPERTIES") "PPTV_pplive__forap_1084_9993.exe" touched "Property Store over folder final" (Path: "HKCU\WOW6432NODE\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "SMB Share Engine" (Path: "HKCU\WOW6432NODE\CLSID\{77F419AA-771A-45FF-AC66-7567FA3243D3}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "Share Manager" (Path: "HKCU\WOW6432NODE\CLSID\{EDB5F444-CB8D-445A-A523-EC5AB6EA33C7}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "Library Description" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FE5AFCF2-E681-4ADA-9703-EF39B8ECB9BF}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" touched "Library Factory" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA8B451C-5A19-49CF-BC5E-98ACCCA49EF3}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" touched "Indexer Status Update Object" (Path: "HKCU\WOW6432NODE\CLSID\{76BE8257-C4C0-4D37-90C0-A23372254D27}\TREATAS") "PPTV_pplive__forap_1084_9993.exe" touched "Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "PPTV_pplive__forap_1084_9993.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "hwcheck.exe" touched "Filter Graph no thread" (Path: "HKCU\WOW6432NODE\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}") "hwcheck.exe" touched "DirectSound Audio Renderer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{79376820-07D0-11CF-A24D-0020AFD79767}") "hwcheck.exe" touched "Filter Mapper2" (Path: "HKCU\WOW6432NODE\CLSID\{CDA42200-BD88-11D0-BD4E-00A0C911CE86}\TREATAS") "hwcheck.exe" touched "Enhanced Video Renderer" (Path: "HKCU\WOW6432NODE\CLSID\{FA10746C-9B63-4B6C-BC49-FC300EA5F256}\TREATAS") "hwcheck.exe" touched "MF Video Mixer" (Path: "HKCU\WOW6432NODE\CLSID\{E474E05A-AB65-4F6A-827C-218B1BAAF31F}\TREATAS") "hwcheck.exe" touched "MF Video Presenter" (Path: "HKCU\WOW6432NODE\CLSID\{98455561-5136-4D28-AB08-4CEE40EA2781}\TREATAS") "hwcheck.exe" touched "Tearless Window Presenter" (Path: "HKCU\WOW6432NODE\CLSID\{A0A7A57B-59B2-4919-A694-ADD0A526C373}\TREATAS") "hwcheck.exe" touched "ActiveMovie Filter Class Manager" (Path: "HKCU\WOW6432NODE\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\INSTANCE\{9D2935C7-3D8B-4EF6-B0D1-C14064698794}") "hwcheck.exe" touched "Seeking" (Path: "HKCU\WOW6432NODE\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}\TREATAS") "hwcheck.exe" touched "System Clock" (Path: "HKCU\WOW6432NODE\CLSID\{E436EBB1-524F-11CE-9F53-0020AF0BA770}\TREATAS") "hwcheck.exe" touched "ItemMoniker" (Path: "HKCU\WOW6432NODE\CLSID\{00000304-0000-0000-C000-000000000046}\TREATAS") "hwcheck.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "hwcheck.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "hwcheck.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "hwcheck.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "hwcheck.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "hwcheck.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "hwcheck.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "netsh.exe" touched "HNetCfg.FwMgr" (Path: "HKCU\WOW6432NODE\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}") "netsh.exe" touched "HNetCfg.FwAuthorizedApplication" (Path: "HKCU\WOW6432NODE\CLSID\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\TREATAS")5a:T711,Observed system executable string:"\Device\HarddiskVolume3\Windows\SysWOW64\regsvr32.exe" [Source: 00000000-00008164-00000BC0-3747946625] Observed system executable string:"%WINDIR%\SYSTEM32\regsvr32.exe" [Source: 00000000-00008164-00000BC0-3747949437] Observed system executable string:""%WINDIR%\system32\PPTVLauncher.exe" "%1"" [Source: 00000000-00008164-00000BC1-3771276955] Observed system executable string:"%WINDIR%\system32\PPTVLauncher.exe.(old)" [Source: 00000000-00008164-00000C2D-42980569948] Observed system executable string:"%WINDIR%\SysWOW64\Rundll32.exe" [Source: 00000000-00008164-00000C2D-43295337356] Observed system executable string:""%WINDIR%\SysWOW64\Rundll32.exe" "%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -i" [Source: 00000000-00008164-00000C46-43333502970] Observed system executable string:""%WINDIR%\SysWOW64\Rundll32.exe" "%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -start" [Source: 00000000-00008164-00000C46-55528881378] Observed system executable string:""%WINDIR%\system32\regsvr32.exe" /s %WINDIR%\system32\kindling.dll" [Source: 00000000-00008164-00000C46-55843635206] Observed system executable string:"\Device\HarddiskVolume3\Windows\SysWOW64\netsh.exe" [Source: 00000000-00002792-00000BC0-3774355711] Observed system executable string:"%WINDIR%\SYSTEM32\netsh.exe" [Source: 00000000-00002792-00000BC0-3774359667] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\netsh.exe" [Source: 00000000-00002792-00000BC0-3795169642] Observed system executable string:"netsh firewall add allowedprogram "%WINDIR%\system32\PPTVLauncher.exe" PPTVLauncher Enable" [Source: 00000000-00002792-00000C46-56386331306] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00006064-00000BC0-3774904071]5b:T54b,"PPTV_pplive__forap_1084_9993.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "PPTV_pplive__forap_1084_9993.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "PPTV_pplive__forap_1084_9993.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "regsvr32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "regsvr32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "regsvr32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SkinConverter.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "SkinConverter.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SkinConverter.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "firewall.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "firewall.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")5c:T5da,Observed system executable string:"%WINDIR%\SysWOW64\PPTVSvc.dll.(old)" [Source: 00000000-00008164-00000C2D-43149269702] Observed system executable string:"%WINDIR%\SysWOW64\PPTVSvc.dll" [Source: 00000000-00008164-00000C2D-43151775286] Observed system executable string:""%WINDIR%\SysWOW64\Rundll32.exe" "%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -i" [Source: 00000000-00008164-00000C46-43333502970] Observed system executable string:""%WINDIR%\SysWOW64\Rundll32.exe" "%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -start" [Source: 00000000-00008164-00000C46-55528881378] Observed system executable string:"%WINDIR%\system32\kindling.dll.(old)" [Source: 00000000-00008164-00000C2D-55539212686] Observed system executable string:""%WINDIR%\system32\regsvr32.exe" /s %WINDIR%\system32\kindling.dll" [Source: 00000000-00008164-00000C46-55843635206] Observed system executable string:"%WINDIR%\System32\PPTVSvc.dll" [Source: 00000000-00000796-00000BC1-3762496157] Observed system executable string:"%WINDIR%\system32\kindling.dll" [Source: 00000000-00007680-00000C2B-3768664373] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006328-00000C2B-3788087374] Observed system executable string:""%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -i" [Source: Rundll32.exe] Observed system executable string:""%WINDIR%\SysWOW64\PPTVSvc.dll" RundllCmd -start" [Source: Rundll32.exe] Observed system executable string:"/s %WINDIR%\system32\kindling.dll" [Source: regsvr32.exe]5d:T852,Spawned process "regsvr32.exe" with commandline "regsvr32 /s "%PROGRAMFILES%\\(x86)\\Internet Explorer\\PPLite\\p ..." (UID: 00000000-00002124), Spawned process "SkinConverter.exe" (UID: 00000000-00004508), Spawned process "Rundll32.exe" with commandline ""%WINDIR%\\SysWOW64\\PPTVSvc.dll" RundllCmd -i" (UID: 00000000-00000796), Spawned process "Rundll32.exe" with commandline ""%WINDIR%\\SysWOW64\\PPTVSvc.dll" RundllCmd -start" (UID: 00000000-00005300), Spawned process "regsvr32.exe" with commandline "/s %WINDIR%\\system32\\kindling.dll" (UID: 00000000-00007680), Spawned process "firewall.exe" with commandline "/PPTVPATH=%PROGRAMFILES%\\(x86)\\PPLive\\PPTV /PPTVVERSION=3.1.5 ..." (UID: 00000000-00002792), Spawned process "PPAP.exe" with commandline "/RegServer" (UID: 00000000-00003096), Spawned process "hwcheck.exe" with commandline "-s -luminanceonly "%TEMP%\\hwcheck.mp4"" (UID: 00000000-00006328), Spawned process "RepairSetup.exe" with commandline "-codec" (UID: 00000000-00001996), Spawned process "PPAP.exe" with commandline "/LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 / ..." (UID: 00000000-00003360), Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00006064) Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00003752), Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00003336) Spawned process "PPAP.exe" with commandline "/LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?s ..." (UID: 00000000-00001080) Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00006060), Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%WINDIR%\\system32\\PPTVLaunc ..." (UID: 00000000-00003832) Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\Common ..." (UID: 00000000-00000600)5e:T852,Spawned process "regsvr32.exe" with commandline "regsvr32 /s "%PROGRAMFILES%\\(x86)\\Internet Explorer\\PPLite\\p ..." (UID: 00000000-00002124), Spawned process "SkinConverter.exe" (UID: 00000000-00004508), Spawned process "Rundll32.exe" with commandline ""%WINDIR%\\SysWOW64\\PPTVSvc.dll" RundllCmd -i" (UID: 00000000-00000796), Spawned process "Rundll32.exe" with commandline ""%WINDIR%\\SysWOW64\\PPTVSvc.dll" RundllCmd -start" (UID: 00000000-00005300), Spawned process "regsvr32.exe" with commandline "/s %WINDIR%\\system32\\kindling.dll" (UID: 00000000-00007680), Spawned process "firewall.exe" with commandline "/PPTVPATH=%PROGRAMFILES%\\(x86)\\PPLive\\PPTV /PPTVVERSION=3.1.5 ..." (UID: 00000000-00002792), Spawned process "PPAP.exe" with commandline "/RegServer" (UID: 00000000-00003096), Spawned process "hwcheck.exe" with commandline "-s -luminanceonly "%TEMP%\\hwcheck.mp4"" (UID: 00000000-00006328), Spawned process "RepairSetup.exe" with commandline "-codec" (UID: 00000000-00001996), Spawned process "PPAP.exe" with commandline "/LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 / ..." (UID: 00000000-00003360), Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00006064) Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00003752), Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00003336) Spawned process "PPAP.exe" with commandline "/LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?s ..." (UID: 00000000-00001080) Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive ..." (UID: 00000000-00006060), Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%WINDIR%\\system32\\PPTVLaunc ..." (UID: 00000000-00003832) Spawned process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\Common ..." (UID: 00000000-00000600)5f:T5cd,"peer.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GdiPlus.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "mir.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "VSFilter.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "chctrl.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "mframe.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "tpi.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "NCList.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PPOptions.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "uilib.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ui.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ProductUpdate.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "admodule.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "omng.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MngModule.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PPTVSvc.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "client_ap.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PPAP.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PPLive.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE60:T5515,"peer.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\peer.dll]- [targetUID: 00000000-00008164] "GdiPlus.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\GdiPlus.dll]- [targetUID: 00000000-00008164] "mir.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\live\mir.dll]- [targetUID: 00000000-00008164] "VSFilter.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\VSFilter.dll]- [targetUID: 00000000-00008164] "chctrl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\chctrl.dll]- [targetUID: 00000000-00008164] "mframe.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\mframe.dll]- [targetUID: 00000000-00008164] "tpi.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\live\tpi.dll]- [targetUID: 00000000-00008164] "NCList.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\NCList.dll]- [targetUID: 00000000-00008164] "PPOptions.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\PPOptions.dll]- [targetUID: 00000000-00008164] "uilib.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\uilib.dll]- [targetUID: 00000000-00001996] "uilib.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\uilib.dll]- [targetUID: 00000000-00001996] "ui.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\ui.dll]- [targetUID: 00000000-00008164] "ProductUpdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\ProductUpdate.dll]- [targetUID: 00000000-00008164] "admodule.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\admodule.dll]- [targetUID: 00000000-00008164] "omng.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\omng.dll]- [targetUID: 00000000-00008164] "MngModule.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\MngModule.dll]- [targetUID: 00000000-00008164] "PPTVSvc.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%WINDIR%\SysWOW64\PPTVSvc.dll]- [targetUID: 00000000-00008164] "mframe.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\mframe.dll]- [targetUID: 00000000-00008164] "client_ap.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PlugOut\client_ap.dll]- [targetUID: 00000000-00008164] "PPAP.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\PPAP.exe]- [targetUID: 00000000-00000600] "PPLive.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\PPLive.exe]- [targetUID: 00000000-00006064] "PPLiveU.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PPLiveU.exe]- [targetUID: 00000000-00008164] "PPP.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PPP.dll]- [targetUID: 00000000-00008164] "PPFrame.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\PPFrame.dll]- [targetUID: 00000000-00008164] "kindling.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%WINDIR%\System32\kindling.dll]- [targetUID: 00000000-00007680] "PPVodDownload.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PPVodDownload.dll]- [targetUID: 00000000-00008164] "IEBrowser.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\IEBrowser.dll]- [targetUID: 00000000-00008164] "TipsClient.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\TipsClient.dll]- [targetUID: 00000000-00008164] "uninst.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\uninst.exe]- [targetUID: 00000000-00008164] "PPDlna.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\PPDlna.dll]- [targetUID: 00000000-00008164] "Troubleshooter.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\Troubleshooter.dll]- [targetUID: 00000000-00001996] "filepick.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\filepick.dll]- [targetUID: 00000000-00008164] "crashreporter.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\crashreporter.exe]- [targetUID: 00000000-00008164] "crashreporter.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\crashreporter.exe]- [targetUID: 00000000-00008164] "pplugin2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll]- [targetUID: 00000000-00008164] "ppp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\ppp.dll]- [targetUID: 00000000-00008164] "Live.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\live\Live.dll]- [targetUID: 00000000-00008164] "h264_dec_filter.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\h264_dec_filter.dll]- [targetUID: 00000000-00008164] "PPTVLauncher.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System32\PPTVLauncher.exe]- [targetUID: 00000000-00008164] "CommonFuncDll.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nslDD05.tmp\CommonFuncDll.dll]- [targetUID: 00000000-00008164] "IEBrowser.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\IEBrowser.dll]- [targetUID: 00000000-00008164] "atl100.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\atl100.dll]- [targetUID: 00000000-00001996] "hwcheck.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe]- [targetUID: 00000000-00008164] "npplugin2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\npplugin2.dll]- [targetUID: 00000000-00008164] "PluginInstaller.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\PluginInstaller.exe]- [targetUID: 00000000-00008164] "FWUpnp.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\FWUpnp.dll]- [targetUID: 00000000-00008164] "IEProxy.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\IEProxy.dll]- [targetUID: 00000000-00008164] "sop.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\sop.dll]- [targetUID: 00000000-00008164] "Converter.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\Converter.dll]- [targetUID: 00000000-00008164] "ppopt.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\ppopt.dll]- [targetUID: 00000000-00008164] "Gallop.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\Gallop.dll]- [targetUID: 00000000-00008164] "pnsis.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\pnsis.dll]- [targetUID: 00000000-00008164] "gtapi_signed.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\gtapi_signed.dll]- [targetUID: 00000000-00008164] "firewall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\nslDD05.tmp\firewall.exe]- [targetUID: 00000000-00008164] "Loader.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\Loader.exe]- [targetUID: 00000000-00008164] "tipsdone.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\tipsdone.dll]- [targetUID: 00000000-00008164] "ckdll.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\ckdll.dll]- [targetUID: 00000000-00008164] "GetCommentsInfoDll.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\GetCommentsInfoDll.dll]- [targetUID: 00000000-00008164] "cknsis.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\cknsis.dll]- [targetUID: 00000000-00008164] "restore.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\restore.dll]- [targetUID: 00000000-00008164] "restore.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\restore.dll]- [targetUID: 00000000-00008164] "BindDLL.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nslDD05.tmp\BindDLL.dll]- [targetUID: 00000000-00008164] "RepairSetup.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe]- [targetUID: 00000000-00001996] "PPInstallLog.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nslDD05.tmp\PPInstallLog.dll]- [targetUID: 00000000-00008164] "PPBindDAC.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nslDD05.tmp\PPBindDAC.dll]- [targetUID: 00000000-00008164] "pprepair.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00008164] "logclient.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\logclient.dll]- [targetUID: 00000000-00008164] "SkinConverter.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe]- [targetUID: 00000000-00008164] "AsynDownload.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nslDD05.tmp\AsynDownload.dll]- [targetUID: 00000000-00008164] "KillProcDLL.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\KillProcDLL.dll]- [targetUID: 00000000-00008164] "FindProcDLL.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\FindProcDLL.dll]- [targetUID: 00000000-00008164] "InetLoad.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nslDD05.tmp\InetLoad.dll]- [targetUID: 00000000-00008164] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsn533E.tmp\System.dll]- [targetUID: 00000000-00008164] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsn533E.tmp\nsExec.dll]- [targetUID: 00000000-00002792] "time.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\time.dll]- [targetUID: 00000000-00008164] "GetVersion.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nslDD05.tmp\GetVersion.dll]- [targetUID: 00000000-00008164] "PPTV Website.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%ProgramFiles%\Common Files\PPLiveNetwork\1.0.1.1058\resource\ikan-p.ico" Archive ctime=Sat Apr 4 18:22:53 2026 atime=Sat Apr 4 18:22:53 2026 mtime=Sat Apr 4 18:22:53 2026 length=86 window=normal IDListSize 0x029f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\resource\PPTV.url""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PPLive\PPTV Website.lnk]- [targetUID: 00000000-00008164] "PPTV.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Has command line arguments Icon number=0 Unicoded HasExpIcon "%ProgramFiles%\PPLive\PPTV\PPLive.exe" MachineID paiutbjlkzokwba KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E Archive ctime=Mon May 14 08:47:58 2012 atime=Sat Apr 4 18:23:15 2026 mtime=Mon May 14 08:47:58 2012 length=461176 window=normal IDListSize 0x01c9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\PPTV.lnk]- [targetUID: 00000000-00008164] "PPTV .lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID paiutbjlkzokwba KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E Archive ctime=Mon May 14 08:47:58 2012 atime=Sat Apr 4 18:23:14 2026 mtime=Mon May 14 08:47:58 2012 length=461176 window=normal IDListSize 0x01c9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe""- Location: [%APPDATA%\Microsoft\Internet Explorer\Quick Launch\PPTV .lnk]- [targetUID: 00000000-00008164] "PPTV .lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID paiutbjlkzokwba KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E Archive ctime=Mon May 14 08:47:58 2012 atime=Sat Apr 4 18:23:03 2026 mtime=Mon May 14 08:47:58 2012 length=461176 window=normal IDListSize 0x01c9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PPLive\PPTV .lnk]- [targetUID: 00000000-00008164] "PPTV .lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID paiutbjlkzokwba KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E Archive ctime=Mon May 14 08:47:58 2012 atime=Sat Apr 4 18:23:14 2026 mtime=Mon May 14 08:47:58 2012 length=461176 window=normal IDListSize 0x01c9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe""- Location: [%PUBLIC%\Desktop\PPTV .lnk]- [targetUID: 00000000-00008164] "AVCVideoDec.ax" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 19 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\AVCVideoDec.ax]- [targetUID: 00000000-00008164] "OPlayer.ocx" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\OPlayer.ocx]- [targetUID: 00000000-00008164] "MP4Splitter.ax" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\MP4Splitter.ax]- [targetUID: 00000000-00008164] "HTTP_ASF_SOURCE.ax" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\HTTP_ASF_SOURCE.ax]- [targetUID: 00000000-00008164] "audioswitcher.ax" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\audioswitcher.ax]- [targetUID: 00000000-00008164] "CoreAAC.ax" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\player\CoreAAC.ax]- [targetUID: 00000000-00008164] "CoreAVC.2.0.0.0.ax" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 PECompact2 compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\CoreAVC.2.0.0.0.ax]- [targetUID: 00000000-00008164] "CoreAVC.ax" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\CoreAVC.ax]- [targetUID: 00000000-00008164] "myHistory.html" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\logPage\myHistory.html]- [targetUID: 00000000-00008164] "errorPage.htm" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\local\errorPage.htm]- [targetUID: 00000000-00008164] "cntvppl.html" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\cntvppl.html]- [targetUID: 00000000-00008164] "FreshPushWnd.htm" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\local\FreshPushWnd.htm]- [targetUID: 00000000-00008164] "pplive_schedule.html" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\pplive_schedule.html]- [targetUID: 00000000-00008164] "page.html" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\local\page.html]- [targetUID: 00000000-00008164] "page2.html" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\local\page2.html]- [targetUID: 00000000-00008164] "nolink.htm" has type "HTML document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\data\local\nolink.htm]- [targetUID: 00000000-00008164] "PPTV.url" has type "MS Windows 95 Internet shortcut text ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\resource\PPTV.url]- [targetUID: 00000000-00008164] "PPLive.url" has type "MS Windows 95 Internet shortcut text ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PPLive.url]- [targetUID: 00000000-00008164]61:Ta36,"PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000352-0000-0000-C000-000000000046}"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000352-0000-0000-C000-000000000046}"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000352-0000-0000-C000-000000000046}"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000352-0000-0000-C000-000000000046}"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\PROGID"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\PROGID"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\TREATAS"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\TREATAS"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\INPROCSERVER32"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\INPROCSERVER32"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\INPROCHANDLER32"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\INPROCHANDLER32"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\INPROCHANDLER"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\INPROCHANDLER"; Key: ""; Value: "")62:T1355,"peer.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\peer.dll]- [targetUID: 00000000-00008164] "GdiPlus.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\GdiPlus.dll]- [targetUID: 00000000-00008164] "mir.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\live\mir.dll]- [targetUID: 00000000-00008164] "VSFilter.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\player\VSFilter.dll]- [targetUID: 00000000-00008164] "chctrl.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\chctrl.dll]- [targetUID: 00000000-00008164] "mframe.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\mframe.dll]- [targetUID: 00000000-00008164] "tpi.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\kernel\live\tpi.dll]- [targetUID: 00000000-00008164] "NCList.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\NCList.dll]- [targetUID: 00000000-00008164] "PPOptions.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\PPOptions.dll]- [targetUID: 00000000-00008164] "uilib.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\uilib.dll]- [targetUID: 00000000-00001996] "uilib.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\uilib.dll]- [targetUID: 00000000-00001996] "ui.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\ui.dll]- [targetUID: 00000000-00008164] "ProductUpdate.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\ProductUpdate.dll]- [targetUID: 00000000-00008164] "admodule.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\admodule.dll]- [targetUID: 00000000-00008164] "omng.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\omng.dll]- [targetUID: 00000000-00008164] "MngModule.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\MngModule.dll]- [targetUID: 00000000-00008164] "PPTVSvc.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%WINDIR%\SysWOW64\PPTVSvc.dll]- [targetUID: 00000000-00008164] "mframe.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\mframe.dll]- [targetUID: 00000000-00008164] "client_ap.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PlugOut\client_ap.dll]- [targetUID: 00000000-00008164] "PPP.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PPP.dll]- [targetUID: 00000000-00008164] "PPFrame.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\components\PPFrame.dll]- [targetUID: 00000000-00008164] "kindling.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%WINDIR%\System32\kindling.dll]- [targetUID: 00000000-00007680] "PPVodDownload.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\PPVodDownload.dll]- [targetUID: 00000000-00008164] "IEBrowser.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\IEBrowser.dll]- [targetUID: 00000000-00008164] "TipsClient.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\TipsClient.dll]- [targetUID: 00000000-00008164]63:Tdcc,"PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}"; Key: ""; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "WAITFORRESTORE"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "PPTV_pplive__forap_1084_9993.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "")64:T478,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Queries physical drive (often used to detect virtual machines) Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to delay the execution of current thread65:T625,"PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\PPTV_pplive__forap_1084_9993.exe" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "PPTV_pplive__forap_1084_9993.exe" trying to touch file "C:\Windows\SysWOW64\shell32.dll"66:T9cd,"PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\PPLive\PPTV\InstallLog.txt" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\InstallLog.txt" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Internet Explorer" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\npplugin2.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\PluginInstaller.exe" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\mframe.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\ppp.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\version.dat" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\Converter.exe" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\Converter.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\MngModule.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\crashreporter.exe" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\uilib.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\TipsClient.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\tipsdone.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\EROTSER.dat" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\restore.dll" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Program Files (x86)\Common Files\PPLiveNetwork\1.0.1.1058\IEBrowser.dll"67:T6f9,"PPTV_pplive__forap_1084_9993.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\6LDIEKEG\bind_en-us[1].ini" "PPTV_pplive__forap_1084_9993.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "PPTV_pplive__forap_1084_9993.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "PPTV_pplive__forap_1084_9993.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "PPTV_pplive__forap_1084_9993.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "PPTV_pplive__forap_1084_9993.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\6LDIEKEG\bind_en-us[1].ini" "PPTV_pplive__forap_1084_9993.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "RepairSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "RepairSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "RepairSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "RepairSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "PPAP.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "PPAP.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "PPAP.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "PPAP.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "PPAP.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "PPAP.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"68:Tb5b,"PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\CFGMGR32.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\System.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\FindProcDLL.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\KillProcDLL.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\InetLoad.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\WININET.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\profapi.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\atl100.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\msvcp100.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\msvcr100.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\PPInstallLog.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\MFC42.DLL" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\WINDOWS\system32\MFC42LOC.DLL" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\WINDOWS\system32\MFC42LOC.DLL.DLL" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\time.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\GetCommentsInfoDll.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\cknsis.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\AsynDownload.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\CommonFuncDll.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nslDD05.tmp\WINMM.dll" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"69:T566,"PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "\Device\RasAcd" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\NOISREV.DAT" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\Program Files" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\Program Files (x86)" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\ProgramData\PPLive" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\MFC42.DLL.mui" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Program Files (x86)\Internet Explorer\PPLite" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\PPLiveNetwork\product.ini" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\PPLiveNetwork\kernel" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\mswsock.dll.mui" "PPTV_pplive__forap_1084_9993.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\wshqos.dll.mui"6a:T42b,"PPTV_pplive__forap_1084_9993.exe" writes a file "%PROGRAMFILES%\(x86)\Internet Explorer\PPLite\plugin\version.dat" "PPTV_pplive__forap_1084_9993.exe" writes a file "%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\1.0.1.1058\EROTSER.dat" "PPTV_pplive__forap_1084_9993.exe" writes a file "%PROGRAMFILES%\(x86)\Common Files\PPLiveNetwork\version.dat" "PPTV_pplive__forap_1084_9993.exe" writes a file "%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\NOISREV.DAT" "PPTV_pplive__forap_1084_9993.exe" writes a file "%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\ETADPU.DAT" "PPTV_pplive__forap_1084_9993.exe" writes a file "%PROGRAMFILES%\(x86)\PPLive\PPTV\3.1.5.0065\EROTSER.dat" "PPAP.exe" writes a file "C:\ProgramData\PPLive\PPTV\Cache\TrustUpload\2026040411232933601.dat" "PPAP.exe" writes a file "%ALLUSERSPROFILE%\PPLive\PPTV\Cache\TrustUpload\2026040411232933601.dat" "PPAP.exe" writes a file "C:\ProgramData\PPLive\PPTV\Cache\TrustUpload\2026040411233910801.dat" "PPAP.exe" writes a file "%ALLUSERSPROFILE%\PPLive\PPTV\Cache\TrustUpload\2026040411233910801.dat"6b:T7e8,file/memory contains long string with (Indicator: "pplive.exe"; File: "PPAP.exe") file/memory contains long string with (Indicator: "pplive.exe"; File: "PPLive.exe") file/memory contains long string with (Indicator: "pplive.exe"; File: "PPLiveU.exe") file/memory contains long string with (Indicator: "pplive.exe"; File: "Live.dll") file/memory contains long string with (Indicator: "pplive.exe"; File: "CommonFuncDll.dll") file/memory contains long string with (Indicator: "pplive.exe"; File: "tipsdone.dll") Found string "/C:\PROGRA~2PPLivePPTVPPLive.exeC:\Program Files (x86)\PPLive\PPTV\PPLive.exe%ProgramFiles%\PPLive\PPTV\PPLive.exepaiutbjlkzokwba1SPS1SPS|O)Dv< -uV" (Indicator: "pplive.exe"; File: "PPTV.lnk") Found string "/C:\PROGRA~2PPLivePPTVPPLive.exeC:\Program Files (x86)\PPLive\PPTV\PPLive.exepaiutbjlkzokwba1SPS1SPS|O)Dv< -uV" (Indicator: "pplive.exe"; File: "PPTV .lnk") Found string "%PROGRAMFILES%\(x86)\PPLive\PPTV\PPLive.exe" (Indicator: "pplive.exe"; Source: "00000000-00008164-00000BBE-3770260364") Found string ""%PROGRAMFILES%\(x86)\PPLive\PPTV\PPLive.exe" "-LoadModule" "Components\PPOptions.dll" "-pplink" " "%1"" (Indicator: "pplive.exe"; Source: "00000000-00008164-00000BC1-3770646479"), Found string "PPLive.exe" (Indicator: "pplive.exe"; Source: "00000000-00008164-00000BC1-3770647686"), Found string "netsh firewall add allowedprogram "%PROGRAMFILES%\(x86)\PPLive\PPTV\PPLive.exe" PPLive Enable" (Indicator: "pplive.exe"; Source: "00000000-00002792-00000C46-6421751222"), Found string ":\Program Files (x86)\PPLive\PPTV\PPLive.exe" (Indicator: "pplive.exe"; Source: "00000000-00000600.00000000.309551.033D6000.00000004.mdmp"), Found string "PPLive.exe" (Indicator: "pplive.exe"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp 00000000-00001080.00000001.308933.00E1D000.00000002.mdmp 00000000-00001080.00000001.308933.00E22000.00000002.mdmp"), Found string "PPLive.exe" (Indicator: "pplive.exe"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")6c:T1162,Found reference to API "Failed to InternetReadFile. GetLastError()==%u" (Indicator: "InternetReadFile"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "HttpQueryInfo's dwCode==%u" (Indicator: "HttpQueryInfo"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "Failed to HttpQueryInfo. GetLastError()==%u" (Indicator: "HttpQueryInfo"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "Failed to HttpSendRequest. GetLastError()==%u" (Indicator: "HttpSendRequest"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "Failed to HttpOpenRequest. GetLastError()==%u" (Indicator: "HttpOpenRequest"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "Failed to InternetConnect. GetLastError()==%u" (Indicator: "InternetConnect"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "Failed to InternetOpen. GetLastError()==%u" (Indicator: "InternetOpen"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp, 00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp, 00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "Failed to InternetReadFile. GetLastError()==%u" (Indicator: "InternetReadFile"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "HttpQueryInfo's dwCode==%u" (Indicator: "HttpQueryInfo"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found reference to API "Failed to HttpQueryInfo. GetLastError()==%u" (Indicator: "HttpQueryInfo"; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")6d:T76fa,Found string "!This program cannot be run in DOS mode.mRich.text`.rdata@.data.rsrc@.relocSVWjQZ^&t19QQQSV@PVPG?Y;@Y9]_^[]jxY+$_^3_^[]?PSV~_^]@_^[]PjihN(WPhPWWh+N(WPh|N(hDN(WWN(h0tEHt;Ht1Ht'HtN(W9N(WuN(Wut9ut0;Mt6hpt5hXtBhpvH9]r!f9\Nv$f9\Nf9\N_^[]zuH3VVVVWQQSV@PVPt%WhSVW3t.WVh[_^]_^[]_^[][_^]RPVQ@PVW#tS3YY!uPVhHuGh\t4h<8#tRt!jdPt!jdP^@[]_[^]E QRQQSVW3tW9}t)SP?w5j@_^[]QSVh@FtuPPu"h$vtj2hQQSVWjPjSFt tTFt@u_^[|Ph9|pSVWtm9uthf9s@f9s@9srPjjh`wQt,Hw3t*HuNhtuh`u-hHRSPQWSSPVzu*WWSSPVVVVVVVVVtUVVVVhpt$9E9>tSfYWVPPjmh4ShXt*ItHtjHt7Ht,Ht!HtPSSjPShh9>t.hpt_^]@_^]vqSVSW9EwV+E_[^]SW9Ew^+E_[^]PVVVw 9Fv|+][_^]_^[]PSSjPShLYPSWYPSW@u]huS9]tNhXPWWjYYhPYPWVYPWSYPVWYtUhhYPWVYtJhh$+ESSSPSSSSjt=WPSSjVSh`YVSS>_^]8Yat8Zat8Yat8Zat8Yau8Yau-8Zau8Zat8Zat_[^]Pj}hj0hxPj~hj0hxj0hxj0hxSShGj0hxt7;p,;0uPjxhPPjsht/h6WWWt_^]z,.uB.f;.uf9r0u_^[]WWWWhF4;F(t>P;w(uB@;E9^xt9W3^x_^3VWSj0SW3tr9}_^[]XjPfQh~f_^[]jASS9~TuuZWSYY9~tu PWj9{tuYY9~tuv4SP?QPWv4SP?QPWYYSj9^tuu6Wj9_tuPjohtt/VVhTtVVhSVWPY_^[WPh(j4XPYYVjSWh`QPVhUpSVWhPjph9~\~a98tQC;^\|t/htt8Ht,Ht"HtHu(9Fd9XWWh#RSSSjt89E_^[]_^[]SSSSU`YjX9EtsMD9EXsM(9EuRVhXu(hL^[_]u9Eq(9>u^_[]P@f;f;A,s3@,F;|89ut3h`E VWu\f9FP,^]s,W3_^[]s,W3_^[]tfS9~P([_^][_^]u(hL^[_]SVW3_^[]E VWjD_WQVPVQVVVSVVPVRWPueYPWVtTh tQh YYPjtQh tQh PjWtth YYPh@tgh 97uDWhPVVVPjohtu5Wjt$9G0tQVh8_^[]rVj<^VSSSjQWhTSSSSWv7=,v)Pht]ShSVWPY_^[_^[]NK;]SSSPSSSSjWSSjtyWPt*PWPVVVVVVtHWh_VVjWWVPWWVP|L9}VSWP9p4u3VQGYY;tB9^Tt=pTQRSt'SWY_[3t6SWF$_[;_[3X_^]VQPhYY_^VWh0PWVWWW_^[tQQV3SVWPY_^[v@YYKYYut$hhOYYuNYYuYY_^[]OYYu_^[]@t19}F PhxPYY;YY_^[xuFJ;< s(SSSj8^DtSSSjQSVWYYVhFDSPF`SPYY_^[]WWWj_^[]VWjDVWjDNt3Nt"Ntt{Otm_^[]W9^0v#C;^0r>_u=QSVWuN8]Fp^]t_<QQQj>t7Sj<t#SVPWt(PWV@_^[VWuuYj@9~$~ x9;~$}4G;~$|t%VhY__^[8csmWVS3QQS3VW9E@_^[u WPSuCWVSt%WVSY__^[_^[]Y_^[Y_^[R SQPinvalid string positionstring too longzHr,g_gq1Y%[0W:S0W:S/f&To/f&T4x(u7b/f&TV(u7b{veQ(u7b(u7b{veQ*g{veQ{veQGetObjectManager;`zziRYOzzvHr,gNX[(WvHr,gHr,gHr,gQ8hHr,gQ8hHr,gzHr,gGetNativeSystemInfoRegOpenKeyTransactedWRegCreateKeyTransactedWSHCreateItemFromParsingName127.0.0.1CommonFunc_check.cppL09nWow64RevertWow64FsRedirectionWow64DisableWow64FsRedirectionwww.pptv.comwww.sina.com.cn.pptv..pplive.[.ShellClassInfo]IconResource=%s,0.PPTV..PPLIVE.ShowProblems.xmlhKm0R[hQohKm0R[hQo[hQo[hQoAccessCheck() failed with error %luvector too long~Hr gGetProductInfoSetupDiDestroyDeviceInfoListSetupDiGetDeviceRegistryPropertySetupDiEnumDeviceInfoSetupDiGetClassDevsSetupDiClassGuidsFromNamedisplay>faS>f:yhVrm:N:>f:yhV s:N:S_MR(u7btXTCgPtXTCgPS_MR(u7b/f~Hr,g*gCreateFileTransactedWQ8h,g0WWrite Test_1Y%NX[(WN_cOWpeercachepathQCgPQCgPd>ehVHr,gS1Y%d>ehVRS1Y%C:\FavoriteVideoX['Yck8^!j6R!j~xQ!jcpezf*g/T(u/T(uW@$xBMYVIx%`l3RegDeleteKeyTransactedWpptv plugin|$[PLUGINS]hKm0RhVck(W`Onxenabled": truefalseenabledPPLive PPTV Plugin"plugins":_8^!N!k(u7bS1Y%ck(WW@$xBmap/set too long:NzzT\PbkO(upHr,gN(u,eHr,gQ1Y%FO/f^8^aSinvalid map/set iterator------------------Content-Type: text/plain; filename="Content-Disposition: form-data; name="FindFirstFileTransactedWABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/?456789:;<= !"#$%&'()*+ -./0123IcmpSendEcho2 returned error: %ldCall to IcmpSendEcho2 failed. Roundtrip time = %ld milliseconds Status = %ld Received from %sInformation from this response:Received %ld icmp message responseInformation from the first response:Received %ld icmp message responsesUnable to allocate memory for reply bufferIcmpCreatefile returned error: %ldUnable to open handle.Data BufferIcmpCloseHandleIcmpSendEcho2IcmpCreateFileapi.passport.pptv.comg1Y%pplivetimestampcatalogsplayN1Y%S_MRS_MRS_MRc6R!jWW1Y%S1Y%c6R!jWWOo`lOo` Oo` g0WOo`1Y%]/T(u0W@WGetPerAdapterInfo.htmllist.client.pplive.cn/v3/index/sync.client.pplive.cnclient-search.pptv.comclient-searchtips.pptv.comclient-list.pptv.comclient-play.pptv.comRhV RhV RhV ejmIejm ejm !jWWS1Y%S1Y%S1Y%RmsuUnRegisterTypeLibForUserRegisterTypeLibForUserA7W;RmsZTroubleShooterCreateProcessWithTokenWAdvapi32.dll-codecCommonFunc.cppsignaturefileinfoversionCodes %s-->standalone="%s" encoding="%s" version="%s" &#x%02X;%s='%s'%s="%s".uEV>*VutG;}nt4Htj _;h 6Bh`4Bhd4Bht4Bh|4Bh 5Bh<5BhD5BhL5BmhT5BShp5Bt!SWY_[3RSPQs W3$9>uQQSV#SSSSWSSSWF$_^[9~4ut6hl9Bt5hT9BtBhl9B9>t.hl9Bt_^]@_^]q(9>uWhpuB^_[]sj'Xf_^[]j'Yf;j'Yf;~n;Fj'Yf;PPPPPPPQPPPPVVV=t2Bh8:Bj'Yf;_^[]^[_]x*;wx ;~91tSVWPY_^[SVWPt!SSVSSW?{uGW}9]?{u>WY_^[_[^]|Pj{Xf;]j"Xfj"YfPhdB5h3Bh ?BhtEBF hhFBh0GB=NB10u&j]=RSDSuVjh,JBhDJBh`JBPhhJBh$KB=@2Bh@KBhPKBh\KBhhKBhtKBh0LBPh`LBhDLBhlXB@h8YBh@YB*h|YBhPZBh0\BhL\B6YPWjPh\\Bh`\B[_^]_^[]t'HtHHu)hhABhLABh4ABhd?BSVWP5L2Bh\HBh4FBhdHBhtHBY_^[hlRBh_uEW_^[]F@^]te<>[uQQSVWG F;0rG?>t2SWPj<'uSQhSQh mB_^[]h4mBh8mBh@mBWShHmBLWShTmBSVj0^VC([]_^[]@_^]QSV3= 2B9wA;@uB;RPhlnB91tWWWQt*Wj_^[]SSSQ?PSV~_^]@_^[];w(uhc(Bh888hY(BhToB_^[]8^5tr.8^4u58^5tju"SjPSSVF$tJ9X8^4t&9Xt&9XF ,uBF$$uBtRjD[SPWWWWWWhhoBh0pBhXqBFh888QQSVW3hXrBh sBh0tB_^[]F ,uBF$$uBQSVWh`mB5$3Bt$j!Sj!HPhtmBh|mB_^[]~,_^]t(PWV@_^[VWu=x1BuYj@9~$~ x9;~$}4G;~$|Vu<+t:f; SW3QQSVWdQSVWY__^[hcsmtaSVYYPVt)SVHu4j=MOCt*=RCC;7|G;p9>u&tR99u2r 9Y@_^[]hnaAt!Ht_^[]h jAY_^[Y_^[h jAY__^[9csm=tzBt htzBPPPPPtf9>t>=uuf9>tf9>tURPQQhL$,3UVWS[_^]SVWj_^[]=unFuNSW@u^Vt%HHtHHt$HHt5l1BRPWS90tW?If90tYYt.9M$u<+t"<-t+t HHt80t/PPPPPSQRPjdRP@PVS@PVSWj0S|-;EVVVVV@u^Vt$HHtHHt$HHt5l1BRPWS90tXYYt.9]$u9](SSt"SS9] u8csm wf"u3tAVWPY[_^PPPPP8"u8tj\Yft$9UQQSVWh9] SSv4;5vL;5PPPPPPPPPPPPPPPPJvf;Jvf;Jvf;Jvf;Jvf;Jvf;Jvf;vN+D$VVhU~%9MQVjr 8^SVWUj]_^[;t$,v-UQPXY]Y[5h1B5l1B5HC=LC_^[]j@j tCHt(Ht 3t(;SSSSSt(9}SW9Et?f;Vuy3tCHt(Ht 3t(;SSSSSt(9}te9]1f;pr+f;ptG9]1f;Hr+f;Hu!f;t9]QSWVjr"9Ur"9USSSSWSSSSW@PWV_^[]PPPPPWVU3vN+D$u09ESVW3_^[uPPPPPu-h$u"9Uu9pu9E;9u0K;]@tH9%P3B%L3B%T3B%t1Bh-(Bh8aBSpe,CommandLineInfo.cppSpe CommandLineInfo.cppCommandLineInfo.cppvector too longCrashReporter.cppRegOpenKeyTransactedWRegCreateKeyTransactedWRegDeleteKeyTransactedWF8:BCrashReporterHelper.cpp^1Y%CrashReporterHelper.cppg>NS_MR(u7bBR1Y%CrashReporterHelper.cppCrashReporterHelper.cpp^1Y%CrashReporterHelper.cppCrashReporterHelper.cppz1Y%CrashReporterHelper.cppCrashReporterHelper.cpp:Nzz.CrashReporterHelper.cppCrashReporterHelper.cppCrashReporterHelper.cpp..;.;%_NT_SYMBOL_PATH%;%_NT_ALTERNATE_SYMBOL_PATH%;CrashReporterHelper.cppS1Y%CrashReporterHelper.cppRD_XXXXQpe0W@W,CrashReporterHelper.cppCrashReporterHelper.cpp_,g0WCCrashReporterHelper.cppCrashReporterHelper.cppNX[(W,CrashReporterHelper.cppCrashReporterHelper.cppN O1Y%CrashReporterHelper.cpp^1Y%CrashReporterHelper.cppCrashReporterHelper.cppNX[(W,CrashReporterHelper.cppN OUNX[(W.CrashReporterHelper.cppCrashReporterHelper.cppN1Y%CrashReporterHelper.cppCrashReporterHelper.cpp^1Y%CrashReporterHelper.cpp--7d2227629012eContent-Disposition: form-data;name="--7d2227629012eContent-Disposition: form-data;name="MiniDump"; filename="pplcrashdump.gz"Content-Encoding: gzipContent-Transfer-Encoding: binary--7d2227629012edeflateInit2_Q1Y%deflateQ1Y%deflateEndQ1Y%crc32Q1Y%1.2.3MiniDump Upload Result. Msg:MiniDump Upload Result. Error:MiniDump Upload Result. Url:CrashReporterHelper.cppstring too longinvalid string positionSymFromAddrSymGetModuleInfoW64MiniDumpWriteDumpSymGetModuleBase64SymFunctionTableAccess64StackWalk64SymCleanupSymInitialize&#x%02X; %s="%s"%s='%s' %s--> ?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~bad exceptionUTF-8UTF-16LEUNICODE(null)( 8PX700WP`h````xpxxxxe+000('8PW700PP`h`hhhxppwpp Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__eabi__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based( !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~GetProcessWindowStationGetUserObjectInformationWGetLastActivePopupGetActiveWindowMessageBoxW1#QNAN1#INF1#IND1#SNANf7~P`Aq;oFX{os3(6kInterlockedDecrementlstrlenWInterlockedIncrementlstrlenADebugBreakOutputDebugStringWRaiseExceptionEnterCriticalSectionLeaveCriticalSectionGetLastErrorInitializeCriticalSectionAndSpinCountDeleteCriticalSectionFlushInstructionCacheGetCurrentProcessGetCurrentThreadIdGetProcAddressGetModuleHandleWlstrcmpiWSetLastErrorFreeLibraryMultiByteToWideCharSizeofResourceLoadResourceFindResourceWLoadLibraryExWGetModuleFileNameWCloseHandleSetEventOpenEventWWideCharToMultiByteWriteFileLoadLibraryWDeleteFileWGetTempPathWGetEnvironmentVariableWCreateFileWGetLocalTimeGetFileSizeIsBadReadPtrReadFileSetFilePointerFlushFileBuffersWritePrivateProfileStringWGetPrivateProfileIntWGetPrivateProfileStringWOpenProcessOutputDebugStringAGetExitCodeThreadWaitForSingleObjectGetTickCountMulDivlstrcpyWCreateProcessWKERNEL32.dllLoadStringWCharNextWSetWindowLongWShowWindowDispatchMessageWTranslateMessageGetMessageWPeekMessageWDestroyWindowCreateDialogParamWDefWindowProcWDrawTextWGetClientRectInvalidateRectLoadBitmapWReleaseDCGetDCBeginPaintEndPaintCallWindowProcWGetWindowLongWGetSysColorSendMessageWPostMessageWSetWindowTextWGetWindowTextWGetWindowTextLengthWShowScrollBarSetWindowPosRegisterWindowMessageWPtInRectCreateWindowExWScreenToClientEnableWindowSetFocusGetDlgCtrlIDGetDlgItemIsDialogMessageWSetWindowRgnIsWindowMapWindowPointsGetMonitorInfoWMonitorFromWindowGetWindowRectGetWindowGetParentSetCursorLoadCursorWLoadImageWPostQuitMessageReleaseCaptureGetCaptureDrawEdgeWindowFromPointClientToScreenGetCursorPosGetSystemMetricsUSER32.dllSelectObjectSetBkModeSetTextColorLineToExtTextOutWSetBkColorCreatePenMoveToExDeleteObjectCreateFontIndirectWCreateCompatibleDCSetViewportOrgExCreateCompatibleBitmapDPtoLPGetDeviceCapsDeleteDCBitBltTextOutWCreateSolidBrushExtCreateRegionGetStockObjectSetTextCharacterExtraGDI32.dllRegOpenKeyExWRegCreateKeyExWRegDeleteKeyWRegDeleteValueWRegCloseKeyRegSetValueExWRegQueryInfoKeyWRegEnumKeyExWADVAPI32.dllSHGetFolderPathWShellExecuteWSHELL32.dllCoTaskMemAllocCoTaskMemReallocCoCreateInstanceCoTaskMemFreeCoUninitializeCoInitializeCoCreateGuidole32.dllOLEAUT32.dllStrToIntWStrToIntExWPathAppendWPathRemoveFileSpecWPathFindFileNameWPathFileExistsWPathRemoveExtensionASHLWAPI.dllInitCommonControlsEx_TrackMouseEventCOMCTL32.dllPPTVLogOutWuilib.dllHttpEndRequestWInternetWriteFileHttpSendRequestExWInternetCloseHandleInternetReadFileHttpAddRequestHeadersWHttpOpenRequestWInternetConnectWInternetOpenWWININET.dllVerQueryValueWGetFileVersionInfoWGetFileVersionInfoSizeWVERSION.dllGdiplusShutdownGdiplusStartupGdipFreeGdipAllocGdipDeleteBrushGdipDeleteGraphicsGdipDeleteFontGdipDisposeImageGdipCreateBitmapFromFileGdipCreateBitmapFromFileICMGdipCreateBitmapFromScan0GdipCreateSolidFillGdipCreateFromHDCGdipGetImageGraphicsContextGdipGetDCGdipReleaseDCGdipSetInterpolationModeGdipDrawStringGdipDrawImageIGdipDrawImageRectIGdipCreateFontFromDCGdipCreateFontFromLogfontWGdipCloneBrushGdipCloneImagegdiplus.dllInterlockedCompareExchangeInterlockedPushEntrySListHeapFreeGetProcessHeapHeapAllocIsProcessorFeaturePresentVirtualFreeVirtualAllocInterlockedPopEntrySListRtlUnwindExitProcessDecodePointerEncodePointerExitThreadCreateThreadGetCommandLineWHeapSetInformationGetStartupInfoWUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentTerminateProcessGetCPInfoGetACPGetOEMCPIsValidCodePageTlsAllocTlsGetValueTlsSetValueTlsFreeGetStringTypeWGetStdHandleHeapCreateHeapReAllocHeapSizeSleepSetHandleCountGetFileTypeLCMapStringWFreeEnvironmentStringsWGetEnvironmentStringsWQueryPerformanceCounterGetCurrentProcessIdGetSystemTimeAsFileTimeGetConsoleCPGetConsoleModeSetStdHandleCreateFileAWriteConsoleWSetEndOfFileUnregisterClassA.?AVCAtlException@ATL@@.?AVbad_alloc@std@@.?AVexception@std@@.?AVCCommandLineInfo@@.?AVCComModule@ATL@@.?AV?$CAtlModuleT@VCComModule@ATL@@@ATL@@.?AVCAtlModule@ATL@@.?AU_ATL_MODULE70@ATL@@.?AVCRegObject@ATL@@.?AUIRegistrarBase@@.?AUIUnknown@@.?AVCAppModule@WTL@@.?AVCMessageLoop@WTL@@.?AVCreateFinishNotify@@.?AVTiXmlDocument@@.?AVTiXmlNode@@.?AVTiXmlBase@@.?AVCMyStaticText@@.?AV?$CWindowImpl@VCMyStaticText@@V?$CStaticT@VCWindow@ATL@@@WTL@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@.?AV?$CWindowImplBaseT@V?$CStaticT@VCWindow@ATL@@@WTL@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@.?AV?$CWindowImplRoot@V?$CStaticT@VCWindow@ATL@@@WTL@@@ATL@@.?AV?$CStaticT@VCWindow@ATL@@@WTL@@.?AVCWindow@ATL@@.?AVCMessageMap@ATL@@.?AVCScrollEdit@@.?AV?$CWindowImpl@VCScrollEdit@@V?$CEditT@VCWindow@ATL@@@WTL@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@.?AV?$CWindowImplBaseT@V?$CEditT@VCWindow@ATL@@@WTL@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@.?AV?$CWindowImplRoot@V?$CEditT@VCWindow@ATL@@@WTL@@@ATL@@.?AV?$CEditT@VCWindow@ATL@@@WTL@@.?AVTiXmlAttribute@@.?AVTiXmlComment@@.?AVTiXmlDeclaration@@.?AVTiXmlText@@.?AVTiXmlUnknown@@.?AVTiXmlElement@@.?AVImage@Gdiplus@@.?AVGdiplusBase@Gdiplus@@.?AVBrush@Gdiplus@@.?AVBitmap@Gdiplus@@.?AVCMessageFilter@WTL@@.?AVCIdleHandler@WTL@@.?AVSolidBrush@Gdiplus@@.?AVCSkinButton@@.?AV?$CWindowImpl@VCSkinButton@@V?$CButtonT@VCWindow@ATL@@@WTL@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@.?AV?$CWindowImplBaseT@V?$CButtonT@VCWindow@ATL@@@WTL@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@.?AV?$CWindowImplRoot@V?$CButtonT@VCWindow@ATL@@@WTL@@@ATL@@.?AV?$CButtonT@VCWindow@ATL@@@WTL@@.?AVCUploadDlg@@.?AV?$CDialogImpl@VCUploadDlg@@VCWindow@ATL@@@ATL@@.?AV?$CDialogImplBaseT@VCWindow@ATL@@@ATL@@.?AV?$CWindowImplRoot@VCWindow@ATL@@@ATL@@.?AVlogic_error@std@@.?AVlength_error@std@@.?AVout_of_range@std@@.?AVtype_info@@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.?AVbad_exception@std@@kU'9HMXB?Zd;?/L[S;uDz?aUYD?$?U>c{zc%C1.:3q-64OSNKebnnnnnnnnnnnnn"""""""""""""(((((((((((((,,,,,,,,,,,,,2222222222222;;;;;;;;;;;;;nnnnnnn@@@@@@@@@@@@@nnnnnnnnzIIIIIIIIIIIIIIIIIIIIIIIIIIzzMMMMMMMMMMMMMMMMMMMMMMMMzzUUUUUUUUUUUUUUUUUUUUUUzzXXXXXXXXXXXXXXXXXXXXzz]]]]]]]]]]]]]]]]]]zzddddddddddddddddzzmmmmmmmmmmmmmmzzuuuuuuuuuuuuzz{{{{{{{{{{z}xjgjty~}{{uur[[[ccjy~}{uqmmll\JHPP[gt~}{qmld]]]]Y81>P[gyuqlaXUUMNUK1>P[j~{qlaWMGA=AAGN />Pct{ulaUNA=-33=31P[j~{mdXNA3$''0/HPg~C}ul]UA=0 +BHPhwqdXNA3'GUQPvqdXG=0!AU]esdUS:9!-AU]mw~S=0-.AU]muLA:!$ /!0=GUamu??C4$-3ANXdq{*.9-D!-00=GU]lu{D9:C3=K_`dq{pPO<<**BBVgj\TF15&%%&&%%%%%%%///////a999999999999999aLEEEEEEEEEEEEELOJJJJJJJJJJJO][[[[[[[[[]d```````dpkkkkkp|www|zrqigmtv|kkheVKT\mtuke]WRR;-?TmvkdRH><>7"-?YtoeR>2*&,2-Nf}Ask]G2&0Kb{$hR<,8FPjCQ6.6J`n{S@'8J`j'>Ldp!)! +Quuuuuuuuu`dTKRuuuuu6N'{T%FP&6U+[I$R)8b'G[7i7=]>SF#9D"[D"VR.h,V\;Q[bA''X;ck(W6e PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING171M1i14A5k5;4;Q;n;<97G7N7o77R8h88*9B9d9;Q;Z;p;=L=s=0'0<0A0p01!1)1S1o1444O46B6p66G7e7;Z;k;t;;k#>->4>T>^>e>?%?U?_?f?A0j0z00i1~12*2:2J2Z2u23 434;4H48+8<8h8u8{8889G9Z9a9l9}9:2:A:H:Q:W:c:n:t:;%;:;F;};<0<>I>W>y>>%?F?O?g?00Q0]0c0o0u01+1X1]1p12I2m2v2~23 313>3h34 4'4H4w44;5F5L5l5r56C6P6U6b68\9b99$:.:5:T:^:e:;L;S;;0>:>A>x>?!?'?>?H?O?y?0+030<0R0`01)101E1M1S1X1b1i11n2x23L3d3t34)404?4I4"; File: "crashreporter.exe"), Found string "Content-Type: multipart/form-data; boundary="; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp"), Found string "Content-Disposition: form-data; name=""; Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp")6e:T41e,Process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive\\PPTV\\PPLive.exe" PPLive Enable" (UID: 00000000-00006064) Process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive\\PPTV\\3.1.5.0065\\PPLiveU.exe" PPLiveU Enable" (UID: 00000000-00003752) Process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive\\PPTV\\3.1.5.0065\\RepairSetup.exe" RepairSetup.exe Enable" (UID: 00000000-00003336) Process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\PPLive\\PPTV\\3.1.5.0065\\CrashReporter.exe" CrashReporter.exe Enable" (UID: 00000000-00006060) Process "netsh.exe" with commandline "netsh firewall add allowedprogram "%WINDIR%\\system32\\PPTVLauncher.exe" PPTVLauncher Enable" (UID: 00000000-00003832) Process "netsh.exe" with commandline "netsh firewall add allowedprogram "%PROGRAMFILES%\\(x86)\\Common Files\\PPLiveNetwork\\PPAP.exe" PPLive Enable" (UID: 00000000-00000600)6f:T58a,"3.1.5.0065" "1.0.0.1" "36.155.28.112" Potential IP "127.0.0.1" found in string "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&speedlimit=100&source=9" Potential IP "127.0.0.1" found in string "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&speedlimit=100&%s&source=9" Potential IP "127.0.0.1" found in string "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&source=11" Potential IP "127.0.0.1" found in string "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&%s&source=11" "0.0.0.0" Potential IP "127.0.0.1" found in string "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&source=10" Potential IP "127.0.0.1" found in string "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&%s&source=10" "3.7.6.3" "11.6.201.146" Potential IP "64.124.12.162" found in string "X-Request-Ip: 64.124.12.162" Potential IP "64.124.12.162" found in string "X-Response-Cinfo: 64.124.12.162" Potential IPs "36.158.216.175" "111.48.108.100" "111.180.202.109" "111.48.138.116" "220.202.41.134" "175.6.233.195" "106.46.24.171" "111.48.108.162" "61.163.8.141" found in string "1.146;36.158.216.175;111.48.108.100;111.180.202.109;111.48.138.116;220.202.41.134;175.6.233.195;106.46.24.171;111.48.108.162;61.163.8.141;" Potential IP "127.0.0.1" found in string "http://127.0.0.1:9000/ppvaplaybyopen?url=%s&%s" Potential IP "127.0.0.1" found in string "http://127.0.0.1:%d/ppvadownloadbyurl?url=%s" "127.0.0.1"70:T1ab4,Pattern match: "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2c" Pattern match: "http://nsis.sf.net/nsis_error" Heuristic match: "#w.gm" Heuristic match: "'kq.se" Heuristic match: ".r..am" Pattern match: "http://ocsp.verisign.com0,0*0" Pattern match: "http://nsis.sf.net/nsis_errorerror" Pattern match: "wgetperadapterinfo.htmllist.client.pplive.cn/v3/index/sync.client.pplive.cnclient-search.pptv.comclient-searchtips.pptv.comclient-list.pptv.comclient-play.pptv.comrhv" Pattern match: "http://.asf/" Pattern match: "livesetchannelupnplivesetchannelcallbacklivesetchannelplayerstatuslivesetchannelparameterlivegetchannelparameterlivegetchannelstatuslivestopchannellivestartchannellivecleanuplivestartuptest.synacast.com/fileweb/webform1.aspxstart" Pattern match: "pplive.com/pplstat;1,g0wl" Pattern match: "crl.microsoft.com/pki/crl/products/cspca.crl0h" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/" Pattern match: "pplive.com/httpproxy;1www'dispatch" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "up.pplive.com/tips/tipsdone.inipplive\ppap\tipsdone.inihttpcookieflashcookiereadxmlitems()" Pattern match: "ol.synacast.com/102.html?online-clientplayfailedhttp://ol.synacast.com/101.html?online-gameapphttp://ol.synacast.com/3.html?online-clientapphttp://ol.synacast.com/1.html?#$eoqwiu31!da421va-videohttp://video-va.synacast.com/1.html?va-ppvodhttp://ppvod-va.sy" Pattern match: "https://www.verisign.com/rpa" Pattern match: "c.tdx/it%k%0c#s~x" Pattern match: "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd" Pattern match: "pplive.com/bubblemgr;1" Pattern match: "http://www.pptv.com/?rcc_id=d7ff9d0c59ed065e257390a84dd5831b" Pattern match: "http://www.pptv.com/" Heuristic match: "ins.pplive.com" Heuristic match: "pp.pplive.com" Heuristic match: "h.synacast.com" Heuristic match: "ins-version.pplive.com" Heuristic match: "videoediting.ru" Heuristic match: "rbogaar@aol.com" Pattern match: "http://ins.pplive.com/config/pptv/qd-all-slient-onelink-autostart/forqd1084/bind_en-us.ini" Heuristic match: "%programfiles%\(x86)\pplive\pptv\3.1.5.0065\player\mp4splitter.ax" Heuristic match: "%programfiles%\(x86)\pplive\pptv\3.1.5.0065\player\avcvideodec.ax" Pattern match: "http://h.synacast.com/1.html?sa2foj" Pattern match: "https://go.microsoft.com/fwlink/?linkid=121488" Heuristic match: "tvlogcfg.in" Heuristic match: "ata1.gslb.pptv.com" Heuristic match: "ata.gslb.pptv.com" Heuristic match: ".synacast.com" Pattern match: "h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2c" Heuristic match: "data1.gslb.pptv.com" Heuristic match: "data.gslb.pptv.com" Heuristic match: "synacast.com" Heuristic match: "ynacast.com" Heuristic match: "host: h.synacast.com" Heuristic match: "" - Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found URL "http://localhost:8080/1.html?online-passportfailedhttp://ol.synacast.com/102.html?online-clientplayfailedhttp://ol.synacast.com/101.html?online-gameapphttp://ol.synacast.com/3.html?online-clientapphttp://ol.synacast.com/1.html?" - Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found URL "http://video-va.synacast.com/1.html?va-ppvodhttp://ppvod-va.synacast.com/1.html?va-ikanhttp://ikan-va.synacast.com/1.html?va-uploadhttp://upload-va.synacast.com/1.html?va-pplivehttp://pplive-va.synacast.com/1.html?ppva_kejiebuy2046http://log.buy2046.com/1.html?fuck_buy2046ppaphttp://ppap.synacast.com/1.html?" - Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found URL "http://ext.synacast.com/1.html?http://crash.g1d.net/1.html?gameappclientapphttp://h.synacast.com/1.html?pplivedata=%s&md5=%sabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/0123456789abcdefrsds" - Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2c32\cmd:\program" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2cc:\program" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2cjhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2cvenetwoc:\program" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2c\hapubws\appdata\local\microsoft\windows\history\history.ie5\mshist012026040420260405\ookiescalrpcistoryacherofilesoftware\policies\microsoft\internet" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2cacmgcomspec=c:\windows\system32\cmd.exeallusersprofile=c:\programdatacomputername=desktop-8ld9t6ns+" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2cpsmodulepath=c:\users\hapubws\documents\windowspowershell\modules;c:\program" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2chomedrive=c:os=windows_nthomedrive=c:prompt=$p$gefc_5668=1os=windows_ntsystemdrive=c:efc_5668=1efc_5668=1homedrive=c:systemdrive=c:prompt=$p$gsystemdrive=c:os=windows_ntprompt=$p$g9nu8xbupath=c:\program" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2c" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2chttp://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2c280,2fasyc" - Source: "00000000-00001080.00000001.308933.00C90000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2c" - Source: "00000000-00001080.00000001.308933.00DE0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xml.0065:\windows\system32\advapi32.dll:\windows\system32\bcryptprimitives.dll:\windows\system32\oleaut32.dllsiscanbuevice\mu.lnkppdata\roamingepairsetup.exeummy://url/p.pplive.comnalysis24k8ups:\windows\system32\windows.storage.dllc:\windows\system32\windows.storage.dll" - Source: "00000000-00001996.00000000.307730.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmlsoftware\policies\microsoft\internet" - Source: "00000000-00001996.00000000.307730.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmltdugthttp://pp.pplive.com/config/control.xmllmemhttp://pp.pplive.com/config/control.xmlhttp://pp.pplive.com/config/control.xmlrpyst" - Source: "00000000-00001996.00000000.307730.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/rmation,0,1,0,@19e7f0,276,240100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000m/000000000000000000000000000000000000000000000000000000000000000000000000w/000000000000000000000000000000000000000000000000" - Source: "00000000-00001996.00000000.307730.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xml.0065:\windows\system32\advapi32.dll:\windows\system32\bcryptprimitives.dll:\windows\system32\oleaut32.dllsiscanbuevice\mu.lnkppdata\roamingepairsetup.exeummy://url/p.pplive.comnalysis24k8ups:\windows\system32\windows.storage.dllc:\windows\system32\windows.storage.dll" - Source: "00000000-00001996.00000001.309653.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmlsoftware\policies\microsoft\internet" - Source: "00000000-00001996.00000001.309653.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmltdugtlmemlmemhttp://pp.pplive.com/config/control.xmlt" - Source: "00000000-00001996.00000001.309653.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmls.%dpplive\pptv\xml\control.xmlnamexecscriptwindow.showmodaldialog('ppmessagebox.xml'," - Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found URL "http://msdl.microsoft.com/download/symbols;*http://msdl.microsoft.com/download/symbols;\websymbolssrv*systemdrive\system32systemroot_nt_alternate_symbol_path_nt_symbol_pathpptv_server_symbolpptv_local_symbolstackwalk64-endless-callstack![callstack]========================================stack========================================abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/vector" - Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found URL "http://localhost:8080/1.html?online-passportfailedhttp://ol.synacast.com/102.html?online-clientplayfailedhttp://ol.synacast.com/101.html?online-gameapphttp://ol.synacast.com/3.html?online-clientapphttp://ol.synacast.com/1.html?" - Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found URL "http://video-va.synacast.com/1.html?va-ppvodhttp://ppvod-va.synacast.com/1.html?va-ikanhttp://ikan-va.synacast.com/1.html?va-uploadhttp://upload-va.synacast.com/1.html?va-pplivehttp://pplive-va.synacast.com/1.html?ppva_kejiebuy2046http://log.buy2046.com/1.html?fuck_buy2046ppaphttp://ppap.synacast.com/1.html?" - Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found URL "http://ext.synacast.com/1.html?http://crash.g1d.net/1.html?gameappclientapphttp://h.synacast.com/1.html?pplivedata=%s&md5=%sabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/0123456789abcdefrsds" - Source: "00000000-00001996.00000001.309653.1018F000.00000002.mdmp") Found URL "http://download.pplive.com/config/pplite/pluginsetup.exe[checkplug]the" - Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found URL "http://call.synacast.com/post/info_1.dotel" - Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found URL "http://client-list.pplive.cn/chtesting.xmlpptestinfo%d.inihttp://client-list.pptv.com/catalog.xmlchtesting%d.inihttp://client-list.pptv.com/cllist-%u.xmlcllist-%d-%d.inihttp://v2.pplive.com/cycle.listcyclelist%d.inionfillresultchannelcount%d-%d-%d" - Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found URL "http://127.0.0.1:9000/ppvaplaybyopen?url=%s&%sbig3peertcp" - Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found URL "http://127.0.0.1:%d/ppvadownloadbyurl?url=%scmyasyncmon::get" - Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found URL "http://pp.pplive.com/config/control.xmlxml\control.xmlcodecexehttp://download.pplive.com/pptv/codec/codecfile.inixml\codecfile.inicodecfile.inisoftware\pplive\player\codecsupdate\codec.exexmlfile" - Source: "00000000-00001996.00000001.309653.715D8000.00000002.mdmp") Found URL "http://pp.pplive.com/config/control.xml.0065:\windows\system32\advapi32.dll:\windows\system32\bcryptprimitives.dll:\windows\system32\oleaut32.dllsiscanbuevice\mu.lnkppdata\roamingepairsetup.exeummy://url/p.pplive.comnalysis24k8ups:\windows\system32\windows.storage.dllc:\windows\system32\windows.storage.dll" - Source: "00000000-00001996.00000002.311573.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmlsoftware\policies\microsoft\internet" - Source: "00000000-00001996.00000002.311573.004C0000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmltdugtlmemlmemhttp://pp.pplive.com/config/control.xmlt" - Source: "00000000-00001996.00000002.311573.004C0000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00002792.00000000.307678.00409000.00000004.mdmp") Found URL "http://ocsp.verisign.com0,0*0(" - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "http://crl.verisign.com/tss-ca.crl0tsa1-20u6t:!?da" - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "http://ocsp.verisign.com0:08060http://crl.verisign.com/thawtetimestampingca.crl0tsa2048-1-530?7!op1verisign," - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "https://www.verisign.com/cps0*https://www.verisign.com/rpa0[0y0w0u" - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0(0&0$http://ocsp.verisign.com01*0(0&" - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0)class3ca2048-1-550xev1verisign," - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "http://csc3-2009-2-crl.verisign.com/csc3-2009-2.crl0d=0;090*0(https://www.verisign.com/rpa0i0g0$http://ocsp.verisign.com0?3http://csc3-2009-2-aia.verisign.com/csc3-2009-2.cer0]+6_6h" - Source: "00000000-00002792.00000000.307678.0040F000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00002792.00000001.309563.00409000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00002792.00000001.309563.0040F000.00000004.mdmp") Found URL "https://www.verisign.com/cps0*https://www.verisign.com/rpa0[0y0w0u" - Source: "00000000-00002792.00000001.309563.0040F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0(0&0$http://ocsp.verisign.com01*0(0&" - Source: "00000000-00002792.00000001.309563.0040F000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0)class3ca2048-1-550xev1verisign," - Source: "00000000-00002792.00000001.309563.0040F000.00000004.mdmp") Found URL "http://csc3-2009-2-crl.verisign.com/csc3-2009-2.crl0d=0;090*0(https://www.verisign.com/rpa0i0g0$http://ocsp.verisign.com0?3http://csc3-2009-2-aia.verisign.com/csc3-2009-2.cer0]+6_6h" - Source: "00000000-00002792.00000001.309563.0040F000.00000004.mdmp") Found URL "http://pp.pplive.com/config/control.xmls.%dpplive\pptv\xml\control.xmlnamexecscriptwindow.showmodaldialog('ppmessagebox.xml'," - Source: "00000000-00003096.00000000.307705.1018F000.00000002.mdmp") Found URL "http://msdl.microsoft.com/download/symbols;*http://msdl.microsoft.com/download/symbols;\websymbolssrv*systemdrive\system32systemroot_nt_alternate_symbol_path_nt_symbol_pathpptv_server_symbolpptv_local_symbolstackwalk64-endless-callstack![callstack]========================================stack========================================abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/vector" - Source: "00000000-00003096.00000000.307705.1018F000.00000002.mdmp") Found URL "http://localhost:8080/1.html?online-passportfailedhttp://ol.synacast.com/102.html?online-clientplayfailedhttp://ol.synacast.com/101.html?online-gameapphttp://ol.synacast.com/3.html?online-clientapphttp://ol.synacast.com/1.html?" - Source: "00000000-00003096.00000000.307705.1018F000.00000002.mdmp") Found URL "http://video-va.synacast.com/1.html?va-ppvodhttp://ppvod-va.synacast.com/1.html?va-ikanhttp://ikan-va.synacast.com/1.html?va-uploadhttp://upload-va.synacast.com/1.html?va-pplivehttp://pplive-va.synacast.com/1.html?ppva_kejiebuy2046http://log.buy2046.com/1.html?fuck_buy2046ppaphttp://ppap.synacast.com/1.html?" - Source: "00000000-00003096.00000000.307705.1018F000.00000002.mdmp") Found URL "http://ext.synacast.com/1.html?http://crash.g1d.net/1.html?gameappclientapphttp://h.synacast.com/1.html?pplivedata=%s&md5=%sabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/0123456789abcdefrsds" - Source: "00000000-00003096.00000000.307705.1018F000.00000002.mdmp") Found URL "http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==ookiescalrpcistoryrofileache%systemroot%\system32\pnrpnsp.dll,-1001ettingsmozilla/4.0" - Source: "00000000-00003360.00000000.307792.007D0000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==data\local\microsoft\windows\history\history.ie5\mshist012026040420260405\hyper-v" - Source: "00000000-00003360.00000000.307792.007D0000.00000004.mdmp") Found URL "http://h.synacast.com/h.synacast.comdesktop-8ld9t6n\hapubwscom/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==.synacast.comrpc" - Source: "00000000-00003360.00000000.307792.007D0000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==0032004b00320061006f0036004b006a006d006100610056006c007200610070006d007300720061004f0061006d007100530061006c007200690070006d00700079005a002b0034006a003800430069006c007200750070006a0038004b0069006f0035007000710061004c0076007100320063006a003800570069006f005a00610067003d003d008510068770,6180,6,lpszversion,3,1,0,@1005c434,160540050002f0031002e0030008510068770,6180,6,lpszreferrer,46180,3,lplpszaccepttypes,5,0,,6fc0088510068770,6180,3,dwflags,000008510068770,6180,3,dwcontext,7,0,,0kwevy" - Source: "00000000-00003360.00000000.307792.007D0000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==ookiescalrpcistoryrofileache%systemroot%\system32\pnrpnsp.dll,-1001ettingsmozilla/4.0" - Source: "00000000-00003360.00000001.308239.007D0000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==data\local\microsoft\windows\history\history.ie5\mshist012026040420260405\hyper-v" - Source: "00000000-00003360.00000001.308239.007D0000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==i" - Source: "00000000-00003360.00000001.308239.007D0000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==http://h.synacast.com/1.html?sdpg0uxtracsqroblrkpmpyordbb2+fjoacknzypradkzqyz0tkhzq+yoaoknk6lta2dok2ao6kjmaavlrapmzysraoamqsalripmpyurz+4j8cilrupj8kioja5pqalvq2cj8wioza8pg==0032004b00320061006f0036004b006a006d006100610056006c007200610070006d007300720061004f0061006d007100530061006c007200690070006d00700079005a002b0034006a003800430069006c007200750070006a0038004b0069006f0035007000710061004c0076007100320063006a003800570069006f005a00610067003d003d008510068770,6180,6,lpszversion,3,1,0,@1005c434,160540050002f0031002e0030008510068770,6180,6,lpszreferrer,46180,3,lplpszaccepttypes,5,0,,6fc0088510068770,6180,3,dwflags,000008510068770,6180,3,dwcontext,7,0,,0kwevy" - Source: "00000000-00003360.00000001.308239.007D0000.00000004.mdmp") Found URL "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&speedlimit=100&source=9http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&speedlimit=100&%s&source=9outofelem" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://ext.synacast.com/1.html?[push]" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&source=11http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&%s&source=11[converter]" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://client-mini.pptv.com/qipao/wakeup/v311/[fb].html.wakeupbubblepush]" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://h.g1d.net/1.html?%s[converter]" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://h.synacast.com/1.html?updateplayreservedacdata" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://client-list.pptv.com/latest.xmlcmanager::timerprocrefreshxml" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://clientapi.aplus.pptv.com/api/v1/timebookbubblebookbubblepap/ickcountbookbubble%i64dbookbubblestarttrustupload" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&source=10http://127.0.0.1:%d/ppvadownloadbyurl_%u%u?url=%s&%s&source=10[push]" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://pp.pplive.com/config/control.xmlcmanager::timerproccontrolxml" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://iptable.pplive.com/getcitycodecmanager::finalconstruct" - Source: "00000000-00003360.00000001.308239.1004E000.00000002.mdmp") Found URL "http://pp.pplive.com/config/control.xmls.%dpplive\pptv\xml\control.xmlnamexecscriptwindow.showmodaldialog('ppmessagebox.xml'," - Source: "00000000-00003360.00000001.308239.1018F000.00000002.mdmp") Found URL "http://msdl.microsoft.com/download/symbols;*http://msdl.microsoft.com/download/symbols;\websymbolssrv*systemdrive\system32systemroot_nt_alternate_symbol_path_nt_symbol_pathpptv_server_symbolpptv_local_symbolstackwalk64-endless-callstack![callstack]========================================stack========================================abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/vector" - Source: "00000000-00003360.00000001.308239.1018F000.00000002.mdmp") Found URL "http://localhost:8080/1.html?online-passportfailedhttp://ol.synacast.com/102.html?online-clientplayfailedhttp://ol.synacast.com/101.html?online-gameapphttp://ol.synacast.com/3.html?online-clientapphttp://ol.synacast.com/1.html?" - Source: "00000000-00003360.00000001.308239.1018F000.00000002.mdmp") Found URL "http://video-va.synacast.com/1.html?va-ppvodhttp://ppvod-va.synacast.com/1.html?va-ikanhttp://ikan-va.synacast.com/1.html?va-uploadhttp://upload-va.synacast.com/1.html?va-pplivehttp://pplive-va.synacast.com/1.html?ppva_kejiebuy2046http://log.buy2046.com/1.html?fuck_buy2046ppaphttp://ppap.synacast.com/1.html?" - Source: "00000000-00003360.00000001.308239.1018F000.00000002.mdmp") Found URL "http://ext.synacast.com/1.html?http://crash.g1d.net/1.html?gameappclientapphttp://h.synacast.com/1.html?pplivedata=%s&md5=%sabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/0123456789abcdefrsds" - Source: "00000000-00003360.00000001.308239.1018F000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=121488" - Source: "00000000-00003752.00000000.308214.03087000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00004508.00000000.307044.01060000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00004508.00000000.307044.01060000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.010B7000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.032C0000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.03D30000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.03D40000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.03F70000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04280000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04300000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04310000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04330000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.043B0000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04400000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04410000.00000002.mdmp") Found URL "http://purl.org/dc/elements/1.1/" - Source: "00000000-00004508.00000000.307044.04904000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04904000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04C00000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04D60000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04D70000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.04D80000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.05710000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.05750000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.057D0000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.057F0000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004508.00000000.307044.05820000.00000002.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00004508.00000000.307044.05840000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00004508.00000000.307044.05840000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=121488" - Source: "00000000-00006060.00000000.308879.00B17000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=121488" - Source: "00000000-00006064.00000000.307886.036DB000.00000004.mdmp") Found URL "http://h.synacast.com/1.html?sa2fojynradkzqyz0tkhzq+yoapnnkqls62i5ajhqakcmfkx7khoovlhlrspzb/qucre0n2mqmfutrzhqz6doksbnqxoj7uioagamzaltq2dn5ysradkmaavokccmaaluk2capubws" - Source: "00000000-00006328.00000001.308483.029B0000.00000004.mdmp") Found URL "http://sourceforge.net/projects/mpc-hc/companynamegabestfiledescriptionmp4" - Source: "00000000-00006328.00000001.308483.10077000.00000002.mdmp") Found URL "http://ininet.dll.hlp.chmuser32.dllf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cppystem%2\clsid%2\insertable%2\protocol\stdfileediting\verb\0&edit%2\protocol\stdfileediting\serverclsid\%1clsid\%1\progidclsid\%1\inprochandler32ole32.dllclsid\%1\localserver32clsid\%1\verb\0&edit,0,2clsid\%1\verb\1&open,0,2clsid\%1\insertableclsid\%1\auxusertype\2clsid\%1\auxusertype\3clsid\%1\defaulticon%3,%7clsid\%1\miscstatusclsid\%1\inprocserver32clsid\%1\docobject%2\docobjectclsid\%1\printableclsid\%1\defaultextension%9," - Source: "00000000-00006328.00000001.308483.7154B000.00000002.mdmp") Found URL "http://sourceforge.net/projects/mpc-hc/companynamempc-hc" - Source: "00000000-00006328.00000001.308483.7158E000.00000002.mdmp") Found URL "http://%s:%d/ppvaplaybyopen?url=?key=%hslocalplay&headonly=1&drag=1&drag=0&preroll=1drag.g1d.net0dragresttime=starttime=tinydrag=ppheader=drag=preroll=1isvipuser=1httpppl://g8r8_g8b8r8g8_b8g8uyvyunknowndxt4multi2_argb8dxt1dxt2yuy2dxt3binarybufferr32fg32r32fa32b32g32r32fcxv8u8a16b16g16r16fvertexdataindex16index32q16w16v16u16r16fg16r16fs8_lockabled32f_lockabled24fs8d32_lockabled24x4s4a2w10v10u10d16_lockabled15s1d24s8d24x8v16u16a4l4v8u8l6v5u5x8l8v8u8q8w8v8u8a8l8g16r16a2r10g10b10a16b16g16r16a8p8x8b8g8r8a8b8g8r8a2b10g10r10x4r4g4b4a8r3g3b2r3g3b2a4r4g4b4a1r5g5b5x1r5g5b5r5g6b5x8r8g8b8a8r8g8b8r8g8b83derr_devicehungd3dok_noautogens_not_residents_resident_in_shared_memorys_present_mode_changeds_present_occluded0x%08x" - Source: "00000000-00006328.00000001.308483.71847000.00000002.mdmp") Found URL "ftp://upload.ffmpeg.org/mplayer/incoming/" - Source: "00000000-00006328.00000001.308483.71CDD000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00006328.00000001.308483.721C1000.00000020.mdmp")72:Ta36,Found string "GET /1.html?sa2foJynraDkzqyZ0tKhzq+YoaPNnKqLs62i5ajhqaKcmfKX7KHoovLhlrSpzb/QucrE0N2mqMfUtrzhqZ6doKSbnqXoj7uioaGamZaLtq2dn5ysraDkmaaVoKCcmaaLuK2c HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp") Found string "Hosth.synacast.comGET /1.html?sa2foJynraDkzqyZ0tKhzq+YoaPNnKqLs62i5ajhqaKcmfKX7KHoovLhlrSpzb/QucrE0N2mqMfUtrzhqZ6doKSbnqXoj7uioaGamZaLtq2dn5ysraDkmaaVoKCcmaaLuK2c HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp") Found string "tml?sa2foJynraDkzqyZ0tKhzq+YoaPNnKqLs62i5ajhqaKcmfKX7KHoovLhlrSpzb/QucrE0N2mqMfUtrzhqZ6doKSbnqXoj7uioaGamZaLtq2dn5ysraDkmaaVoKCcmaaLuK2c HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001080.00000000.308794.00C90000.00000004.mdmp") Found string "HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00001080.00000000.308794.1004E000.00000002.mdmp") Found string "HTTP/1.0 200 OK" (Indicator: "HTTP/1.0"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001080.00000000.308794.1018F000.00000002.mdmp") Found string "GET /config/control.xml HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001996.00000000.307730.004C0000.00000004.mdmp") Found string "Hostpp.pplive.comGET /config/control.xml HTTP/1.1B.R" (Indicator: "HTTP/1.1"; Source: "00000000-00001996.00000000.307730.004C0000.00000004.mdmp") Found string "GET /config/control.xml HTTP/1.1P,R" (Indicator: "HTTP/1.1"; Source: "00000000-00001996.00000001.309653.004C0000.00000004.mdmp, 00000000-00001996.00000002.311573.004C0000.00000004.mdmp") Found string "Hostpp.pplive.comGET /config/control.xml HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001996.00000001.309653.004C0000.00000004.mdmp, 00000000-00001996.00000002.311573.004C0000.00000004.mdmp") Found string "HTTP/1.1 204 No Content_" (Indicator: "GetDC"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001136.00000000.211473.03190000.00000004.mdmp, 00000000-00001136.00000001.213305.03190000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001136.00000001.213305.00407000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002424.00000000.210915.035C0000.00000004.mdmp")94:T92c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "7b024deda9a285ce08cdea266a351c5714ca61e6799cf12aa474ccdf04363a68.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001136.00000000.211473.00409000.00000004.mdmp, 00000000-00001136.00000001.213305.00409000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002176.00000000.211971.00CC5000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002424.00000000.210915.72301000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002424.00000000.210915.72301000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002424.00000000.210915.72301000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003296.00000000.213293.01250000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003296.00000000.213293.01250000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003520.00000000.211872.00B7D000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003520.00000000.211872.00B7D000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003520.00000000.211872.72511000.00000020.mdmp, 00000000-00003520.00000000.211872.726A1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003520.00000000.211872.72511000.00000020.mdmp, 00000000-00003520.00000000.211872.726A1000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003520.00000000.211872.72511000.00000020.mdmp")95:Tabf,Spawned process "3F\" (Indicator: \"\"; Source: \"00000000-00002424.00000000.210915.035C0000.00000004.mdmp, 00000000-00002424.00000000.210915.07AE0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"697afc81bfa5f143210b731a"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}S\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00003296.00000000.213293.01250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"697afc81bfa5f143210b731a"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"697afc81bfa5f143210b731a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2151 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"697afc81bfa5f143210b731a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"