26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 76:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious VHO:Trojan.Makoob.gen Sample 9fd46aa45ac8… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 9fd46aa45ac8…. Malware family: VHO:Trojan.Makoob.gen. Threat score 70/100. 1/26 AV engines flagged this file. 19 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9fd46aa45ac8539cd288b744730661b3b27b00047bbb994e6a12b8da82d2b3e3","keywords":["Suspicious","VHO:Trojan.Makoob.gen","malware analysis","sandbox report","threat intelligence","9fd46aa45ac8539cd288b744730661b3b27b00047bbb994e6a12b8da82d2b3e3"],"about":{"@type":"SoftwareApplication","name":"9fd46aa45ac8539cd288b744730661b3b27b00047bbb994e6a12b8da82d2b3e3.bin","applicationCategory":["compressed","7zip"],"identifier":"9fd46aa45ac8539cd288b744730661b3b27b00047bbb994e6a12b8da82d2b3e3","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"VHO:Trojan.Makoob.gen","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":19,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T43f,"" (Indicator: "SHA384"; Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp, 00000000-00000620.00000001.152043.085B4000.00000004.mdmp, 00000000-00000620.00000001.152043.085DA000.00000004.mdmp, 00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp, 00000000-00000620.00000001.152043.085B4000.00000004.mdmp, 00000000-00000620.00000001.152043.085DA000.00000004.mdmp, 00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00000620.00000001.152043.08270000.00000004.mdmp, 00000000-00000620.00000002.153964.08270000.00000004.mdmp, 00000000-00000620.00000002.153964.715B9000.00000002.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000620.00000001.152043.08270000.00000004.mdmp, 00000000-00000620.00000002.153964.08270000.00000004.mdmp, 00000000-00000620.00000002.153964.715B9000.00000002.mdmp") file/memory contains long string with (Indicator: "SHA384"; Source: "00000000-00000620.00000001.152043.082D1000.00000004.mdmp, 00000000-00000620.00000002.153964.08270000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00000620.00000001.152043.082E8000.00000004.mdmp, 00000000-00000620.00000002.153964.08270000.00000004.mdmp, 00000000-00000620.00000002.153964.715B9000.00000002.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00000620.00000001.152043.082E8000.00000004.mdmp, 00000000-00000620.00000002.153964.08270000.00000004.mdmp, 00000000-00000620.00000002.153964.715B9000.00000002.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00000620.00000001.152043.082E8000.00000004.mdmp, 00000000-00000620.00000002.153964.08270000.00000004.mdmp")2b:T7fe,"Blocked by nProtectGET Accept-Language: POST Host: Content-Type: multipart/form-datamailReferer: http://\??\From:Content-Transfer-Encoding:d:\___devgroup\nos-d\engdev_0802_tkids\trunk\2.0\driver\vista\tkidsvt\library.cNdisprot: assert BytesAvailable > Offset failed in file %s, line %dSystem( 8PP700WP`h````xpxxppN;K*'s\[s?a*s~c|w{9JLX~=d]jF~^;qDF+|pZ}0123456789ABCDEFRSDSKd:\___devgroup\nos-d\engdev_0802_tkids\trunk\2.0\bin\free\amd64\TKIdsVt64.pdbEXPLORER.EXEIEXPLORE.EXENETSCAPE.EXEFIREFOX.EXEMSNMSGR.EXEL$ HD$@HD$8H\$`Hl$hHt$pHD$pHL$pHL$xH\$@E3L$ HT$pH\$`HVATAUAVAWHEt$DEl$PL$(I\$pIA_A^A]A\^UVWATAUAVAWHL$xHT$XDD$PDT$HD\$@DL$8E\$0LL$xED$0HD$pHD$(HA_A^A]A\_^]UVWATAUAVAWHD$0EL$0I;@A_A^A]A\_^]L$hLL$0HL$0H|$hID$`HD$`1D$`H\$PHD$pDL$p3D$@HD$0Hl$(H\$ HL$@H\$`Hl$hHXuISf=0uCf=Ar)f=fWATAUAVAWH #A;\$xASeAl\$PHl$XHt$`H A_A^A]A\_WATAUH\$@Hl$HHt$PH A]A\_WATAUH\$@Hl$HHt$PH A]A\_@SUVWATAUAVHH!2H!t$HfSeAlAD$@HT$HH\$@H\$@f;)uUHL$HHL$0AD$(IPA^A]A\_^][UVWHD$PHL$@H\$HH _^]D$@HI!8LD$ HL$(E3\$x!|$pfD\$*LD$pHL$(3T$pASeSdL$ 3\$`HD$pHL$(HL$ 3SeTs\$0Hl$8Ht$@HUVWHD$XHT$ HD$XHT$ H9\$ L$XLD$(HT$hHL$XLD$(HT$hH\$PH0_^]PpUcD$(IL$8fDD$8D\$0AD$(HD$8Hl$XH\$PHD$HIL$HH3\$pHD$@0D$X@D$ 0D$8@L$`HL$ IL$0HD$ HT$0H\$PHL$ IT$ L\$@HL$0ID$pHT$0DD$(E3\$PHt$XHL$ IT$ L\$@Ht$HHL$@AT$@DD$0HD$(H\$`Ht$hHL$ IT$ L\$@Ht$HHWATAUHl$pAPpRbD$hLD$(IT$h3PpRbD$hLD$hI\$PHl$XHt$`H0A]A\_L$0AD$pHT$0D\$PHt$XHD$@HFV09HT$HHT$HHD$ HL$@HD$@HD$@HD$@HD$$HMmUnmapLockedPagesExAllocatePoolWithTagIoDeleteSymbolicLinkExFreePoolWithTagKeReadStateEventRtlInitUnicodeStringIoDeleteDeviceKeSetEventIoIs32bitProcessKeReleaseSpinLockMmBuildMdlForNonPagedPoolIoFreeMdlZwUnloadDriverMmMapLockedPagesSpecifyCachePsSetCreateProcessNotifyRoutineExIofCompleteRequestObReferenceObjectByHandleIoCreateSymbolicLinkPsGetCurrentProcessIdRtlCopyUnicodeStringIoAllocateMdlKeAcquireSpinLockRaiseToDpc_strnicmpmemchrDbgPrintKeInitializeMutexKeInitializeEventObfDereferenceObjectIoFreeWorkItemIoAllocateWorkItemIoQueueWorkItemstrncmpKeReleaseMutexstrncpyKeWaitForSingleObjectDbgBreakPointislowerIoBuildDeviceIoControlRequestPsSetCreateProcessNotifyRoutineIoGetDeviceObjectPointerIofCallDriverRtlWalkFrameChainPsLookupProcessByProcessIdKeUnstackDetachProcessRtlCompareMemoryKeStackAttachProcessKeBugCheckExntoskrnl.exeExInitializeNPagedLookasideListExpInterlockedPushEntrySListExpInterlockedPopEntrySListExQueryDepthSListExDeleteNPagedLookasideListRtlAnsiStringToUnicodeString_wcsnicmpMmGetSystemRoutineAddressRtlInitAnsiStringRtlFreeUnicodeStringZwQueryValueKeyIoGetCurrentProcessZwCloseZwOpenKeyNdisMSleepNdisAdvanceNetBufferDataStartNdisRetreatNetBufferDataStartNdisFreeMemoryNdisAllocateMemoryWithTagNDIS.SYSFwpmEngineClose0FwpmTransactionBegin0FwpmFilterAdd0FwpmEngineOpen0FwpmTransactionAbort0FwpsCalloutRegister0FwpsAllocateCloneNetBufferList0FwpmCalloutAdd0FwpsInjectNetworkSendAsync0FwpmTransactionCommit0FwpsInjectionHandleCreate0FwpsInjectionHandleDestroy0FwpsQueryPacketInjectionState0FwpsFreeCloneNetBufferList0FwpmSubLayerAdd0FwpsCalloutUnregisterById0fwpkclnt.sysObOpenObjectByPointerIoCreateDeviceZwSetSecurityObjectIoDeviceObjectType_snwprintfRtlLengthSecurityDescriptorSeCaptureSecurityDescriptorRtlCreateSecurityDescriptorRtlSetDaclSecurityDescriptorRtlAbsoluteToSelfRelativeSDIoIsWdmVersionAvailableSeExportswcschrRtlLengthSidRtlAddAccessAllowedAceRtlGetSaclSecurityDescriptorRtlGetDaclSecurityDescriptorRtlGetGroupSecurityDescriptorRtlGetOwnerSecurityDescriptorZwCreateKeyZwSetValueKey__C_specific_handlerN0L004$tkWashington1Redmond1Microsoft Corporation1806/Microsoft Windows Third Party Component CA 20140240111200915Z250110200915Z0Washington1Redmond1Microsoft Corporation1;092Microsoft Windows Hardware Compatibility Publisher0#eH[Pvve.'aS0*nFb+1\LK*Hi`(i3Q$o:081Microsoft Corporation1232147+5019330m0k0ichttp://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crt0B[zZ#6;9m"*[v%`=Pp/u&v4$huaou=5MXTq_m6Washington1Redmond1Microsoft Corporation1200)Microsoft Root Certificate Authority 20100141015203127Z291015204127Z0Washington1Redmond1Microsoft Corporation1806/Microsoft Windows Third Party Component CA 20140sk=($,/9}c!FNg7=)x(0tR'5s?I1s_uHD3IVV.$u"xo]0[00A0?3http://www.microsoft.com/pkiops/Docs/Repository.htm0O0M0KEhttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZN0L0J>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0t,7diE'?s#2(Fx!+YEzw*Uu'Ol:kUYd`3>.Washington1Redmond1Microsoft Corporation1806/Microsoft Windows Third Party Component CA 2014|+u.cd0n1`0^(https://www.microsoft.com/en-us/windows 0nrwZo#"M520240808045539.576Z0Washington1Redmond1Microsoft Corporation1-0+$Microsoft Ireland Operations Limited1&"; File: "TKIdsVt64.sys") Found string "!This program cannot be run in DOS mode.Rich.texth.rdataH.dataPAGE`INIT.rsrcB.relochNI28hSVWPhTI19hBlocked by nProtectAccept-Language: GET Referer: http://mailContent-Type: multipart/form-dataHost: POST \??\Content-Transfer-Encoding:From:Ndisprot: assert BytesAvailable > Offset failed in file %s, line %dd:\___devgroup\nos-d\engdev_0802_tkids\trunk\2.0\driver\vista\tkidsvt\library.cSystemN;K*'s\[s?a*s~0123456789ABCDEFc|w{9JLX~=d]jF~^;qDF+|pZ}( 8PP700WP`h````xpxxppRSDSgd:\___devgroup\nos-d\engdev_0802_tkids\trunk\2.0\bin\free\i386\TKIdsVt.pdbEXPLORER.EXEIEXPLORE.EXENETSCAPE.EXEFIREFOX.EXEMSNMSGR.EXEWh \|w9]|X9]|88]QQSWPSWh@]PShl]PShX]VWuG_^[]hSeAlPjPf=0u>f=Ar$f=f7@_^[]F@@;u9UuAhSeAlj;tR3hSeAlVjFFf9>tFFf9>tFFf9>tFFf9>t>;tAFFf9>tf9>tf9>ttYf9>uFFf9>t>)uDf@@f^_[]SVW3hSeSdUWhSeTsRjWhPpRb\hPpRb@hPpUc@PjhFV09RtlCopyUnicodeStringExAllocatePoolWithTagmemsetPsSetCreateProcessNotifyRoutineExExFreePoolWithTagIoDeleteDeviceIoDeleteSymbolicLinkRtlInitUnicodeStringIoCreateSymbolicLinkIofCompleteRequestZwUnloadDriverKeSetEventKeReadStateEventPsGetCurrentProcessIdMmMapLockedPagesSpecifyCachememcpyMmBuildMdlForNonPagedPoolIoAllocateMdlIoFreeMdlMmUnmapLockedPagesObReferenceObjectByHandle_strnicmpmemchrDbgPrintKeInitializeMutexKeInitializeEventObfDereferenceObjectIoQueueWorkItemIoAllocateWorkItemIoFreeWorkItemstrncmpstrncpyKeReleaseMutexKeWaitForSingleObjectislowerDbgBreakPointPsSetCreateProcessNotifyRoutineIoGetDeviceObjectPointerIofCallDriverIoBuildDeviceIoControlRequestKeUnstackDetachProcessKeStackAttachProcessPsLookupProcessByProcessIdRtlCompareMemoryRtlWalkFrameChainKeTickCountKeBugCheckExntoskrnl.exeRtlUnwindKeGetCurrentIrqlKfReleaseSpinLockKfAcquireSpinLockHAL.dllInterlockedPopEntrySListInterlockedPushEntrySListExInitializeNPagedLookasideListExDeleteNPagedLookasideListZwClose_wcsnicmpIoGetCurrentProcessMmGetSystemRoutineAddressRtlFreeUnicodeStringRtlAnsiStringToUnicodeStringRtlInitAnsiStringZwQueryValueKeyZwOpenKeyNdisMSleepNdisAdvanceNetBufferDataStartNdisRetreatNetBufferDataStartNdisFreeMemoryNdisAllocateMemoryWithTagNDIS.SYSFwpsFreeCloneNetBufferList0FwpsInjectNetworkSendAsync0FwpsAllocateCloneNetBufferList0FwpsQueryPacketInjectionState0FwpsInjectionHandleDestroy0FwpmEngineClose0FwpmTransactionAbort0FwpmTransactionCommit0FwpmSubLayerAdd0FwpmTransactionBegin0FwpmEngineOpen0FwpsInjectionHandleCreate0FwpsCalloutUnregisterById0FwpmFilterAdd0FwpmCalloutAdd0FwpsCalloutRegister0fwpkclnt.sysObOpenObjectByPointerZwSetSecurityObjectIoDeviceObjectTypeIoCreateDeviceRtlGetDaclSecurityDescriptorRtlGetSaclSecurityDescriptorRtlGetGroupSecurityDescriptorRtlGetOwnerSecurityDescriptor_snwprintfRtlLengthSecurityDescriptorSeCaptureSecurityDescriptorSeExportsIoIsWdmVersionAvailableRtlAddAccessAllowedAceRtlLengthSidwcschrRtlAbsoluteToSelfRelativeSDRtlSetDaclSecurityDescriptorRtlCreateSecurityDescriptorZwCreateKeyZwSetValueKey0+0;0I0S0]0j0r0y01!1 12I2S2a2w2634?4W4g4~45R7Y79E9O:5;O255/585B5H5]55D6H6L6P6T6X6\6`6d6h6l6p6t6x6|67X8i8o8t8{8:1:g:;[;e;5L7P7T7X7\7:D;~;=$>^>7P8{8:>:o:021j12(222@2J2x23i7O;g=>&>@>3B3l34F4P4_5i5566@6O7Y7!0^02P3s33 4:4n47D7J7O7V7l7q7w78+81868Z8u89#:;:;X<_7L7R7W7^7t7y7:6:G:; ;';=;B;H;?2?8?=?c?h?n?0q0v0|01!2&2,2G2L2R2:h;w=0"1L11%243A3S3`38)8m<=I=[?#0Z00q1~1J1q13J3p3435h5m6>(>5>;>d>j>t>$0*040L0R01,121h1r1x1343:3D3\3b34;5B5p:t:x:|:; ;$;(0Y0^0W1f1n13,323P3k3p3404_4q45%5,5P5a56!686=6C6]6c6k67$7/7;7G7R7^7j7u78$808<8G8S8_8j8v89%919<9H9T9_9k9w9:&:1:=:I:T:`:l:w:;&;2;>;I;U;a;l;x;<'<3<>">1>?>N>]>k>z>?*?9?G?V?e?s?0#020A0O0^0m0{01+1:1I1W1f1u12%232B2Q2_2n2}23-3;3J3Y3g3v34&454C4R4a4o4~45.5=5K5Z5i5w56'666E6S6b6q67!7/7>7M7[7j7y78)878F8U8c8r89"919?9N9]9k9z9:*:9:G:V:e:s:;#;2;A;O;^;m;{;<+<:->;>J>Y>g>v>?&?5?C?R?a?o?~?0.0=0K0Z0i0w01'161E1S1b1q12!2/2>2M2[2j2y23)373F3U3c3r34"414?4N4]4k4z45*595G5V5e5s56#626A6O6^6m6{67+7:7I7W7f7u78%838B8Q8_8n8}89-9;9J9Y9g9v9:&:5:C:R:a:o:~:;.;=;K;Z;i;w;<'<6=M=[=j=y=>)>7>F>U>c>r>?"?1???N?]?k?z?0*090G0V0e0s01#121A1O1^1m1{12+2:2I2W2f2u23%333B3Q3_3n3}34-4;4J4Y4g4v45&555C5R5a5o5~56.6=6K6Z6i6w67'767E7S7b7q78!8/8>8M8[8j8y89)979F9U9c9r9:":1:?:N:]:k:z:;*;9;G;V;e;s;<#<2%>3>B>Q>_>n>}>?-?;?J?Y?g?v?0&050C0R0a0o0~01.1=1K1Z1i1w12'262E2S2b2q23!3/3>3M3[3j3y34)474F4U4c4r45"515?5N5]5k5z56*696G6V6e6s67#727A7O7^7m7{78+8:8I8W8f8u89%939B9Q9_9n9}9:-:;:J:Y:g:v:;&;5;C;R;a;o;~;<.<=!>/>>>M>[>j>y>?)?7?F?U?c?r?0"010?0N0]0k0z01*191G1V1e1s12#222A2O2^2m2{23+3:3I3W3f3u34%434B4Q4_4n4}45-5;5J5Y5g5v56&656C6R6a6o6~67.7=7K7Z7i7w78'868E8S8b8q89!9/9>9M9[9j9y9:):7:F:U:c:r:;";1;?;N;];k;z;<*<9+>:>I>W>f>u>?%?3?B?Q?_?n?}?0-0;0J0Y0g0v01&151C1R1a1o1~12.2=2K2Z2i2w23'363E3S3b3q34!4/4>4M4[4j4y45)575F5U5c5r56"616?6N6]6k6z67*797G7V7e7s78#828A8O8^8m8{89+9:9I9W9f9u9:%:3:B:Q:_:n:}:;-;;;J;Y;g;v;<&<5'>6>E>S>b>q>?!?/?>?M?[?j?y?0)070F0U0c0r01"111?1N1]1k1z12*292G2V2e2s23#323A3O3^3m3{34+4:4I4W4f4u45%535B5Q5_5n5}56-6;6J6Y6g6v67&757C7R7a7o7~78.8=8K8Z8i8w89'969E9S9b9q9:!:/:>:M:[:j:y:;);7;F;U;c;r;<"<1#>2>A>O>^>m>{>?+?:?I?W?f?u?0%030B0Q0_0n0}01-1;1J1Y1g1v12&252C2R2a2o2~23.3=3K3Z3i3w34'464E4S4b4q45!5/5>5M5[5j5y56)676F6U6c6r67"717?7N7]7k7z78*898G8V8e8s89#929A9O9^9m9{9:+:::I:W:f:u:;%;3;B;Q;_;n;};<-<;.>=>K>Z>i>w>?'?6?E?S?b?q?0!0/0>0M0[0j0y01)171F1U1c1r12"212?2N2]2k2z23*393G3V3e3s34#424A4O4^4m4{45+5:5I5W5f5u56%636B6Q6_6n6}67-7;7J7Y7g7v78&858C8R8a8o8~89.9=9K9Z9i9w9:':6:E:S:b:q:;!;/;>;M;[;j;y;<)<7*>9>G>V>e>s>?#?2?A?O?^?m?{?0+0:0I0W0f0u01%131B1Q1_1n1}12-2;2J2Y2g2v23&353C3R3a3o3~34.4=4K4Z4i4w45'565E5S5b5q56!6/6>6M6[6j6y67)777F7U7c7r78"818?8N8]8k8z89*999G9V9e9s9:#:2:A:O:^:m:{:;+;:;I;W;f;u;<%<3&>5>C>R>a>o>~>?.?=?K?Z?i?w?0'060E0S0b0q01!1/1>1M1[1j1y12)272F2U2c2r23"313?3N3]3k3z34*494G4V4e4s45#525A5O5^5m5{56+6:6I6W6f6u67%737B7Q7_7n7}78-8;8J8Y8g8v89&959C9R9a9o9~9:.:=:K:Z:i:w:;';6;E;S;b;q;">1>?>N>]>k>z>?*?9?G?V?e?s?0#020A0O0^0m0{01+1:1I1W1f1u12%232B2Q2_2n2}23-3;3J3Y3g3v34&454C4R4a4o4~45.5=5K5Z5i5w56'666E6S6b6q67!7/7>7M7[7j7y78)878F8U8c8r89"919?9N9]9k9z9:*:9:G:V:e:s:;#;2;A;O;^;m;{;<+<:->;>J>Y>g>v>?&?5?C?R?a?o?~?0.0=0K0Z0i0w01'161E1S1b1q12!2/2>2M2[2j2y23)373F3U3c3r34"414?4N4]4k4z45*595G5V5e5s56#626A6O6^6m6{67+7:7I7W7f7u78%838B8Q8_8n8}89-9;9J9Y9g9v9:&:5:C:R:a:o:~:;.;=;K;Z;i;w;<'<6=M=[=j=y=>)>7>F>U>c>r>?"?1???N?]?k?z?0*090G0V0e0s01#121A1O1^1m1{12+2:2I2W2f2u23%333B3Q3_3n3}34-4;4J4Y4g4v45&555C5R5a5o5~56.6=6K6Z6i6w67'767E7S7b7q78!8/8>8M8[8j8y89)979F9U9c9r9:":1:?:N:]:k:z:;*;9;G;V;e;s;<#<2%>3>B>Q>_>n>}>?-?;?J?Y?g?v?0&050C0R0a0o0~01.1=1K1Z1i1w12'262E2S2b2q23!3/3>3M3[3j3y34)474F4U4c4r45"515?5N5]5k5z56*696G6V6e6s67#727A7O7^7m7{78+8:8I8W8f8u89%939B9Q9_9n9}9:-:;:J:Y:g:v:;&;5;C;R;a;o;~;<.<=!>/>>>M>[>j>y>?)?7?F?U?c?r?0"010?0N0]0k0z01*191G1V1e1s12#222A2O2^2m2{23+3:3I3W3f3u34%434B4Q4_4n4}45-5;5J5Y5g5v56&656C6R6a6o6~67.7=7K7Z7i7w78'868E8S8b8q89!9/9>9M9[9j9y9:):7:F:U:c:r:;";1;?;N;];k;z;<*<9+>:>I>W>f>u>?%?3?B?Q?_?n?}?0-0;0J0Y0g0v01&151C1R1a1o1~12.2=2K2Z2i2w23'363E3S3b3q34!4/4>4M4[4j4y45)575F5U5c5r56"616?6N6]6k6z67*797G7V7e7s78#828A8O8^8m8{89+9:9I9W9f9u9:%:3:B:Q:_:n:}:;-;;;J;Y;g;v;<&<5'>6>E>S>b>q>?!?/?>?M?[?j?y?0)070F0U0c0r01"111?1N1]1k1z12*292G2V2e2s23#323A3O3^3m3{34+4:4I4W4f4u45%535B5Q5_5n5}56-6;6J6Y6g6v67&757C7R7a7o7~78.8=8K8Z8i8w89'969E9S9b9q9:!:/:>:M:[:j:y:;);7;F;U;c;r;<"<1#>2>A>O>^>m>{>?+?:?I?W?f?u?0%030B0Q0_0n0}01-1;1J1Y1g1v12&252C2R2a2o2~23.3=3K3Z3i3w34'464E4S4b4q45!5/5>5M5[5j5y56)676F6U6c6r67"717?7N7]7k7z78*898G8V8e8s89#929A9O9^9m9{9:+:::I:W:f:u:;%;3;B;Q;_;n;};<-<;.>=>K>Z>i>w>?'?6?E?S?b?q?0!0/0>0M0[0j0y01)171F1U1c1r12"212?2N2]2k2z23*393G3V3e3s34#424A4O4^4m4{45+5:5I5W5f5u56%636B6Q6_6n6}67-7;7J7Y7g7v78&858C8R8a8o8~89.9=9K9Z9i9w9:':6:E:S:b:q:;!;/;>;M;[;j;y;<)<7*>9>G>V>e>s>?#?2?A?O?^?m?{?0+0:0I0W0f0u01%131B1Q1_1n1}12-2;2J2Y2g2v23&353C3R3a3o3~34.4=4K4Z4i4w45'565E5S5b5q56!6/6>6M6[6j6y67)777F7U7c7r78"818?8N8]8k8z89*999G9V9e9s9:#:2:A:O:^:m:{:;+;:;I;W;f;u;<%<3&>5>C>R>a>o>~>?.?=?K?Z?i?w?0'060E0S0b0q01!1/1>1M1[1j1y12)272F2U2c2r23"313?3N3]3k3z34*494G4V4e4s45#525A5O5^5m5{56+6:6I6W6f6u67%737B7Q7_7n7}78-8;8J8Y8g8v89&959C9R9a9o9~9:.:=:K:Z:i:w:;';6;E;S;b;q;">1>?>N>]>k>z>?*?9?G?V?e?s?0#020A0O0^0m0{01+1:1I1W1f1u12%232B2Q2_2n2}23-3;3J3Y3g3v34&454C4R4a4o4~45.5=5K5Z5i5w56'666E6S6b6q67!7/7>7M7[7j7y78)878F8U8c8r89"919?9N9]9k9z9:*:9:G:V:e:s:;#;2;A;O;^;m;{;<+<:->;>J>Y>g>v>?&?5?C?R?a?o?~?0.0=0K0Z0i0w01'161E1S1b1q12!2/2>2M2[2j2y23)373F3U3c3r34"414?4N4]4k4z45*595G5V5e5s56#626A6O6^6m6{67+7:7I7W7f7u78%838B8Q8_8n8}89-9;9J9Y9g9v9:&:5:C:R:a:o:~:;.;=;K;Z;i;w;<'<6=M=[=j=y=>)>7>F>U>c>r>?"?1???N?]?k?z?0*090G0V0e0s01#121A1O1^1m1{12+2:2I2W2f2u23%333B3Q3_3n3}34-4;4J4Y4g4v45&555C5R5a5o5~56.6=6K6Z6i6w67'767E7S7b7q78!8/8>8M8[8j8y89)979F9U9c9r9:":1:?:N:]:k:z:;*;9;G;V;e;s;<#<2%>3>B>Q>_>n>}>?-?;?J?Y?g?v?0&050C0R0a0o0~01.1=1K1Z1i1w12'262E2S2b2q23!3/3>3M3[3j3y34)474F4U4c4r45"515?5N5]5k5z56*696G6V6e6s67#727A7O7^7m7{78+8:8I8W8f8u89%939B9Q9_9n9}9:-:;:J:Y:g:v:;&;5;C;R;a;o;~;<.<=!>/>>>M>[>j>y>?)?7?F?U?c?r?0"010?0N0]0k0z01*191G1V1e1s12#222A2O2^2m2{23+3:3I3W3f3u34%434B4Q4_4n4}45-5;5J5Y5g5v56&656C6R6a6o6~67.7=7K7Z7i7w78'868E8S8b8q89!9/9>9M9[9j9y9:):7:F:U:c:r:;";1;?;N;];k;z;<*<9+>:>I>W>f>u>?%?3?B?Q?_?n?}?0-0;0J0Y0g0v01&151C1R1a1o1~12.2=2K2Z2i2w23'363E3S3b3q34!4/4>4M4[4j4y45)575F5U5c5r56"616?6N6]6k6z67*797G7V7e7s78#828A8O8^8m8{89+9:9I9W9f9u9:%:3:B:Q:_:n:}:;-;;;J;Y;g;v;<&<5'>6>E>S>b>q>?!?/?>?M?[?j?y?0)070F0U0c0r01"111?1N1]1k1z12*292G2V2e2s23#323A3O3^3m3{34+4:4I4W4f4u45%535B5Q5_5n5}56-6;6J6Y6g6v67&757C7R7a7o7~78.8=8K8Z8i8w89'969E9S9b9q9:!:/:>:M:[:j:y:;';2;>;J;U;a;m;x;<'<3)>4>@>L>W>c>o>z>?)?5?A?L?X?d?o?{?0*060A0M0\0j0y01)181F1U1d1r12"212@2N2]2l2z23*393H3V3e3t34$424A4P4^4m4|45,5:5I5X5f5u56%646B6Q6`6n6}67-7<7J7Y7h7v78&858D8R8a8p8~89 9.9=9L9Z9i9x9:(:6:E:T:b:q:;!;0;>;M;\;j;y;<)<8*>9>H>V>e>t>?$?2?A?P?^?m?|?0 0:0I0X0f0u01%141B1Q1`1n1}12-2<2J2Y2h2v23&353D3R3a3p3~34 4.4=4L4Z4i4x45(565E5T5b5q56!606>6M6\6j6y67)787F7U7d7r78"818@8N8]8l8z89*999H9V9e9t9:$:2:A:P:^:m:|:;,;:;I;X;f;u;<%<4&>5>D>R>a>p>~>? ?.?=?L?Z?i?x?0(060E0T0b0q01!101>1M1\1j1y12)282F2U2d2r23"313@3N3]3l3z34*494H4V4e4t45$525A5P5^5m5|56 6:6I6X6f6u67%747B7Q7`7n7}78-8<8J8Y8h8v89&959D9R9a9p9~9: :.:=:L:Z:i:x:;(;6;E;T;b;q;">1>@>N>]>l>z>?*?9?H?V?e?t?0$020A0P0^0m0|01,1:1I1X1f1u12%242B2Q2`2n2}23-3<3J3Y3h3v34&454D4R4a4p4~45 5.5=5L5Z5i5x56(666E6T6b6q67!707>7M7\7j7y78)888F8U8d8r89"919@9N9]9l9z9:*:9:H:V:e:t:;$;2;A;P;^;m;|;< <:-><>J>Y>h>v>?&?5?D?R?a?p?~?0 0.0=0L0Z0i0x01(161E1T1b1q12!202>2M2\2j2y23)383F3U3d3r34"414@4N4]4l4z45*595H5V5e5t56$626A6P6^6m6|67,7:7I7X7f7u78%848B8Q8`8n8}89-9<9J9Y9h9v9:&:5:D:R:a:p:~:; ;.;=;L;Z;i;x;<(<6=M=\=j=y=>)>8>F>U>d>r>?"?1?@?N?]?l?z?0*090H0V0e0t01$121A1P1^1m1|12 2:2I2X2f2u23%343B3Q3`3n3}34-4<4J4Y4h4v45&555D5R5a5p5~56 6.6=6L6Z6i6x67(767E7T7b7q78!808>8M8\8j8y89)989F9U9d9r9:":1:@:N:]:l:z:;*;9;H;V;e;t;<$<2%>4>B>Q>`>n>}>?-?3M3\3j3y34)484F4U4d4r45"515@5N5]5l5z56*696H6V6e6t67$727A7P7^7m7|78 8:8I8X8f8u89%949B9Q9`9n9}9:-:<:J:Y:h:v:;&;5;D;R;a;p;~;< <.<=!>0>>>M>\>j>y>?)?8?F?U?d?r?0"010@0N0]0l0z01*191H1V1e1t12$222A2P2^2m2|23,3:3I3X3f3u34%444B4Q4`4n4}45-5<5J5Y5h5v56&656D6R6a6p6~67 7.7=7L7Z7i7x78(868E8T8b8q89!909>9M9\9j9y9:):8:F:U:d:r:;";1;@;N;];l;z;<*<9 >:>I>X>f>u>?%?4?B?Q?`?n?}?0-0<0J0Y0h0v01&151D1R1a1p1~12 2.2=2L2Z2i2x23(363E3T3b3q34!404>4M4\4j4y45)585F5U5d5r56"616@6N6]6l6z67*797H7V7e7t78$828A8P8^8m8|89,9:9I9X9f9u9:%:4:B:Q:`:n:}:;-;<;J;Y;h;v;<&<5(>6>E>T>b>q>?!?0?>?M?\?j?y?0)080F0U0d0r01"111@1N1]1l1z12*292H2V2e2t23$323A3P3^3m3|34 4:4I4X4f4u45%545B5Q5`5n5}56-6<6J6Y6h6v67&757D7R7a7p7~78 8.8=8L8Z8i8x89(969E9T9b9q9:!:0:>:M:\:j:y:;);8;F;U;d;r;<"<1<@$>2>A>P>^>m>|>?,?:?I?X?f?u?0%040B0Q0`0n0}01-1<1J1Y1h1v12&252D2R2a2p2~23 3.3=3L3Z3i3x34(464E4T4b4q45!505>5M5\5j5y56)686F6U6d6r67"717@7N7]7l7z78*898H8V8e8t89$929A9P9^9m9|9: :::I:X:f:u:;%;4;B;Q;`;n;};<-<< >.>=>L>Z>i>x>?(?6?E?T?b?q?0!000>0M0\0j0y01)181F1U1d1r12"212@2N2]2l2z23*393H3V3e3t34$424A4P4^4m4|45,5:5I5X5f5u56%646B6Q6`6n6}67-7<7J7Y7h7v78&858D8R8a8p8~89 9.9=9L9Z9i9x9:(:6:E:T:b:q:;!;0;>;M;\;j;y;<)<8*>9>H>V>e>t>?$?2?A?P?^?m?|?0 0:0I0X0f0u01%141B1Q1`1n1}12-2<2J2Y2h2v23&353D3R3a3p3~34 4.4=4L4Z4i4x45(565E5T5b5q56!606>6M6\6j6y67)787F7U7d7r78"818@8N8]8l8z89*999H9V9e9t9:$:2:A:P:^:m:|:;,;:;I;X;f;u;<%<4&>5>D>R>a>p>~>? ?.?=?L?Z?i?x?0(060E0T0b0q01!101>1M1\1j1y12)282F2U2d2r23"313@3N3]3l3z34*494H4V4e4t45$525A5P5^5m5|56 6:6I6X6f6u67%747B7Q7`7n7}78-8<8J8Y8h8v89&959D9R9a9p9~9: :.:=:L:Z:i:x:;(;6;E;T;b;q;">1>@>N>]>l>z>?*?9?H?V?e?t?0$020A0P0^0m0|01,1:1I1X1f1u12%242B2Q2`2n2}23-3<3J3Y3h3v34&454D4R4a4p4~45 5.5=5L5Z5i5x56(666E6T6b6q67!707>7M7\7j7y78)888F8U8d8r89"919@9N9]9l9z9:*:9:H:V:e:t:;$;2;A;P;^;m;|;< <:-><>J>Y>h>v>?&?5?D?R?a?p?~?0 0.0=0L0Z0i0x01(161E1T1b1q12!202>2M2\2j2y23)383F3U3d3r34"414@4N4]4l4z45*595H5V5e5t56$626A6P6^6m6|67,7:7I7X7f7u78%848B8Q8`8n8}89-9<9J9Y9h9v9:&:5:D:R:a:p:~:; ;.;=;L;Z;i;x;<(<6=M=\=j=y=>)>8>F>U>d>r>?"?1?@?N?]?l?z?0*090H0V0e0t01$121A1P1^1m1|12 2:2I2X2f2u23%343B3Q3`3n3}34-4<4J4Y4h4v45&555D5R5a5p5~56 6.6=6L6Z6i6x67(767E7T7b7q78!808>8M8\8j8y89)989F9U9d9r9:":1:@:N:]:l:z:;*;9;H;V;e;t;<$<2%>4>B>Q>`>n>}>?-?3M3\3j3y34)484F4U4d4r45"515@5N5]5l5z56*696H6V6e6t67$727A7P7^7m7|78 8:8I8X8f8u89%949B9Q9`9n9}9:-:<:J:Y:h:v:;&;5;D;R;a;p;~;< <.<=!>0>>>M>\>j>y>?)?8?F?U?d?r?0"010@0N0]0l0z01*191H1V1e1t12$222A2P2^2m2|23,3:3I3X3f3u34%444B4Q4`4n4}45-5<5J5Y5h5v56&656D6R6a6p6~67 7.7=7L7Z7i7x78(868E8T8b8q89!909>9M9\9j9y9:):8:F:U:d:r:;";1;@;N;];l;z;<*<9 >:>I>X>f>u>?%?4?B?Q?`?n?}?0-0<0J0Y0h0v01&151D1R1a1p1~12 2.2=2L2Z2i2x23(363E3T3b3q34!404>4M4\4j4y45)585F5U5d5r56"616@6N6]6l6z67*797H7V7e7t78$828A8P8^8m8|89,9:9I9X9f9u9:%:4:B:Q:`:n:}:;-;<;J;Y;h;v;<&<5(>6>E>T>b>q>?!?0?>?M?\?j?y?0)080F0U0d0r01"111@1N1]1l1z12"; File: "TKIdsVt.sys")5d:T3f2d,Heuristic match: "c4yo.pn" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j" Pattern match: "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/" Pattern match: "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/.text$mn.idata$5.00cfg.crt$xca.crt$xcz.crt$xia.crt$xiz.crt$xpa.crt$xpz.crt$xta.crt$xtz.rdata.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$iaa.rtc$izz.rtc$taa.rtc$tzz.xdata$x.edata.idata$2.idata$3.idata$4" Pattern match: "http://logo.verisign.com/vslogo.gif0\:oj" Pattern match: "http://\??\from:content-transfer-encoding:d:\___devgroup\nos-d\engdev_0802_tkids\trunk\2.0\driver\vista\tkidsvt\library.cndisprot" Pattern match: "http://mailcontent-type" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0b[zz#6;9m*[v%`=pp/u&v4$huaou=5mxtq_m6washington1redmon" Pattern match: "http://certs.godaddy.com/repository/1301*go" Pattern match: "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0" Pattern match: "https://www.verisign.com/rpa" Heuristic match: "supdate.nprotect.net" Heuristic match: "get /nprotect/nos_service/nos.check_force http/1.1accept: */*user-agent: npupdatehost: supdate.nprotect.net" Heuristic match: "supdated.nprotect.net" Heuristic match: "get /nprotect/nos_service/nos.service http/1.1accept: */*user-agent: npupdatehost: supdated.nprotect.net" Heuristic match: "bwtd.nprotect2.net" Heuristic match: "get /version http/1.1accept: */*user-agent: npupdatehost: bwtd.nprotect2.net" Heuristic match: "nsrs.nprotect.net" Heuristic match: "/noscollection.do" Heuristic match: "bwt.nprotect2.net" Heuristic match: "noscollection.do" Heuristic match: "%programfiles%\(x86)\incainternet\nprotect online security\coredll\network\x86\tkfwfv.cat" Heuristic match: "%windir%\syswow64\tkfwfv.cat" Heuristic match: "%programfiles%\(x86)\incainternet\nprotect online security\coredll\network\x64\tkfwfv64.cat" Heuristic match: "%windir%\system32\tkfwfv64.cat" Heuristic match: "om~.ir" Heuristic match: "cctldl.windowsupdate.com" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en" Heuristic match: "//ctldl.windowsupdate.com" Heuristic match: "ntrust.net" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" Heuristic match: "ctldl.windowsupdate.com" Heuristic match: "windowsupdate.com" Heuristic match: "tldl.windowsupdate.com" Heuristic match: "cl-glcb907925.gcdn.co" Heuristic match: "cdn.co" Heuristic match: "wu-b-net.trafficmanager.net" Heuristic match: "u-b-net.trafficmanager.net" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" Pattern match: "http://crl.thawte.com/thawtetimestampingca.crl0" Pattern match: "symantec.com/tss-ca-g2.crl0" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://www.nprotect.com" Pattern match: "http://sv.symcb.com/sv.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://www.nprotect.co.kr" Pattern match: "http://sv.symcb.com/sv.crl0f" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://sf.symcb.com/sf.crl0f" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://sf.symcb.c" Pattern match: "http://sv.symcb.com/sv" Pattern match: "www.nprotect.co.kr" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://sv.sym" Pattern match: "www.symauth.com/cps0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1a663fc8937d1b3c" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "s.symantec.com/tss-ca-g2.crl0" Heuristic match: "zenpe.com" Heuristic match: "l-glcb907925.gcdn.co" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1a663fc8937d1b3c" Heuristic match: ";.vg" Heuristic match: "2[.ne" Pattern match: "crosoft.com/pki/" Pattern match: "oft.com/pki/crl/" Pattern match: "rosoft.com/pki/c" Heuristic match: "host: ctldl.windowsupdate.com" Heuristic match: "s2.symcb.com" Heuristic match: "sf.symcd.com" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl" Heuristic match: "sf.symcb.com" Pattern match: "crl.thawte.com/thawtetimestampingca.crl" Pattern match: "http://ocsp.verisign.com" Pattern match: "http://crl.verisign.com/pca3-g5.crl" Heuristic match: "crl.verisign.com" Heuristic match: "ocsp.thawte.com" Heuristic match: "ocsp.verisign.com" Heuristic match: "crl.thawte.com" Pattern match: "http://ts-ocsp.ws.symantec.com" Pattern match: "crl.verisign.com/pca3-g5.crla" Pattern match: "sf.symcb.com/sf.crlq" Heuristic match: "entrust.net" Pattern match: "www.entrust.net/cps_2048" Heuristic match: "ts-ocsp.ws.symantec.com" Heuristic match: "ts-crl.ws.symantec.com" Pattern match: "http://ocsp.thawte.com" Pattern match: "http://crl.thawte.com/thawtetimestampingca.crl" Heuristic match: "rr-na.cdp1.digicert.com.akahost.net" Heuristic match: "cdp1.digicert.com.eip.akadns.net" Heuristic match: "eip-terr-na.cdp1.digicert.com.akahost.net" Heuristic match: "cdp1.digicert.com.splitter-eip.akadns.net" Heuristic match: "cdp1.digicert.com.akamaized.net" Heuristic match: "mpki-crl.edge.digicert.com" Heuristic match: "crl-symcprod.digicert.com" Pattern match: "www.digicert.com" Pattern match: "www.entrust.n" Pattern match: "http://ocsp.thawte.com/mfewtzbnmeswstajbgurdgmcgguabbqj1tblbrq9onphxpvawb87mxknlgquwu79f9f%2btw%2fgcij7fvba4giz7d4ceh6t6%2ft8xk5z6kuad9qg%2fds%3d" Heuristic match: "mpki-ocsp.digicert.com.cdn.cloudflare.net" Heuristic match: "sv.symcb.com" Heuristic match: "sv.symcd.com" Heuristic match: "s1.symcb.com" Pattern match: "sv.symcd.com/mfewtzbnmeswstajbgurdgmcgguabbqe6lndjdqx%2bjop7hvgteagfj%2fcqgquljtt8hkzl699g%2b8uk8zkt4yecmycegvwuysz45ri7f7exnowpc0%3d" Pattern match: "s2.symcb.com/mfewtzbnmeswstajbgurdgmcgguabbs56bkhaoud%2boyl%2b0lhpg9jxyqm4gquf9nlp8ld7lvwmanzqzn6aq8zmtmced141%2fl2swcyyx308b7khio%3d" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://s2.symcb.com/mfewtzbnmeswstajbgurdgmcgguabbs56bkhaoud%2boyl%2b0lhpg9jxyqm4gquf9nlp8ld7lvwmanzqzn6aq8zmtmced141%2fl2swcyyx308b7khio%3d" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0p" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0" Pattern match: "www.digicert.com1.0" Pattern match: "http://crl3.digicert.com/assured-cs-g1.crl00" Pattern match: "http://crl4.digicert.com/assured-cs-g1.crl0l" Pattern match: "http://ocsp.digicert.com0i" Pattern match: "http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "vts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "supdate.nprotect.net/nprotect/nos_service/nos.check_force" Heuristic match: "rt.np" Pattern match: "supdated.nprotect.net/nprotect/nos_service/nos.service" Pattern match: "supdate.nprotect.net/nprotect/nos_service/nos.service" Heuristic match: "eb.inca.co.kr" Heuristic match: "co.kr" Pattern match: "supdate.nprotect.net/nprotect/nos_service/windows6/npcnosc.npx" Pattern match: "bwt.nprotect2.net/auth/api/v1" Pattern match: "bwt.nprotect2.net/org/api/v1" Pattern match: "bwt.nprotect2.net/report/api/v1" Pattern match: "bwt.nprotect2.net/stat/api/v1" Pattern match: "nprotect.com/kr/index.html" Pattern match: "supdate.nprotect.net/nprotect/nos_service/windows6/install/apsffsetup30.exe" Pattern match: "supdate.nprotect.net/nprotect/nos_service/windows6/install/apsffsetup31.exe" Pattern match: "supdate.nprotect.net/nprotect/nos_service/windows6/custom/nosbank/p_nosbank.dat" Pattern match: "report.nprotect.net/phishingcheck.do" Pattern match: "supdate.tachyonlab.com/nos/nos10/ixupdcnf.ixp.ixz" Pattern match: "update.nprotect.net/nprotect/nos_service/win/npcnosc.npx" Heuristic match: "fs.nprotect.com" Heuristic match: "wt.nprotect2.net" Heuristic match: "update.nprotect.net" Heuristic match: "review.nprotect.co.kr" Heuristic match: "eb.nprotect.net" Heuristic match: "srs.nprotect.net" Heuristic match: "updated.nprotect.net" Heuristic match: "review.nprotect.com" Heuristic match: "review.nprotect.net" Heuristic match: "wtd.nprotect2.net" Pattern match: "https://nprotect.com/kr/index.html" Heuristic match: "stt.nr" Pattern match: "supdate.nprotect.net/nprotect/nos_service/nos.check" Heuristic match: "protect.com" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.digi" Pattern match: "http://s1.symcb.com/pca3-g5.crla" Pattern match: "http://sf.symcd.com" Pattern match: "http://sf.symcb.com/sf.crl" Pattern match: "http://sv.symcd.com" Pattern match: "http://sv.symcb.com/sv.crl" Pattern match: "http://ts-ocsp.ws.symantec.com/mfewtzbnmeswstajbgurdgmcgguabbri82pvyykwgjwdgvnyepy5kytdqqqux5r1blzmzhsa1n197z%2fb7eyalt0cea7p9dji%2fr81bgtyapgbgla%3d" Heuristic match: "zed.net" Heuristic match: "mpki-ocsp.edge.digicert.com" Heuristic match: "mpki-ocsp.digicert.com" Pattern match: "ocsp.thawte.com/mfewtzbnmeswstajbgurdgmcgguabbqj1tblbrq9onphxpvawb87mxknlgquwu79f9f%2btw%2fgcij7fvba4giz7d4ceh6t6%2ft8xk5z6kuad9qg%2fds%3d" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer" Pattern match: "www.entrust.net/legal-terms" Heuristic match: "secom trust.net" Pattern match: "ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "http://ocsp.verisign.com/mfewtzbnmeswstajbgurdgmcgguabbs56bkhaoud%2boyl%2b0lhpg9jxyqm4gquf9nlp8ld7lvwmanzqzn6aq8zmtmcefia5aolvvwahu2wydrlm8c%3dm" Pattern match: "te.com/thawteti" Pattern match: "http://sf.symcb.a" Pattern match: "http://sf.symcd.com/mfewtzbnmeswstajbgurdgmcgguabbtsqzmg5m8ta9rdzkbcnnwumad5vgquz5mp6nsm9evjjo%2fx8aum7%2bpsp50cebal3oz5y4dlk%2fbaiuo25fk%3d8" Pattern match: "ocsp.verisign.com/mfewtzbnmeswstajbgurdgmcgguabbs56bkhaoud%2boyl%2b0lhpg9jxyqm4gquf9nlp8ld7lvwmanzqzn6aq8zmtmcefia5aolvvwahu2wydrlm8c%3d" Pattern match: "nsrs.nprotect.net/noscollection.do" Heuristic match: "wt-test-final-dbaa0d1c4ce87f27.elb.ap-northeast-2.amazonaws.com" Heuristic match: "protect.net" Heuristic match: "nprotect.net" Heuristic match: "nca-supdate.dl.cdn.cloudn.co.kr" Heuristic match: "updated.nprotect.net.wtxcdn.com" Pattern match: "bwtd.nprotect2.net/version" Heuristic match: "*.nprotect.net" Heuristic match: "*.nprotect2.net" Heuristic match: "nprotect2.net" Heuristic match: "t.net" Heuristic match: "hr~.ru" Heuristic match: "/).bb" Heuristic match: "vh.nu" Heuristic match: "/q.an"5e:T16eae,Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabhyper-v" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://crl.thawte.com/thawtetimestampingca.crl0" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://sf.symcb.com/sf.crl0az0x0v0l0" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://crl.m0.com/pki/crl/products/microsoftcodeverifroot.crl0,n9iqmgvw,czcthawte," - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1a663fc8937d1b3c0a0!0c0!sc11120531151137z0/^g(o-cejy" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*loft" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcsuuuhhsm" - Source: "00000000-00000620.00000000.150122.00A40000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00000620.00000000.150122.011E4000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000000.150122.03930000.00000004.mdmp") Found URL "http://www.nprotect.co.kr" - Source: "00000000-00000620.00000000.150122.03930000.00000004.mdmp") Found URL "http://sv.symcb.com/sv.crl0f_0]0[0l0" - Source: "00000000-00000620.00000000.150122.03930000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sv.symcd.com0&http://sv.symcb.com/sv.crt0fxry]_)4u5y/i;qkverisign," - Source: "00000000-00000620.00000000.150122.03930000.00000004.mdmp") Found URL "http://s2.symcb.com0e0c0a0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-567031305/3xwashington1redmond1microsoft" - Source: "00000000-00000620.00000000.150122.03930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,nhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000620.00000000.150122.08570000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcj_m" - Source: "00000000-00000620.00000000.150122.08570000.00000004.mdmp") Found URL "http://ts-crl.ws.symantec.com/tss-ca-g2.crlsf.symcb.comttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/encalrpctsvcscalrpceysvccalrpcsa/sha384sa/sha256uovadis" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.verisign.comhttp://crl.verisign.com/pca3-g5.crlcrl.verisign.coms," - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.comhttp://ts-crl.ws.symantec.com/tss-ca-g2.crlntrust" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.thawte.comhttp://crl.thawte.com/thawtetimestampingca.crlisallowedcert_autoupdate_1subcamicrosoftsubcamicrosofthawtentrustertumhawterpc-d68eb4bcf181156f52lobalsign" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.thawte.com/mfewtzbnmeswstajbgurdgmcgguabbqj1tblbrq9onphxpvawb87mxknlgquwu79f9f%2btw%2fgcij7fvba4giz7d4ceh6t6%2ft8xk5z6kuad9qg%2fds%3dbaebe581fcb73249406fc21094ea252e_c:\windows\temp\asllog_apphelpdebug_nosstarter.npe_620.txtmpki-ocsp.digicert.com.cdn.cloudflare.netcrl.thawte.comeip-terr-na.cdp1.digicert.com.akahost.netsv.symcb.comclsid\" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://sv.symcd.com0&http://sv.symcb.com/sv.crt0pa-w0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301ca-g2.crl0(timestamp-2048-20b07x,&c3efany3+.gn" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://sf.symcb.chttps://d.symcb.com/cps0%0.!z&r'hm)" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "https://www.verisign.com/cps0*https://www.verisign.com/rpa0[0y0w0u" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif04-0+0)" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3-g5.crl04(0&0$http://ocsp.verisign.com0verisignmpki-2-803130g8j-lb=e61.3.6.1.4.1.311.2.1.46&b0d(xn.ux_9g'i" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://sv.symcb.com/sv.crl0az0x0v0l0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sv.symcd.com0&http://sv.symcb.com/svnc.1" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://s2.symcb.com/mfewtzbnmeswstajbgurdgmcgguabbs56bkhaoud%2boyl%2b0lhpg9jxyqm4gquf9nlp8ld7lvwmanzqzn6aq8zmtmced141%2fl2swcyyx308b7khio%3dy" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;-v" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00a0!0c0!120531151137z0/^g(o-cejy" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://www.nprotect.com" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lqvg3we>[apiow" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0@bi\6" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://zd?0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0!" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0g0e0*http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" - Source: "00000000-00000620.00000001.152043.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,nhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00000620.00000001.152043.08570000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00000620.00000001.152043.08570000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00000620.00000001.152043.08570000.00000004.mdmp") Found URL "http://www.microsoft.com0@bi\6" - Source: "00000000-00000620.00000001.152043.08570000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crlas," - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://sf.symcd.comhttp://sf.symcb.com/sf.crlicrosoft" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://sv.symcd.comhttp://sv.symcb.com/sv.crlicrosoft" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com/mfewtzbnmeswstajbgurdgmcgguabbri82pvyykwgjwdgvnyepy5kytdqqqux5r1blzmzhsa1n197z%2fb7eyalt0cea7p9dji%2fr81bgtyapgbgla%3dwan" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://ocsp.thawte.com/mfewtzbnmeswstajbgurdgmcgguabbqj1tblbrq9onphxpvawb87mxknlgquwu79f9f%2btw%2fgcij7fvba4giz7d4ceh6t6%2ft8xk5z6kuad9qg%2fds%3dlocal" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://www.nprotect.com" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0!" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0g0e0*http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301pi]tp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000620.00000001.152043.085B4000.00000004.mdmp") Found URL "http://ocsp.verisign.com/mfewtzbnmeswstajbgurdgmcgguabbs56bkhaoud%2boyl%2b0lhpg9jxyqm4gquf9nlp8ld7lvwmanzqzn6aq8zmtmcefia5aolvvwahu2wydrlm8c%3dmverisign" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "http://sf.symcd.comhttp://sf.symcb.a2fds%3dhttp://sf.symcd.com/mfewtzbnmeswstajbgurdgmcgguabbtsqzmg5m8ta9rdzkbcnnwumad5vgquz5mp6nsm9evjjo%2fx8aum7%2bpsp50cebal3oz5y4dlk%2fbaiuo25fk%3d8researchinca" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "http://ocsp.thawte.com/mfewtzbnmeswstajbgurdgmcgguabbqj1tblbrq9onphxpvawb87mxknlgquwu79f9f%2btw%2fgcij7fvba4giz7d4ceh6t6%2ft8xk5z6kuad9qg%2fds%3d" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "http://sv.symcb.com/sv.crlicrosoft" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "http://sf.symcb.com/sf.crl0f_0]0[0l0" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sf.symcd.com0&http://sf.symcb.com/sf.crt0d/p,^(" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0!" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,nhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00000620.00000001.152043.085DA000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000001.152043.08676000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000001.152043.0867C000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00000620.00000001.152043.08C30000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00000620.00000001.152043.08C30000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000001.152043.08C30000.00000004.mdmp") Found URL "http://sf.symcb.com/sf.crl0f_0]0[0l0" - Source: "00000000-00000620.00000001.152043.08C30000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sf.symcd.com0&http://sf.symcb.com/sf.crt0d/p,^(" - Source: "00000000-00000620.00000001.152043.08C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,n9iqmgvw,czcthawte," - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pce" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lapiou1:" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://www.microsoft.com0@bi\6" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "https://1.3.6.1.4.1.311.60.2.1.32.5.4.152.5.4.5214-86-478882.5.4.62.5.4.8seoul2.5.4.7guro-gu2.5.4.10inca" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl1.3.6.1.4.1.311.60.2.1.32.5.4.152.5.4.5214-86-478882.5.4.62.5.4.8seoul2.5.4.7guro-gu2.5.4.10inca" - Source: "00000000-00000620.00000002.153964.00A40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,nhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "http://www.microsoft.com0@bi\6" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%2.5.4.102.5.4.3w%w0connconltcpchcontico31230)mi" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0g0e0*http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301pi]tp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05x'ect" - Source: "00000000-00000620.00000002.153964.08570000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "https://supdated.nprotect.net/nprotect/nos_service/nos.service2&,lfw4=6sp%%'q%" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0.http://www.digicert.com/ssl-cps-repository.htm0:fk" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%w)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)vw)vxp)v" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0elap]fpa" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0(https://www.digicert.com/cps0r0p0$http://ocsp.digicert.com0h705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0&\6kmoa;[" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@:http://crl4.digicert.com/digicerthighassurances/http://ts-sdecddecddecd3lssruuu8yykssm1nsnib" - Source: "00000000-00000620.00000002.153964.08670000.00000004.mdmp") Found URL "http://www.nprotect.com" - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0elap]fpa" - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0(https://www.digicert.com/cps0r0p0$http://ocsp.digicert.com0h0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0" - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0g" - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0;!%" - Source: "00000000-00000620.00000002.153964.0883F000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00000620.00000002.153964.08C30000.00000004.mdmp") Found URL "https://cs.nprotect.com/" - Source: "00000000-00000620.00000002.153964.096C3000.00000004.mdmp") Found URL "https://nprotect.com/kr/index.html" - Source: "00000000-00000620.00000002.153964.096C3000.00000004.mdmp") Found URL "http://ipcheck.nprotect.net/nproteg_sec/ip/ipchecker.php" - Source: "00000000-00000620.00000002.153964.096C3000.00000004.mdmp") Found URL "http://ipc.nprotect.net/nppfs.address.jsp" - Source: "00000000-00000620.00000002.153964.096C3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00000620.00000002.153964.09E32000.00000004.mdmp") Found URL "https://http://llnormalllwarningllerrorllcriticallangerrsetthere" - Source: "00000000-00000620.00000002.153964.100A4000.00000002.mdmp") Found URL "https://nprotect.com/kr/index.html" - Source: "00000000-00000620.00000002.153964.12B99000.00000004.mdmp") Found URL "https://cs.nprotect.com/" - Source: "00000000-00000620.00000002.153964.12B99000.00000004.mdmp") Found URL "http://inca.co.kr%s=%s%02demote.nprotect2.net$moddir$\bwt$windir$winio.sys\\.\physicaldrive%d\\.\scsi%d:winhvvmbkmclhypervideohyperkbdctxsmcdrvpicatwcommsctxuvipicadmpicakbmctxmcswbctkfilefilternpnusbldrnhnusbdbusprl_timeprl_tgprl_pvvsockvmcivmkdbvmwvhubvmwaudiovm3dmpvmusbmousevmmemctl\driver\devicentdll.dllsystem\currentcontrolset\services\kbdclass\enumhid\acpi\exception_execute_handler" - Source: "00000000-00000620.00000002.153964.14159000.00000002.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00000620.00000002.153964.15B00000.00000004.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00000620.00000002.153964.15B00000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00000620.00000002.153964.15B00000.00000004.mdmp") Found URL "http://www.nprotect.com" - Source: "00000000-00000620.00000002.153964.17950000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00000620.00000002.153964.17950000.00000004.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00000620.00000002.153964.17950000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00000620.00000002.153964.17950000.00000004.mdmp") Found URL "ftp://ftp://%s/%sfrom:" - Source: "00000000-00000620.00000002.153964.715B9000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00000620.00000002.153964.715B9000.00000002.mdmp") Found URL "https://curl.se/docs/hsts.html" - Source: "00000000-00000620.00000002.153964.715B9000.00000002.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00000620.00000002.153964.715B9000.00000002.mdmp") Found URL "https://%s/%sdataresulttitletreatindexexceptflagjson=[" - Source: "00000000-00000620.00000002.153964.71685000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003188.00000000.150704.00980000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr202+0)0'!http://crl.pki.goog/gsr2/gsr2.crl0?806040*0(https://pki.goog/repository/0r" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicertglobalrootg2.crl071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0(https://www.digicert.com/cps0$n+-qq%in" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0=604020*0(https://www.digicert.com/cps0p'hh" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0056nz(edfdigicert" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0=604020*0(https://www.digicert.com/cps0roi:f(:" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0=604020*0(https://www.digicert.com/cps0" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0056nz(edf" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0(https://www.digicert.com/cps0$vl%wuw\digicert" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0*u-eki?;scb;globalsign" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr103,0*0(" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://crl.globalsign.com/root.crl0vo0m00402&https://www.globalsign.com/repository/0bg6^hxg^l7gz" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0*u-eki?;scb;digicert" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0*u-eki?;scb;m>9qu0z1" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0(https://www.digicert.com/cps0$vl%wuw\globalsign" - Source: "00000000-00003188.00000000.150704.00A30000.00000004.mdmp") Found URL "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/.text$mn.idata$5.00cfg.crt$xca.crt$xcz.crt$xia.crt$xiz.crt$xpa.crt$xpz.crt$xta.crt$xtz.rdata.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$iaa.rtc$izz.rtc$taa.rtc$tzz.xdata$x.edata.idata$2.idata$3.idata$4.idata$6.data.bss.rsrc$01.rsrc$02libplds4.dllpl_arenaallocatepl_arenafinishpl_arenagrowpl_arenareleasepl_cleararenapoolpl_compactarenapoolpl_comparestringspl_comparevaluespl_finisharenapoolpl_freearenapoolpl_hashstringpl_hashtableaddpl_hashtabledestroypl_hashtabledumppl_hashtableenumerateentriespl_hashtablelookuppl_hashtablelookupconstpl_hashtablerawaddpl_hashtablerawlookuppl_hashtablerawlookupconstpl_hashtablerawremovepl_hashtableremovepl_initarenapoolpl_newhashtablepl_sizeofarenapoolexcludingpoollibversionpointpr_mallocpr_freepr_ceilinglog2libnspr4.dllqueryperformancecountergetcurrentprocessidgetcurrentthreadidgetsystemtimeasfiletimedisablethreadlibrarycallsinitializeslistheadisdebuggerpresentunhandledexceptionfiltersetunhandledexceptionfilterisprocessorfeaturepresentgetcurrentprocessterminateprocesskernel32.dllmemcpymemset__std_type_info_destroy_list_except_handler4_commonvcruntime140.dll_initterm_initterm_e_seh_filter_dll_configure_narrow_argv_initialize_narrow_environment_initialize_onexit_table_execute_onexit_table_cexitapi-ms-win-crt-runtime-l1-1-0.dll" - Source: "00000000-00003188.00000000.150704.71953000.00000002.mdmp") Found URL "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/" - Source: "00000000-00003188.00000000.150704.71964000.00000002.mdmp") Found URL "http://mozilla.org/mpl/2.0/.license" - Source: "00000000-00003188.00000000.150704.71999000.00000002.mdmp") Found URL "http://www.mozilla.org/mpl/nspr_fd_cache_size_lownspr_fd_cache_size_highclosesocket" - Source: "00000000-00003188.00000000.150704.71999000.00000002.mdmp") Found URL "http://get" - Source: "00000000-00003188.00000000.150704.71A0B000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0digicert" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0056nz(edfwph;digicert" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0=604020*0(https://www.digicert.com/cps0" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0=604020*0(https://www.digicert.com/cps0p'hh" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicertglobalrootg2.crl071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0(https://www.digicert.com/cps0$n+-qq%in" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0056nz(edf" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0=604020*0(https://www.digicert.com/cps0roi:f(:" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr202+0)0'!http://crl.pki.goog/gsr2/gsr2.crl0?806040*0(https://pki.goog/repository/0r" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "https://www.digicert.com/cps0p'hh" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr103,0*0(" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://crl.globalsign.com/root.crl0vo0m00402&https://www.globalsign.com/repository/0bg6^hxg^l7gz" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0*u-eki?;scb;digicert" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0(https://www.digicert.com/cps0$vl%wuw\digicert" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0056nz(edfi0z1" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.c" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/,o=" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0(https://www.digicert.com/cps0$vl%wuw\_40w1globalsign" - Source: "00000000-00003436.00000000.151033.033E4000.00000004.mdmp") Found URL "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/" - Source: "00000000-00003436.00000000.151033.71964000.00000002.mdmp") Found URL "http://mozilla.org/mpl/2.0/.license" - Source: "00000000-00003436.00000000.151033.71999000.00000002.mdmp") Found URL "http://www.mozilla.org/mpl/nspr_fd_cache_size_lownspr_fd_cache_size_highclosesocket" - Source: "00000000-00003436.00000000.151033.71999000.00000002.mdmp") Found URL "http://get" - Source: "00000000-00003436.00000000.151033.71A0B000.00000002.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00004516.00000000.148736.0040A000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004516.00000000.148736.0040A000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004516.00000000.148736.0040A000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00004516.00000000.148736.0040A000.00000004.mdmp") Found URL "http://sf.symcb.com/sf.crl0az0x0v0l0" - Source: "00000000-00004516.00000000.148736.0040A000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sf.symcd.com0&http://sf.symcb.com/sf.crt0'y%4f=<6fwashington1redmond1microsoft" - Source: "00000000-00004516.00000000.148736.0040A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0,nSV_^][_^][_^][tNPWVt PVt$0W9D$Dt$DSt$DVl$8Wuoj:D$ hC WP_^][][_^t$ Wt$ Vt$@Wt$DV][_^][_^][_^t$ Wt$ Vt$@Wt$DV][_^][_^t$(Wt$0P]_^[t$0P]_^[t$HPt$ jt$\Uu&h`t$0P]_^[]_^[t$0P]_^[t$0P]_^[VjPW\$(Su.9FPSh$[_]^tLS3tDW3D$PS\$dU\$$hA4hXfD$(PD$$P_^][L$P3_^][3w1WSU]_^[+|$,WS;~]_^[]_^[\$(SD$ P][_^[_^][_^][_^]_]^[_]^[F(9D$ SUVW|$439,0u_^]3tT9oD$(PjD$,UPtxUjL$(QVht$4P_^][_^][v^UV99t43_[^3_[^]UVWhh|$,u2u*9|$0u$9|$4u_^][Y^][Yty9~x8ABFxPh_^][t$$j\$ PjSPUV[]^_t5PRQF,9D$tpVhtdPh )91tf]_^[(UVW|$83D$ PVhD$ PSU\$4Pt(hO[_^]*97t^]_[Y^]_[Y91t+'97t[^]_[^]_[_^Yl$DV3SW9u9{ t|$$jt,VUD$@PsDt)D$DPjD$HPjt$$Ujt$$VPD$@jt$$jt$ Vt$Xjt$ U|$SPV_^][_^][Vj(WL$ WV9jTV(jPVSUVWhD$$jD_^][_^][_^][_^]3SVj(W]^[_D$$U][_^][_^][_^][_^t$$V][_^][_^t$,V][_^CtPU][_^][_^][_^][_^][_^l$$3L$(QPD$$Pw(_^][_^][L$ P_^]3^][Y\$ U|$$3t$0VSPt$0PPPt$$PVE4][t$$3_^][QQQQjHSUV3\$43L$HQPUt$xVD$HPD$\jt$pjt$@V9t$hutEh/l$ 3D$$PRQt$8PSQPWt$$SVPU\$,tD$,_^][t$$39\$,t$ jt$8VW;D$ VhP*t$ PD$,PW_^][_^][D$(WPU_^][_^][RQPVF$9D$DSUVt$TWVD$ 0"1*1]1g1u1353w34$4*464<44W5w56'6-63696?6E6K6`6u6|6777J7868@8Y8b8g8z88 9%9<9F9O9:B:L:U:^:s:|:;-;6;A;H;[;i;o;u;{;<$<4<=8?3G3W3d3m3}37<7@78,909<9@9D9H9L9P9I?/1T1X1\1`1d12(2,20242823l3q3w3}36<7@7D7H7L7P78094989<9@99&:u:6?6|69 9$9(9,9094989<9(:2o3^78t:x:|:s><1D1J1O1k1q12$2*2/2K2Q23!3\3d3j3o3454=4C4H4d4j45+515a5i5q5w5|5666E6Y6q6672777A7G7M7X7]7b7q78$8/898@8S8X8`8e8-0406<7@7D7H7L7P7a8<3T99:p:x:;=;V;u="2'2,2420 0$0(0,01F3j3x3;6;R;;G485<5@5D5H5L53787p7@8E8l8x:1F4M4575=5C5I5O5l5p5t5x5|5628;8a81;I#>)>/>5>;>A>G>M>S>Y>_>e>k>q>w>}>?%?+?1?7?=?C?I?O?U?[?a?g?m?s?y?0$0*00060<0B0H0N0T0Z0`0f0l0r0x0~04P4p4707p7808@8p89 9@9P99 :0:@:;P;`;p;< H>`>1`1p11 2`2203p34 404@4P4`4p45 6`6p67`7p78 888<8@8D8H8L8X8h8p8t8x89 909@9`9:(:,:0:4:8:<:h:;P;`;p;;@iO+0V>ls'2ID&XeDIv(KDigiCert Inc1www.digicert.com1$0"DigiCert Assured ID Root CA0220801000000Z311109235959Z0b1DigiCert Inc1www.digicert.com1!0DigiCert Trusted Root G40]J<0"0i3t;mqu]xfv=Y]Bvp,A`RQGt|Lu?c Qkoq]dLm0k0$http://ocsp.digicert.com0C7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E>0<0:4http://crl3.digicert.com/DigiCertAssuredIDRootCA" (Indicator: "----begin certificate----") in Source: smime3.dll68:Tbc5," "data=dbb57177081e3dbc443fd884d7e7ae09cc694939e5c3fb3070fdd8fb8808a4a2be7bb5cc5a1008ba2f43874ff3a18f9b12b7b3dba74e95d63714bc0195cf8846f4b36bd85ddc054b4e1fcd9cfbe64eeb9f9a751a6dad598f00ee7ac9b90644549b7e92d75ce141a7af15d873c010c3bf1588aae6bc3405d31805f4e8aea2d3b80c907a971ec49452f047014433fda20248f83c00e44410b64782a516d02b0a9d4d5b9482bc226225a825702d2ddbdd0190b2ddc577ae787a052d5aba95cd727fca3f8baea17fd75f605dc1ae9273ea2b92da8d44d2e28bd72c634cab51a5263df758da015c243196017bf34302c19a2fef92f05199cc481242a8553b943d1fd902f9fcceb062d261c02daf0432555e8b0e05deaa9a23022e917f18fe9e68b96c7b008c73174c6caacbd527ac5563fb2c6b8c8d09cdc1405c3f01dfd68331970749df1cf94701d326839839da83b5e992b558a6ebd42cbdc915fa92703f3dd3ae8f7390c8d3b5ad568c24bf0478f2d793854c7341cc4134aa031ae4776f49bda414ffaf51d2ee74ec4a8ae370473fd57d2263fa1ad9f4fd50e6a359594e1892da0a1030b5cff14773335b82c18049286dda5b122029eb9ce95d96bd42f744479b9b60a1f4bebebf3ed4b1c17206f7796cb673ec892f63844cd4560dc0d2970d21013706dfed6c46dbe70a656cb9954a29b2294bf2e775067ba372cabd97aa8361ee9e88e959153a3b0d9a5abe429318ecd458da2da925063f25256b117740421e2ef0b74bbef23ac9fa1add6b46e0f80938bbada784b430718dfd6a22af6696dd9238291beddfc3dee08a47aee1e416fab0f727ddae232601d37aab261947dae93d057993b428fd2e408c2b260c4b6879" HTTP/1.1 200 OK Cache-Control: no-cache Content-Type: text/plain; charset=UTF-8 Date: Mon 01 Jun 2026 09:02:14 GMT Expires: Thu 01 Jan 1970 00:00:00 GMT Server: Apache/2.2.34 (Amazon) Content-Length: 0 Connection: keep-alive with no response body "POST /nosCollection.do HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=utf-8 Content-Length: 1413 User-Agent: npNsrs Host: nsrs.nprotect.net Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "data=371ff03993ea0f5397e8196087f3e0637d080798a70d5a2054e5917b6042b2bdb63793cb50b8b9b0c68c98699bb82d5f475c3c00558f0449f94e185516d29cbee5a2505e7b346f0d4521ed57db188d6d1254f320adb7dd4ba0d0985e62c676cf7a1b01c267a05e24b6ce04a471b0ddeaa68ee745f932780fd8d10dcf6d0fc093ad96a8497c8ec92ec2ee7e84f2641800cec5b17501ab0a26c92f86509be475a9b588d56025c8187d42d16712ccf5d0f4aadd5051c5155515a8f87f604b3b707de44288cd057db5cd5e6672facfc1dbcab3f4af4e4c418012ab750f071353d88d0abd8574fab76e5d35b000afe0c2dfcf737ca13589a467d381d82d23eac3ef937f985249f24a887d74c01f3e9fb3479c7a9dff743fb325a14ac0170a68bc1cb99f9ef7d72823d01258e830cc78a9b8005f28f956c75694c67babdf5bdf4873315a2498c5429098bf095d242f279202e04222396cfe9677838f4b2b74cba69e62e16afd810b787b221f6b375604271d3edb806b6eba567bd09e3b1c8c0b81d360cffc12190741ffc96838babfd6ede8017d2d9b9d7fe59eade29344de6d94f1acfd1e245bb491aabe3fca52c8a9ca0b65b11750052292f660f331b607f9e63054b4b69cad73bf02fd0a6db848773980d61a7546d2924d40d80975d57ba88c58f3963af49587bf0e9fededafe9eab687ad54cfaaa184385cef2d60101772cef2fbd8ba107c146fd0c31a7ee2f23a4ce499cab7c0cf6ce36a4fac49bd97aa8fbee67f67f6cf406b4269757d888a0c199692689c18fe6bf21fa6d1c79eb4dcf82f0fbe9f3b19125cd87876d0dbbce90899c6dc4e7a97fb5760eae90025250b3aee8e724fc8ae939e33b30866a1db80f044f524532a9c3cb03caa14efa867639cae7d22f45fb64aa1f1ce0bb5c7aeb876a9904167ed0224b36facfd78ee024fd5fdcf90e41f1da782c7417dbcd4a98e4edc42cc0262108c30e1d9254e8e2cb8985287" HTTP/1.1 200 OK Cache-Control: no-cache Content-Type: text/plain; charset=UTF-8 Date: Mon 01 Jun 2026 09:02:17 GMT Expires: Thu 01 Jan 1970 00:00:00 GMT Server: Apache/2.2.34 (Amazon) Content-Length: 0 Connection: keep-alive with no response body "POST /nosCollection.do HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=utf-8 Content-Length: 1253 User-Agent: npNsrs Host: nsrs.nprotect.net Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "data=c29d1e1d600e3d8b7be1bd7fc78f857370bbc51ecfc19a2a92b0a7fbc3f1df9001276f3985fc25f35c89dc73b072939f8ab979ad976ebcfc2a0623d0cb13cb09eef8de841784c429de5347983b7c18f2602a31b746e0c6b1655eebfebf9ceea543e4f4a9e7e6d9a4106405b17b34bf9ace386c6f1aa2dbf24d95f5fd3b055eed32973ad45c07edc14e502e37ee791baa94426f5e504cfe0d4db4f6860e51290b250e02c65ecb097714d189c6fbe73d700a1f217accfc443298e1bbea27e2af077a28e66633bd0acef8ccc2708e2d69096f2b0f97f960dc940e95907a7cf7eec23ca176787cc4d9d2ac40634c2459de8142e2d7f8d90fd35dd572dcf5d4420db02785bfa1c495bf60474cdd6e5d674bdd9ef47e9840ce0cb4ee1b3ce08b38cb0f81e924019869f142b8932ebf805276f580792737697daf80a54c44c391773003345db32e569ec043998f8a1af79234419cae356713ee750617ec92380bf0b33edafe1c49add05cbf2d357f236a84b8f654fab63386bb3a9caf2819fb08bda9dec1fc8ab35ae9c60b2f4ebc06c3c2d98501a294766b60ad52212be21db7882fe08d43ced8ae70a0365175ee4d719805d9dd3092c4632872331ed992fa2bd85ff9f611a2d0c384f37dfff6cb79146e8185733599ae7d2966b39581bbaa56eb431572abe5ede4034b537d1b2a873ae6d28f0867b3cd35efaf28743a5cf27d6978b79acce61c4599bb4d79703f7305b0b4c22075ab55267afc65d023b713ee72a8159320e6f100c2279dc27e0ad8202f36689a6baeb1493637fde4c802eca1c63222d29e8dd92aacf1ff300e0f7895ed2f9fdfa2c003b94ba07c9efc8ab71d425bd0f7efd80ca440b24d594262d08100ed19" HTTP/1.1 200 OK Cache-Control: no-cache Content-Type: text/plain; charset=UTF-8 Date: Mon 01 Jun 2026 09:02:54 GMT Expires: Thu 01 Jan 1970 00:00:00 GMT Server: Apache/2.2.34 (Amazon) Content-Length: 0 Connection: keep-alive with no response body6e:T1e8d,"NpHttpsLib.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00001568] "nProtectUninstaller.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet UnInstall\nProtect Online Security\nProtectUninstaller.exe]- [targetUID: 00000000-00001568] "nos_launcher.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\nos_launcher.exe]- [targetUID: 00000000-00001568] "sqlite3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\sqlite3.dll]- [targetUID: 00000000-00001568] "npeNSISUtil.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsxEFCB.tmp\npeNSISUtil.dll]- [targetUID: 00000000-00001568] "freebl3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\freebl3.dll]- [targetUID: 00000000-00001568] "nss3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\nss3.dll]- [targetUID: 00000000-00001568] "nssckbi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\nssckbi.dll]- [targetUID: 00000000-00001568] "ssl3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\ssl3.dll]- [targetUID: 00000000-00001568] "BWT.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\nProtect Shared\Engine\BWT.dll]- [targetUID: 00000000-00001568] "BwtTrust.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\nProtect Shared\Engine\BwtTrust.dll]- [targetUID: 00000000-00001568] "softokn3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\softokn3.dll]- [targetUID: 00000000-00001568] "libnspr4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\libnspr4.dll]- [targetUID: 00000000-00001568] "NpBWT.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\Common Files\nProtect Shared\Engine\NpBWT.dll]- [targetUID: 00000000-00001568] "certutil.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\certutil.exe]- [targetUID: 00000000-00001568] "npcf_win_32u.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsxEFCB.tmp\npcf_win_32u.dll]- [targetUID: 00000000-00001568] "nssutil3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\nssutil3.dll]- [targetUID: 00000000-00001568] "smime3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\smime3.dll]- [targetUID: 00000000-00001568] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\vcruntime140.dll]- [targetUID: 00000000-00001568] "npPb.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsxEFCB.tmp\npPb.dll]- [targetUID: 00000000-00001568] "certmgr.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\certmgr.exe]- [targetUID: 00000000-00001568] "libplc4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\libplc4.dll]- [targetUID: 00000000-00001568] "libplds4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet\nProtect Online Security\ncert\libplds4.dll]- [targetUID: 00000000-00001568] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsxEFCB.tmp\System.dll]- [targetUID: 00000000-00001568] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsxEFCB.tmp\nsDialogs.dll]- [targetUID: 00000000-00001568] "GetVersion.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\nsxEFCB.tmp\GetVersion.dll]- [targetUID: 00000000-00001568] "nsExec.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsxEFCB.tmp\nsExec.dll]- [targetUID: 00000000-00001568] "UserInfo.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsxEFCB.tmp\UserInfo.dll]- [targetUID: 00000000-00001568] "Crypto.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\nsxEFCB.tmp\Crypto.dll]- [targetUID: 00000000-00001568] "tkfwvt.sys" has type "PE32 executable for MS Windows 6.00 (native) Intel i386 7 sections"- Location: [%WINDIR%\SysWOW64\tkfwvt.sys]- [targetUID: 00000000-00001568] "TKIdsVt64.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 8 sections"- Location: [%WINDIR%\System32\TKIdsVt64.sys]- [targetUID: 00000000-00001568] "TKIdsVt.sys" has type "PE32 executable for MS Windows 6.00 (native) Intel i386 7 sections"- Location: [%WINDIR%\SysWOW64\TKIdsVt.sys]- [targetUID: 00000000-00001568] "TKTool2k64.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 8 sections"- Location: [%WINDIR%\System32\TKTool2k64.sys]- [targetUID: 00000000-00001568] "TKTool2k.sys" has type "PE32 executable for MS Windows 5.00 (native) Intel i386 7 sections"- Location: [%WINDIR%\SysWOW64\TKTool2k.sys]- [targetUID: 00000000-00001568] "npeNSISUtil.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsp67E9.tmp\npeNSISUtil.dll]- [targetUID: 00000000-00001568] "npcf_win_32u.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsp67E9.tmp\npcf_win_32u.dll]- [targetUID: 00000000-00001568] "npcf_win_32u.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet UnInstall\nProtect Online Security\npcf_win_32u.dll]- [targetUID: 00000000-00001568] "npPb.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\INCAInternet UnInstall\nProtect Online Security\npPb.dll]- [targetUID: 00000000-00001568] "npPb.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsp67E9.tmp\npPb.dll]- [targetUID: 00000000-00001568] "TKTool2k64.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 8 sections"- Location: [%WINDIR%\SysWOW64\TKTool2k64.sys]- [targetUID: 00000000-00001568] "TKTool2k.sys" has type "PE32 executable for MS Windows 5.00 (native) Intel i386 7 sections"- Location: [%WINDIR%\System32\TKTool2k.sys]- [targetUID: 00000000-00001568]6f:T2b2c,"