Windows Analysis Report
PCPrivacyShieldSetup.exe

Overview

General Information

Sample name: PCPrivacyShieldSetup.exe
Analysis ID: 1545595
MD5: 36e634c5cd1d301df846df0d28f0db50
SHA1: 1daa5039a206eac01555c0554bc0772e477a9dca
SHA256: 681b61911a4e840540afad0f05af5669140e86d7c9d8a1377d50483d4e5d2352
Tags: exeuser-MaxMax66
Infos:

Detection

Score: 34
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Compliance

Score: 36
Range: 0 - 100

Signatures

Multi AV Scanner detection for dropped file
.NET source code references suspicious native API functions
Installs Task Scheduler Managed Wrapper
PE file contains section with special chars
PE file has nameless sections
Tries to harvest and steal browser information (history, passwords, etc)
Abnormal high CPU Usage
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PCPrivacyShield.exe ReversingLabs: Detection: 20%
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\TaskTools.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x64\DecryptTool.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\WcDialog.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\schedc10.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\InstAct.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PCPrivacyShield.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Armt.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\trialnotification.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\updater.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x86\DecryptTool.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\TaskTools.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x64\DecryptTool.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\WcDialog.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\schedc10.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\InstAct.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PCPrivacyShield.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Armt.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\trialnotification.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\updater.exe Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe EXE: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x86\DecryptTool.exe Jump to behavior
Uses 32bit PE files
Source: PCPrivacyShieldSetup.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\installlog.txt Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe File created: C:\Program Files (x86)\PC Privacy Shield\README.txt
Source: PCPrivacyShieldSetup.exe Static PE information: certificate valid
Source: C:\Windows\System32\msiexec.exe File opened: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: PCPrivacyShieldSetup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: wininet.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1716368342.0000000006AAC000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1768133800.0000000003A51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\NetFirewall.pdb: source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dropbox\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net40\Newtonsoft.Json.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1902083448.000000000C6A2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\3\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\ChromeDownloads\ExcelDataReader-develop\ExcelDataReader-develop\src\ExcelDataReader\obj\Debug\net45\ExcelDataReader.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbl source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\NetFirewall.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: PCPrivacyShieldSetup.exe, PCPrivacyShieldSetup.exe, 00000000.00000000.1679879072.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1966657651.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930059215.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000000.1762525754.0000000000E18000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: d:\agent\_work\3\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Branch\win\Release\stubs\x86\Updater.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcp100.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcr100.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb| source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\ChromeDownloads\ExcelDataReader-develop\ExcelDataReader-develop\src\ExcelDataReader\obj\Debug\net45\ExcelDataReader.pdbSHA256 source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcr120.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1939151292.0000000005E22000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: msvcp120.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet\bin\2010\Win32\ReleaseStatic\System.Data.SQLite.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\ResourceCleaner.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\SfxCA.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074A3000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wininet.pdbUGP source: PCPrivacyShieldSetup.exe, 00000000.00000003.1716368342.0000000006AAC000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1768133800.0000000003A51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdbp source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1939151292.0000000005E22000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dropbox\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net40\Newtonsoft.Json.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, InstAct.exe, 0000000B.00000002.1902083448.000000000C6A2000.00000002.00000001.01000000.00000010.sdmp
Checks for available system drives (often done to infect USB drives)
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: z: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: x: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: v: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: t: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: r: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: p: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: n: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: l: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: j: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: h: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: f: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: b: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: y: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: w: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: u: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: s: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: q: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: o: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: m: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: k: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: i: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: g: Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: e: Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File opened: c:
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File opened: a: Jump to behavior
Creates COM task schedule object (often to register a task for autostart)
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D027F0 ReadFile,FindFirstFileW,FindClose,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, 0_2_00D027F0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDC9A0 FindFirstFileW,GetLastError,FindClose, 0_2_00CDC9A0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDC040 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr, 0_2_00CDC040
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE11B0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW, 0_2_00BE11B0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CC1130 GetShortPathNameW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00CC1130
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDE270 FindFirstFileW,FindClose, 0_2_00CDE270
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDC3D0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW, 0_2_00CDC3D0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D208C0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose, 0_2_00D208C0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00CDBDB0 _wcsrchr,_wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,SetFileAttributesW,FindNextFileW, 3_2_00CDBDB0
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.4:54730 -> 1.1.1.1:53
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 63Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 47Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 120Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 40Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 40Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 90Expect: 100-continue
Source: global traffic HTTP traffic detected: GET /ext/cyber_whitelist.txt HTTP/1.1Host: pps.shieldappsverify.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 90Expect: 100-continue
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 50.87.253.110 50.87.253.110
Source: Joe Sandbox View IP Address: 151.101.194.137 151.101.194.137
Source: Joe Sandbox View IP Address: 151.101.194.137 151.101.194.137
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 172.64.149.23
Source: unknown TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown TCP traffic detected without corresponding DNS query: 172.64.149.23
Source: unknown TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.64
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BmRxXm81SrA95px&MD=Rw14uCfM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE= HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/css/dist/block-library/style.min.css?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/formcraft3/dist/formcraft-common.css?ver=3.8.24 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jquery-2.2.4.min.js?ver=2.2.4 HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/formcraft3/dist/form.css?ver=3.8.24 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/complianz-gdpr-premium/assets/css/cookieblocker.min.css?ver=1720730547 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/style.css?ver=1.0.1 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/css/bootstrap.min.css?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/css/slick.css?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/images/shield-apps-logo.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2022/03/palceholder.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2015/03/box-shieldapps-cyber-privacy1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2020/03/box-vpn1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2022/10/box-shield-antivirus1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/js/bootstrap.min.js?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/js/ScrollToPlugin.min.js?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/js/TweenMax.min.js?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/js/slick.min.js?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/css/icomoon/icomoon.ttf?dzxhyb HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://shieldapps.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://shieldapps.com/wp-content/themes/shield-apps2/style.css?ver=1.0.1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/images/about-bkg.jpg HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/wp-content/themes/shield-apps2/style.css?ver=1.0.1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/js/design.js?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/shield-apps2/js/skip-link-focus-fix.js?ver=20151215 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2016/03/box-ransomware-defender1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2015/04/box-pc-privacy-shield1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2015/05/box-ShieldApps_Webcam_Blocker1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2015/06/box-identity-theft-preventer1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2016/03/box-pc-cleaning-utility1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2016/03/box-anti-malware1.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2019/08/color-line.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2020/02/partner_logos_c.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/complianz-gdpr-premium/cookiebanner/js/complianz.min.js?ver=1720730544 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-json/complianz/v1/banner?lang=en&locale=en_US&token=onhno HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/jsonAccept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=6.6.2 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/complianz/css/banner-1-optout.css?v=30 HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /td/ga/rul?tid=G-V0DL3XBK82&gacid=1954789622.1730307161&gtm=45Pe4as0v896163840za200zb813187311&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533421~101823848~101878899~101878944~101925629&z=325251096 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://shieldapps.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET //favicon.png HTTP/1.1Host: shieldapps.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1439299319.1730307161; _gid=GA1.2.131272535.1730307161; _gat=1; _ga_V0DL3XBK82=GS1.1.1730307161.1.0.1730307161.60.0.0; _ga=GA1.1.1954789622.1730307161
Source: global traffic HTTP traffic detected: GET /ext/cyber_whitelist.txt HTTP/1.1Host: pps.shieldappsverify.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BmRxXm81SrA95px&MD=Rw14uCfM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: PCPrivacyShieldSetup.exe, 00000000.00000000.1679879072.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1966657651.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930059215.0000000000E18000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: FlashWindowFlashWindowExGetPackagePathhttp://www.yahoo.comhttp://www.example.comhttp://www.google.comTESTtin9999.tmpattachment=.partGETcharsetDLD "filenameutf-8utf-16123POSTAdvancedInstallerLocal Network ServerISO-8859-1US-ASCIIHTTP/1.0Range: bytes=%u- equals www.yahoo.com (Yahoo)
Source: PCPrivacyShieldSetup.exe String found in binary or memory: http://www.yahoo.com equals www.yahoo.com (Yahoo)
Source: chrome.exe, 00000017.00000002.4207432841.00001D60024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: pps.shieldappsverify.com
Source: global traffic DNS traffic detected: DNS query: shieldapps.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: code.jquery.com
Source: global traffic DNS traffic detected: DNS query: analytics.google.com
Source: global traffic DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic DNS traffic detected: DNS query: td.doubleclick.net
Source: unknown HTTP traffic detected: POST /pcprivshield/pcprivshield_2.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pps.shieldappsverify.comContent-Length: 63Expect: 100-continueConnection: Keep-Alive
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anglebug.com/8280
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, TaskTools.exe, 00000014.00000002.1998769025.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://block.shieldapps.us/cps_blocked.html
Source: PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiC
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1970286967.00000000072F0000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1968333544.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931797641.00000000044B7000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1928662615.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1966272462.0000000005C54000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCx
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://clients3.google.com/generate_204
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: PCPrivacyShieldSetup.exe, 00000000.00000002.1968333544.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1897935406.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1942206234.00000000010C4000.00000004.00000020.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.1982764222.000000000076A000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4383471863.000000000A4A1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigni
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931797641.00000000044B7000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1928662615.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSignivl~
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1968333544.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931797641.00000000044B7000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1928662615.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1966272462.0000000005C54000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931797641.00000000044B7000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1928662615.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pa
Source: chrome.exe, 00000017.00000002.4217928603.00001D60035F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 00000017.00000003.2277253893.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2183800270.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000017.00000002.4204991671.00001D600221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/k
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: InstAct.exe, 0000000B.00000002.1902083448.000000000C6A2000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: PCPrivacyShieldSetup.exe, 00000000.00000002.1970286967.00000000072F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1966272462.0000000005C54000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0K
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1970286967.00000000072F0000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1968333544.0000000005C20000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764642146.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764913738.000000000139E000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931797641.00000000044B7000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1928662615.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931280057.0000000003135000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1764059979.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931797641.00000000044B7000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1928662615.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com00
Source: PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pps.5l7k9bn.info/setups/privacy/pcprivacyshield/ext/ff/global_adblock2
Source: InstAct.exe, 0000000B.00000002.1898806369.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002D15000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pps.shieldappsverify.com
Source: InstAct.exe, 0000000B.00000002.1898806369.0000000002B52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pps.shieldappsverify.com/setups/
Source: InstAct.exe, 0000000B.00000002.1898806369.0000000002B52000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pps.shieldappsverify.com/setups/privacy/pcprivacyshield/s/updates.txt
Source: InstAct.exe, 0000000B.00000002.1898806369.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002D15000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pps.shieldappsverify.comd
Source: chrome.exe, 00000017.00000002.4211939952.00001D6002BBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: InstAct.exe, 0000000B.00000002.1898806369.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002D02000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000281B000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.00000000031B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, TaskTools.exe, 00000014.00000002.1998769025.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://scp.e2c3h1y.info/dbvercheck/check_f1.php
Source: PCPrivacyShieldSetup.exe, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp, InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, TaskTools.exe, 00000014.00000002.1998769025.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://shieldapps.com/eula/
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, TaskTools.exe, 00000014.00000002.1998769025.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://shieldapps.com/eula/&https://shieldapps.com/privacy-policy/3https://shieldapps.com/supportmai
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1961491681.0000000006223000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1966298410.0000000006238000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961563281.0000000006232000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1760842982.000000000622A000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1962135661.0000000006233000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://shieldapps.com/eula/C
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://t2.symcb.com0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://tl.symcd.com0&
Source: chrome.exe, 00000017.00000002.4211891400.00001D6002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000017.00000002.4211891400.00001D6002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://unisolated.invalid/a
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wixtoolset.org
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wixtoolset.org/news/
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://wixtoolset.org/releases/
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: PCPrivacyShieldSetup.exe String found in binary or memory: http://www.google.com
Source: chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thir
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/unix/customizing.html#prefs
Source: InstAct.exe, 0000000B.00000002.1902083448.000000000C6A2000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: PCPrivacyShieldSetup.exe String found in binary or memory: http://www.yahoo.com
Source: PCPrivacyShield.exe, 00000013.00000002.4560769217.00000000104F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: chrome.exe, 00000017.00000002.4205508309.00001D6002278000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000017.00000002.4213788644.00001D6002E44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000017.00000002.4204991671.00001D600221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4213788644.00001D6002E44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000017.00000002.4205508309.00001D6002278000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000017.00000002.4206461158.00001D600235C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.w.org/
Source: chrome.exe, 00000017.00000002.4210158134.00001D6002918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.4208399201.00001D600260C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000017.00000003.2043258407.00001D6002E98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, InstAct.exe, 00000007.00000002.1843409932.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000007.00000002.1845083152.000000000772E000.00000002.00000001.01000000.0000000D.sdmp, InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003036000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore/detail/pobombckckddakmbebafbmamchdffedp
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B23000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003036000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore/detail/pobombckckddakmbebafbmamchdffedp)Failed
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore/detail/pobombckckddakmbebafbmamchdffedpRhttps://microsoftedge.mic
Source: chrome.exe, 00000017.00000002.4209866592.00001D60028B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000017.00000002.4211891400.00001D6002BAC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2106626639.00001D6002E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2104546867.00001D6002E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624475467.00001D6004FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4207863974.00001D6002548000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2046785475.00001D6002E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2043258407.00001D6002E98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000017.00000003.1998628522.0000537400694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1998082436.0000537400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2089508607.00001D6003418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000017.00000002.4204991671.00001D600221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000017.00000003.1985484642.00006FFC002C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000017.00000002.4212560856.00001D6002CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4204991671.00001D600221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4218728757.00001D600393C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4209866592.00001D60028B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000017.00000002.4208399201.00001D600260C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://code.jquery.com/jquery-2.2.4.min.js?ver=2.2.4
Source: chrome.exe, 00000017.00000003.2131077220.00001D6002494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2078314892.00001D6002494000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crbug.com/368855.)
Source: chrome.exe, 00000017.00000003.2167094296.00001D600253C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving
Source: chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2167094296.00001D600253C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:
Source: chrome.exe, 00000017.00000002.4214701848.00001D6002F7C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-servingsN=Micros
Source: chrome.exe, 00000017.00000002.4209866592.00001D60028B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000017.00000003.2167094296.00001D600253C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving
Source: chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_p
Source: chrome.exe, 00000017.00000003.2088217650.00001D6003350000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000017.00000002.4207432841.00001D60024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000017.00000002.4207432841.00001D60024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultll.Touch
Source: chrome.exe, 00000017.00000002.4210805359.00001D60029CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actionsA
Source: chrome.exe, 00000017.00000002.4210805359.00001D60029CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.4210805359.00001D60029CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000017.00000002.4207432841.00001D60024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000017.00000002.4210158134.00001D6002918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.4207432841.00001D60024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000017.00000002.4207432841.00001D60024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultheel
Source: chrome.exe, 00000017.00000002.4210158134.00001D6002918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.4217548970.00001D6003554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2277253893.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2183800270.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4218137838.00001D600365C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doubleclick.net/
Source: chrome.exe, 00000017.00000002.4217548970.00001D6003554000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doubleclick.net/Z
Source: chrome.exe, 00000017.00000002.4218137838.00001D600365C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doubleclick.net/ps.com/
Source: chrome.exe, 00000017.00000002.4217548970.00001D6003554000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://doubleclick.net/t/
Source: chrome.exe, 00000017.00000002.4210881976.00001D60029F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000017.00000002.4210881976.00001D60029F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000017.00000002.4210881976.00001D60029F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, TaskTools.exe, 00000014.00000002.1998769025.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dw.verifywebpro.com/api.php
Source: chrome.exe, 00000017.00000002.4204991671.00001D600221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 00000017.00000002.4204991671.00001D600221C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: chrome.exe, 00000017.00000003.2089508607.00001D6003418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000017.00000003.1998628522.0000537400694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1998082436.0000537400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gjtS
Source: chrome.exe, 00000017.00000003.1998628522.0000537400694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1998082436.0000537400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2089508607.00001D6003418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000017.00000003.1998628522.0000537400694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1998082436.0000537400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000017.00000003.1998082436.0000537400684000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000017.00000003.2089508607.00001D6003418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000017.00000003.3632211551.00001D600267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624636601.00001D600267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4218728757.00001D600393C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4217928603.00001D60035F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4217548970.00001D6003554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2277253893.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2183800270.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googletagmanager.com/
Source: chrome.exe, 00000017.00000003.2277253893.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2183800270.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googletagmanager.com/9e3
Source: chrome.exe, 00000017.00000002.4217548970.00001D6003554000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googletagmanager.com/O
Source: chrome.exe, 00000017.00000002.4218728757.00001D600393C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googletagmanager.com/cy
Source: chrome.exe, 00000017.00000002.4217548970.00001D6003554000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googletagmanager.com/f
Source: chrome.exe, 00000017.00000002.4217928603.00001D60035F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://googletagmanager.com/pH;
Source: PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://haveibeenpwned.com/
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003046000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.0000000002839000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000293C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ids.xverify.info
Source: PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ids.xverify.info/pwnapi/api.php?useragent=PC
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000017.00000003.2042627918.00001D6002964000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000017.00000002.4210805359.00001D60029CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000017.00000002.4210805359.00001D60029CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000017.00000002.4228364726.0000537400270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4229761037.0000537400770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000017.00000002.4228364726.0000537400270000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardSt(
Source: chrome.exe, 00000017.00000002.4228364726.0000537400270000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardSt(Z
Source: chrome.exe, 00000017.00000002.4229761037.0000537400770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardStwY
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000017.00000002.4229761037.0000537400770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000017.00000003.1999190221.00005374006E8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000017.00000003.1995885847.000053740039C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000017.00000002.4207092071.00001D600246C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000017.00000002.4210158134.00001D6002918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000017.00000002.4216062281.00001D60030E5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4213616509.00001D6002E1F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000017.00000003.2045300074.00001D6002934000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000017.00000002.4207489483.00001D60024E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2045300074.00001D6002934000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000017.00000002.4207489483.00001D60024E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000017.00000003.2045300074.00001D6002934000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000017.00000002.4216062281.00001D60030E5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4213616509.00001D6002E1F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1728918159&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000017.00000002.4216062281.00001D60030E5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4213616509.00001D6002E1F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1728918182&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000017.00000002.4213616509.00001D6002E1F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2659613983.00001D6003134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1729004809&target=OPTIMIZATION_TARGET_CLI
Source: chrome.exe, 00000017.00000003.2045300074.00001D6002934000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000017.00000003.2045300074.00001D6002934000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000017.00000002.4216062281.00001D60030E5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4213616509.00001D6002E1F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2659613983.00001D6003134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4212277284.00001D6002C4C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=5&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000017.00000003.2277253893.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetModels?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js?
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js?7https://sandbox.google.com/payments/v4/js/
Source: PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pps.shieldappsverify.com
Source: InstAct.exe, 0000000E.00000002.1943989651.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000260B000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000003E23000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pps.shieldappsverify.com/pcprivshield/pcprivshield_2.php
Source: InstAct.exe, 0000000F.00000002.2010871467.000000000260B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pps.shieldappsverify.com/pcprivshield/pcprivshield_2.phpd
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 00000007.00000002.1845083152.000000000772E000.00000002.00000001.01000000.0000000D.sdmp String found in binary or memory: https://pps.shieldappsverify.comzhttps://shieldapps.com/supportmain/pc-privacy-shield-support/
Source: chrome.exe, 00000017.00000002.4205508309.00001D6002278000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000017.00000002.4215286674.00001D600300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sandbox.google.com/
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1969508218.0000000006625000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767804983.00000000044B1000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1931797641.00000000044B7000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1928662615.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1767936999.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2277253893.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com
Source: chrome.exe, 00000017.00000003.2183800270.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2092779925.00001D6003528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/
Source: chrome.exe, 00000017.00000002.4212560856.00001D6002CC8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com//favicon.png
Source: chrome.exe, 00000017.00000002.4214701848.00001D6002F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4214406203.00001D6002F14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/90dd1f3f-be22-409e-a4ce-2fbab89593ad
Source: chrome.exe, 00000017.00000002.4214406203.00001D6002F14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/90dd1f3f-be22-409e-a4ce-2fbab89593ad6
Source: chrome.exe, 00000017.00000002.4214406203.00001D6002F14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/90dd1f3f-be22-409e-a4ce-2fbab89593ader
Source: chrome.exe, 00000017.00000002.4214406203.00001D6002F14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/90dd1f3f-be22-409e-a4ce-2fbab89593adgeHandler
Source: chrome.exe, 00000017.00000002.4206461158.00001D600235C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/?p=5772
Source: chrome.exe, 00000017.00000002.4211939952.00001D6002BBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/J
Source: chrome.exe, 00000017.00000002.4211044615.00001D6002A2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/bserver
Source: chrome.exe, 00000017.00000002.4212338065.00001D6002C74000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/erPolicy
Source: chrome.exe, 00000017.00000002.4214406203.00001D6002F14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/ost-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=17
Source: InstAct.exe, 0000000F.00000002.2063933765.0000000009519000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/post-instal
Source: InstAct.exe, 0000000F.00000002.2010871467.00000000026C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/
Source: InstAct.exe, 0000000F.00000002.2010871467.00000000026C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?
Source: chrome.exe, 00000017.00000002.4220969629.00001D6003C19000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=1
Source: PCPrivacyShieldSetup.exe, PCPrivacyShieldSetup.exe, 00000003.00000003.1929595718.000000000135C000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930451926.000000000135E000.00000004.00000020.00020000.00000000.sdmp, InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, TaskTools.exe, 00000014.00000002.1998769025.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/privacy-policy/
Source: InstAct.exe, 0000000B.00000002.1898806369.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/privacy-policy/3https://shieldapps.com/supportmain/product_support//http://sc
Source: PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/supportmain/pc-privacy-shield-support/
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B29000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003017000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.000000000282C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000292C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, TaskTools.exe, 00000014.00000002.1998769025.0000000002FAC000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/supportmain/product_support/
Source: chrome.exe, 00000017.00000002.4217548970.00001D6003554000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/t/
Source: chrome.exe, 00000017.00000003.2277253893.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2183800270.00001D6002E64000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/uD
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/themes/shield-apps2/js/ScrollToPlugin.min.js?ver=6.6.2
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/themes/shield-apps2/js/TweenMax.min.js?ver=6.6.2
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/themes/shield-apps2/js/bootstrap.min.js?ver=6.6.2
Source: chrome.exe, 00000017.00000002.4214406203.00001D6002F14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/themes/shield-apps2/js/design.js?ver=6.6.2
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/themes/shield-apps2/js/slick.min.js?ver=6.6.2
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/uploads/2015/03/box-shieldapps-cyber-privacy1.png
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/uploads/2015/05/box-ShieldApps_Webcam_Blocker1.png
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/uploads/2015/06/box-identity-theft-preventer1.png
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/uploads/2016/03/box-ransomware-defender1.png
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/uploads/2020/03/box-vpn1.png
Source: chrome.exe, 00000017.00000003.2095010828.00001D60031C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-content/uploads/2022/10/box-shield-antivirus1.png
Source: chrome.exe, 00000017.00000002.4206461158.00001D600235C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-json/
Source: chrome.exe, 00000017.00000002.4206461158.00001D600235C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/wp-json/wp/v2/pages/5772
Source: chrome.exe, 00000017.00000003.2066240499.00001D6002E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4206461158.00001D600235C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/xmlrpc.php
Source: chrome.exe, 00000017.00000003.2066240499.00001D6002E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4206461158.00001D600235C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com/xmlrpc.phpLink:
Source: chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com0
Source: chrome.exe, 00000017.00000002.4211044615.00001D6002A2C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.com:443
Source: chrome.exe, 00000017.00000002.4212397476.00001D6002C98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.comHX
Source: chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://shieldapps.comh
Source: chrome.exe, 00000017.00000002.4210805359.00001D60029CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.4210805359.00001D60029CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4210989560.00001D6002A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://system.data.sqlite.org/
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1939151292.0000000005E22000.00000002.00000001.01000000.00000012.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003102000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://taskscheduler.codeplex.com/
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1939481330.0000000005E6A000.00000002.00000001.01000000.00000012.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003102000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://taskscheduler.codeplex.com/H&
Source: chrome.exe, 00000017.00000002.4218137838.00001D600365C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://td.doubleclick.net/
Source: chrome.exe, 00000017.00000002.4211891400.00001D6002BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4207489483.00001D60024E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://td.doubleclick.net/td/ga/rul?tid=G-V0DL3XBK82&gacid=1954789622.1730307161&gtm=45Pe4as0v89616
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003046000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.0000000002839000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000293C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://testurl.com
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003046000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.0000000002839000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000293C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://testurl.comPMDoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECLBOkl9
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000000.1931383015.0000000000482000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: https://trello.com/c/VusdVdfd/345-add-red
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.advancedinstaller.com
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: chrome.exe, 00000017.00000003.3632211551.00001D600267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624636601.00001D600267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2045196020.00001D600267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.2097804706.00001D600267C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000017.00000002.4213566147.00001D6002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000017.00000003.2043258407.00001D6002E98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/$
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thi
Source: chrome.exe, 00000017.00000002.4210158134.00001D6002918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/dot2.gif
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/x2.gif
Source: chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000017.00000003.3629543495.00001D6004490000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com
Source: chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000017.00000002.4212560856.00001D6002CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: chrome.exe, 00000017.00000003.2089508607.00001D6003418000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000017.00000002.4212560856.00001D6002CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4217004943.00001D6003354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierra5-https://www.googleapis.com/auth/sierrasandbox6.https://www.g
Source: chrome.exe, 00000017.00000002.4212560856.00001D6002CC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624907200.00001D600400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.3624717557.00001D6003134000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: chrome.exe, 00000017.00000002.4212397476.00001D6002C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4213566147.00001D6002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com/
Source: chrome.exe, 00000017.00000002.4211939952.00001D6002BBC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=GT-M38DBR2
Source: chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fshieldapps.co
Source: chrome.exe, 00000017.00000002.4216574035.00001D60031A5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fshie
Source: chrome.exe, 00000017.00000002.4212397476.00001D6002C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4215918809.00001D60030B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.comHX
Source: chrome.exe, 00000017.00000002.4213566147.00001D6002E0C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000017.00000002.4208615088.00001D60026B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: InstAct.exe, 0000000B.00000002.1902083448.000000000C6A2000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.000000000313A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.sqlite.org/copyright.html2
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.thawte.com/cps0/
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000003.1961456996.0000000001405000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.thawte.com/repository0W
Source: chrome.exe, 00000017.00000002.4207432841.00001D60024C0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.210.194.253:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.4:49843 version: TLS 1.2
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CBBCC0 SendMessageW,GetParent,GetParent,GetWindowRect,GetParent,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,MapWindowPoints,FillRect,DeleteDC,SendMessageW,SendMessageW,SendMessageW, 0_2_00CBBCC0

System Summary
barindex
PE file contains section with special chars
Source: Armt.exe.0.dr Static PE information: section name: nI7-I
Source: DecryptTool.exe.0.dr Static PE information: section name: nI7-I
Source: DecryptTool.exe0.0.dr Static PE information: section name: Hhex%(F
Source: InstAct.exe.0.dr Static PE information: section name: Hhex%(F
Source: PCPrivacyShield.exe.0.dr Static PE information: section name: nI7-I
Source: schedc10.exe.0.dr Static PE information: section name: Hhex%(F
Source: TaskTools.exe.0.dr Static PE information: section name: nI7-I
Source: trialnotification.exe.0.dr Static PE information: section name: nI7-I
Source: CaByp.dll.0.dr Static PE information: section name: Hhex%(F
PE file has nameless sections
Source: Armt.exe.0.dr Static PE information: section name:
Source: DecryptTool.exe0.0.dr Static PE information: section name:
Source: InstAct.exe.0.dr Static PE information: section name:
Source: PCPrivacyShield.exe.0.dr Static PE information: section name:
Source: schedc10.exe.0.dr Static PE information: section name:
Source: TaskTools.exe.0.dr Static PE information: section name:
Source: trialnotification.exe.0.dr Static PE information: section name:
Source: CaByp.dll.0.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00C9A630 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,GetSysColor, 0_2_00C9A630
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00C340A0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W, 0_2_00C340A0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BD8280 NtdllDefWindowProc_W, 0_2_00BD8280
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE8270 NtdllDefWindowProc_W, 0_2_00BE8270
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BD5580 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,GetWindowTextLengthW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString, 0_2_00BD5580
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BD8840 NtdllDefWindowProc_W, 0_2_00BD8840
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BD5BE0 NtdllDefWindowProc_W,GetSysColor, 0_2_00BD5BE0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BD7B50 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow, 0_2_00BD7B50
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE2C90 KillTimer,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection, 0_2_00BE2C90
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BF5D40 NtdllDefWindowProc_W, 0_2_00BF5D40
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BDEE70 NtdllDefWindowProc_W, 0_2_00BDEE70
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BD4E60 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,GetWindowTextLengthW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W, 0_2_00BD4E60
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BDEFE0 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W, 0_2_00BDEFE0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00C7EF50 NtdllDefWindowProc_W, 0_2_00C7EF50
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00C9A630 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W, 3_2_00C9A630
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00C340A0 NtdllDefWindowProc_W, 3_2_00C340A0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BD8280 NtdllDefWindowProc_W, 3_2_00BD8280
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BE8270 NtdllDefWindowProc_W, 3_2_00BE8270
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BD5580 SysFreeString,NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,SysFreeString,NtdllDefWindowProc_W,SysFreeString, 3_2_00BD5580
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BD8840 NtdllDefWindowProc_W, 3_2_00BD8840
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BD5BE0 NtdllDefWindowProc_W, 3_2_00BD5BE0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BD7B50 NtdllDefWindowProc_W, 3_2_00BD7B50
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BE2C90 NtdllDefWindowProc_W,DeleteCriticalSection, 3_2_00BE2C90
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BF5D40 NtdllDefWindowProc_W, 3_2_00BF5D40
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BD4EB7 NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W, 3_2_00BD4EB7
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BDEE70 NtdllDefWindowProc_W, 3_2_00BDEE70
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BD4FF5 NtdllDefWindowProc_W, 3_2_00BD4FF5
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BDEFE0 NtdllDefWindowProc_W, 3_2_00BDEFE0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00C7EF50 NtdllDefWindowProc_W, 3_2_00C7EF50
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6fd11f.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID2E4.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID362.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID3A1.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID3D1.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID411.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID441.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID4AF.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{AFBC5F3E-A4BA-45F5-AD51-E866312F779E} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID6A4.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID84B.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID86B.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID966.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDAFD.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDB5C.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{AFBC5F3E-A4BA-45F5-AD51-E866312F779E} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{AFBC5F3E-A4BA-45F5-AD51-E866312F779E}\icon_1.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{AFBC5F3E-A4BA-45F5-AD51-E866312F779E}\SystemFoldermsiexec.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE485.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6fd121.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6fd121.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6B4.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI703.tmp Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSID2E4.tmp Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D027F0 0_2_00D027F0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D76840 0_2_00D76840
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D77900 0_2_00D77900
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00DA0040 0_2_00DA0040
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE9023 0_2_00BE9023
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE11B0 0_2_00BE11B0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CC1130 0_2_00CC1130
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00DB328A 0_2_00DB328A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BEE230 0_2_00BEE230
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BF73A0 0_2_00BF73A0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00DA839A 0_2_00DA839A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BEC363 0_2_00BEC363
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BF84B0 0_2_00BF84B0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CBC450 0_2_00CBC450
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BDF420 0_2_00BDF420
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00C37500 0_2_00C37500
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE9650 0_2_00BE9650
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BFB720 0_2_00BFB720
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BC4772 0_2_00BC4772
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BC7480 0_2_00BC7480
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BEF9F0 0_2_00BEF9F0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CE29A0 0_2_00CE29A0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CEEAF0 0_2_00CEEAF0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D98A2C 0_2_00D98A2C
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE4B30 0_2_00BE4B30
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CF3B50 0_2_00CF3B50
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BEBC61 0_2_00BEBC61
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BC2EA0 0_2_00BC2EA0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00DAAEF1 0_2_00DAAEF1
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE8E20 0_2_00BE8E20
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00DACE19 0_2_00DACE19
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D35F00 0_2_00D35F00
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_3_0135CF3A 3_3_0135CF3A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_3_0136CEC9 3_3_0136CEC9
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BEE230 3_2_00BEE230
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BF73A0 3_2_00BF73A0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BF84B0 3_2_00BF84B0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00CBC450 3_2_00CBC450
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BDF420 3_2_00BDF420
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00C37500 3_2_00C37500
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BFC600 3_2_00BFC600
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BE9650 3_2_00BE9650
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BFB7BE 3_2_00BFB7BE
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BC4772 3_2_00BC4772
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BC7480 3_2_00BC7480
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BEF9F0 3_2_00BEF9F0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BE4B30 3_2_00BE4B30
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BEBC61 3_2_00BEBC61
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00CDBDB0 3_2_00CDBDB0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BC2EA0 3_2_00BC2EA0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00DAAEF1 3_2_00DAAEF1
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BE8E20 3_2_00BE8E20
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00DACE19 3_2_00DACE19
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00D35F00 3_2_00D35F00
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010AD958 7_2_010AD958
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A19B8 7_2_010A19B8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6AB8 7_2_010A6AB8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A2D30 7_2_010A2D30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A95A8 7_2_010A95A8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A44A9 7_2_010A44A9
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A7E30 7_2_010A7E30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A291F 7_2_010A291F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A195A 7_2_010A195A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A29A8 7_2_010A29A8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A41A1 7_2_010A41A1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A41B0 7_2_010A41B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A69C7 7_2_010A69C7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010AE1F8 7_2_010AE1F8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6822 7_2_010A6822
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A684D 7_2_010A684D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6883 7_2_010A6883
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A28A4 7_2_010A28A4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A18C7 7_2_010A18C7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A08D7 7_2_010A08D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A68E0 7_2_010A68E0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A1347 7_2_010A1347
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A137D 7_2_010A137D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A139D 7_2_010A139D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A63EB 7_2_010A63EB
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A2BF9 7_2_010A2BF9
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6A5A 7_2_010A6A5A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A5A80 7_2_010A5A80
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A92AA 7_2_010A92AA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A92B0 7_2_010A92B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A2AD2 7_2_010A2AD2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A12EB 7_2_010A12EB
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A1526 7_2_010A1526
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A154F 7_2_010A154F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A157B 7_2_010A157B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010AFD88 7_2_010AFD88
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6583 7_2_010A6583
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A759A 7_2_010A759A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A25AC 7_2_010A25AC
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A65C4 7_2_010A65C4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A65FA 7_2_010A65FA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6447 7_2_010A6447
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A647D 7_2_010A647D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A1483 7_2_010A1483
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A249A 7_2_010A249A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A649D 7_2_010A649D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A24C6 7_2_010A24C6
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A14C4 7_2_010A14C4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A14FA 7_2_010A14FA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010AECF8 7_2_010AECF8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6718 7_2_010A6718
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A1722 7_2_010A1722
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A174D 7_2_010A174D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A8779 7_2_010A8779
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6772 7_2_010A6772
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A1783 7_2_010A1783
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A8780 7_2_010A8780
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A2784 7_2_010A2784
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A17E0 7_2_010A17E0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A97E0 7_2_010A97E0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A67E7 7_2_010A67E7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A1618 7_2_010A1618
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A6626 7_2_010A6626
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A664F 7_2_010A664F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A667B 7_2_010A667B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A1672 7_2_010A1672
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A3670 7_2_010A3670
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A3680 7_2_010A3680
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A16E7 7_2_010A16E7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_010A26FD 7_2_010A26FD
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02943EB0 7_2_02943EB0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029414F8 7_2_029414F8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02942870 7_2_02942870
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02945CB0 7_2_02945CB0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02943EA0 7_2_02943EA0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02945CA9 7_2_02945CA9
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029404D7 7_2_029404D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029414D2 7_2_029414D2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029422C4 7_2_029422C4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02943CF0 7_2_02943CF0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02943CE2 7_2_02943CE2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029420EC 7_2_029420EC
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029424E8 7_2_029424E8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02942612 7_2_02942612
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02942006 7_2_02942006
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02946834 7_2_02946834
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_0294223D 7_2_0294223D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02946A29 7_2_02946A29
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_0294245F 7_2_0294245F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029431B0 7_2_029431B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02941FDA 7_2_02941FDA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029431C0 7_2_029431C0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_029423E4 7_2_029423E4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02943FE8 7_2_02943FE8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 7_2_02942739 7_2_02942739
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA6AC0 10_2_02EA6AC0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA19B8 10_2_02EA19B8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EAD980 10_2_02EAD980
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA7E38 10_2_02EA7E38
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA44A9 10_2_02EA44A9
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA95B0 10_2_02EA95B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA2D30 10_2_02EA2D30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA92A8 10_2_02EA92A8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA92B8 10_2_02EA92B8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA6AB1 10_2_02EA6AB1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA5A9F 10_2_02EA5A9F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EAF220 10_2_02EAF220
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EAE220 10_2_02EAE220
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA4361 10_2_02EA4361
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA4370 10_2_02EA4370
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA08D7 10_2_02EA08D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA19A1 10_2_02EA19A1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA41A1 10_2_02EA41A1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA41B0 10_2_02EA41B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA3680 10_2_02EA3680
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA3670 10_2_02EA3670
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA7E29 10_2_02EA7E29
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EAF600 10_2_02EAF600
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA8788 10_2_02EA8788
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA8778 10_2_02EA8778
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA9468 10_2_02EA9468
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA9478 10_2_02EA9478
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EAFDC8 10_2_02EAFDC8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA8590 10_2_02EA8590
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EAED20 10_2_02EAED20
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_02EA2D20 10_2_02EA2D20
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC3FE8 10_2_07CC3FE8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC14F8 10_2_07CC14F8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6390 10_2_07CC6390
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC8098 10_2_07CC8098
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC2870 10_2_07CC2870
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC681D 10_2_07CC681D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC27EF 10_2_07CC27EF
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC27E1 10_2_07CC27E1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6FAF 10_2_07CC6FAF
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6FA6 10_2_07CC6FA6
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC666E 10_2_07CC666E
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6662 10_2_07CC6662
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC5E00 10_2_07CC5E00
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6E2D 10_2_07CC6E2D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6E36 10_2_07CC6E36
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC5DF1 10_2_07CC5DF1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC14D9 10_2_07CC14D9
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC04D7 10_2_07CC04D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC3CE3 10_2_07CC3CE3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC3CF0 10_2_07CC3CF0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC14A5 10_2_07CC14A5
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC64A7 10_2_07CC64A7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6CBB 10_2_07CC6CBB
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6CB2 10_2_07CC6CB2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC64B3 10_2_07CC64B3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6B41 10_2_07CC6B41
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6B38 10_2_07CC6B38
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC7286 10_2_07CC7286
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC727D 10_2_07CC727D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC31C0 10_2_07CC31C0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6997 10_2_07CC6997
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC69A3 10_2_07CC69A3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC31B0 10_2_07CC31B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC710C 10_2_07CC710C
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC7103 10_2_07CC7103
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC8093 10_2_07CC8093
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6826 10_2_07CC6826
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 10_2_07CC6064 10_2_07CC6064
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0C6A9706 11_2_0C6A9706
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0C6A9C05 11_2_0C6A9C05
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F119B8 11_2_00F119B8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1D980 11_2_00F1D980
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16AC0 11_2_00F16AC0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F14370 11_2_00F14370
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F19478 11_2_00F19478
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11DF7 11_2_00F11DF7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F12D30 11_2_00F12D30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16EFF 11_2_00F16EFF
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F17E38 11_2_00F17E38
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F168E8 11_2_00F168E8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F108D7 11_2_00F108D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F118C7 11_2_00F118C7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F128A4 11_2_00F128A4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1688B 11_2_00F1688B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16855 11_2_00F16855
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1682A 11_2_00F1682A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F169CF 11_2_00F169CF
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F141B0 11_2_00F141B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F141A1 11_2_00F141A1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F129A8 11_2_00F129A8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1291F 11_2_00F1291F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F112EB 11_2_00F112EB
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F12AD2 11_2_00F12AD2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16AB0 11_2_00F16AB0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F192B8 11_2_00F192B8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F192A8 11_2_00F192A8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F15A88 11_2_00F15A88
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1E220 11_2_00F1E220
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F163F3 11_2_00F163F3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F12BF9 11_2_00F12BF9
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1139D 11_2_00F1139D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1137D 11_2_00F1137D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F14361 11_2_00F14361
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11347 11_2_00F11347
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F114FA 11_2_00F114FA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F114C4 11_2_00F114C4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F124C6 11_2_00F124C6
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F164A5 11_2_00F164A5
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1249A 11_2_00F1249A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11483 11_2_00F11483
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16485 11_2_00F16485
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F13489 11_2_00F13489
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F19468 11_2_00F19468
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1644F 11_2_00F1644F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1EC18 11_2_00F1EC18
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F17DC2 11_2_00F17DC2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F165CC 11_2_00F165CC
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F195B0 11_2_00F195B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F125AC 11_2_00F125AC
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F18590 11_2_00F18590
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1658B 11_2_00F1658B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1157B 11_2_00F1157B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1154F 11_2_00F1154F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F12D20 11_2_00F12D20
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11526 11_2_00F11526
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F126FD 11_2_00F126FD
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F116E7 11_2_00F116E7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F13680 11_2_00F13680
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16683 11_2_00F16683
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11672 11_2_00F11672
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16657 11_2_00F16657
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1662E 11_2_00F1662E
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11618 11_2_00F11618
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16602 11_2_00F16602
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F117E0 11_2_00F117E0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F167EF 11_2_00F167EF
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11783 11_2_00F11783
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F12784 11_2_00F12784
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F18788 11_2_00F18788
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F18778 11_2_00F18778
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1677A 11_2_00F1677A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F1174D 11_2_00F1174D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F16720 11_2_00F16720
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_00F11722 11_2_00F11722
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01176310 11_2_01176310
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011714F8 11_2_011714F8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011776BD 11_2_011776BD
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01178938 11_2_01178938
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011799D0 11_2_011799D0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01172870 11_2_01172870
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01172E88 11_2_01172E88
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171158 11_2_01171158
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011711B2 11_2_011711B2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011731A8 11_2_011731A8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011741C8 11_2_011741C8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01172006 11_2_01172006
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171004 11_2_01171004
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0117103A 11_2_0117103A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171066 11_2_01171066
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01174090 11_2_01174090
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01174080 11_2_01174080
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0117108F 11_2_0117108F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011710BB 11_2_011710BB
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011720EC 11_2_011720EC
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171320 11_2_01171320
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01173391 11_2_01173391
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011733A0 11_2_011733A0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011723E4 11_2_011723E4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0117223D 11_2_0117223D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171227 11_2_01171227
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171262 11_2_01171262
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0117128D 11_2_0117128D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011722C4 11_2_011722C4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011712C3 11_2_011712C3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011762FF 11_2_011762FF
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171407 11_2_01171407
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01176457 11_2_01176457
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0117245F 11_2_0117245F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011704D7 11_2_011704D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_011724E8 11_2_011724E8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01172739 11_2_01172739
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01172612 11_2_01172612
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01178948 11_2_01178948
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01179AB6 11_2_01179AB6
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01179C0B 11_2_01179C0B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01175C64 11_2_01175C64
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01171FDA 11_2_01171FDA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01170FC3 11_2_01170FC3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01170E2B 11_2_01170E2B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01170E87 11_2_01170E87
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01170EBD 11_2_01170EBD
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01173ED0 11_2_01173ED0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01170EDD 11_2_01170EDD
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01173EC2 11_2_01173EC2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01175EC0 11_2_01175EC0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_01179EF0 11_2_01179EF0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0CDD7418 11_2_0CDD7418
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0CDF04C0 11_2_0CDF04C0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0CDF0040 11_2_0CDF0040
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 11_2_0CDF0007 11_2_0CDF0007
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC14F8 14_2_04CC14F8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC6018 14_2_04CC6018
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC41D3 14_2_04CC41D3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CCC190 14_2_04CCC190
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC2A58 14_2_04CC2A58
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CCBBC8 14_2_04CCBBC8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1BF8 14_2_04CC1BF8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC04D7 14_2_04CC04D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1407 14_2_04CC1407
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC108F 14_2_04CC108F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC408B 14_2_04CC408B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC4098 14_2_04CC4098
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC10BB 14_2_04CC10BB
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1066 14_2_04CC1066
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC600B 14_2_04CC600B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1004 14_2_04CC1004
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC103A 14_2_04CC103A
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC11B2 14_2_04CC11B2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1158 14_2_04CC1158
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC12C3 14_2_04CC12C3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC128D 14_2_04CC128D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1262 14_2_04CC1262
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC3276 14_2_04CC3276
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1227 14_2_04CC1227
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC33A8 14_2_04CC33A8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC33A3 14_2_04CC33A3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC1320 14_2_04CC1320
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC0EDD 14_2_04CC0EDD
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC3ED8 14_2_04CC3ED8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC3ED3 14_2_04CC3ED3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC0E87 14_2_04CC0E87
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC0EBD 14_2_04CC0EBD
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC0E2B 14_2_04CC0E2B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC0FC3 14_2_04CC0FC3
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_04CC2A56 14_2_04CC2A56
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051595B2 14_2_051595B2
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051544A9 14_2_051544A9
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05152D30 14_2_05152D30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05157E30 14_2_05157E30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515D960 14_2_0515D960
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051519B8 14_2_051519B8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156AB8 14_2_05156AB8
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156583 14_2_05156583
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051565C4 14_2_051565C4
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051565FA 14_2_051565FA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156447 14_2_05156447
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515647D 14_2_0515647D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515649D 14_2_0515649D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156718 14_2_05156718
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05158770 14_2_05158770
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156772 14_2_05156772
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05158780 14_2_05158780
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051567E7 14_2_051567E7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156626 14_2_05156626
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515664F 14_2_0515664F
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05153670 14_2_05153670
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515667B 14_2_0515667B
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05153680 14_2_05153680
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051541B0 14_2_051541B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051541A1 14_2_051541A1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051563EB 14_2_051563EB
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515E200 14_2_0515E200
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051592B0 14_2_051592B0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051592AA 14_2_051592AA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05152D01 14_2_05152D01
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515ED00 14_2_0515ED00
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05157D43 14_2_05157D43
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05157DDA 14_2_05157DDA
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05152C8E 14_2_05152C8E
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05151966 14_2_05151966
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051519A1 14_2_051519A1
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051569C7 14_2_051569C7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156822 14_2_05156822
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_0515684D 14_2_0515684D
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05156883 14_2_05156883
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051508D7 14_2_051508D7
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_051568E0 14_2_051568E0
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Code function: 14_2_05155A97 14_2_05155A97
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00CD9DE0 appears 56 times
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00D8D922 appears 38 times
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00DA9AAD appears 34 times
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00BC8190 appears 102 times
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00D9022A appears 57 times
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00BC9610 appears 241 times
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00BC8220 appears 50 times
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: String function: 00D90D20 appears 39 times
PE file does not import any functions
Source: DecryptTool.exe.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll8 vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp100.dll^ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp120.dll^ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140.dll^ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcr100_clr0400.dll^ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcr120.dll^ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOpacityGuide.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOpacityGuide.resources.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePCPrivacyShield.resources.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePdfReader.dll2 vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePerpetuum.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: get_OriginalFilename vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: ConfusedByAttributeExtensionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeDebuggableAttributeDebuggingModesAssemblyTitleAttributeAssemblyDescriptionAttributeAssemblyConfigurationAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeGuidAttributeAssemblyFileVersionAttributeTargetFrameworkAttributeSystem.Runtime.VersioningFlagsAttributeCompilerGeneratedAttributeAsyncStateMachineAttributeDebuggerHiddenAttributeNewtonsoft.JsonJsonPropertyAttributeGeneratedCodeAttributeSystem.CodeDom.CompilerDebuggerNonUserCodeAttributeEditorBrowsableAttributeEditorBrowsableStatew!\,j)0t }MO"JL\\\+n'\*ZDoR%%.resourcesStringGetTypeFromHandleGetMethodConcatInvokeEqualsFailFastset_IsBackgroundStartget_CurrentThreadSleepDebuggerget_IsAttachedIsLoggingget_IsAliveMemoryStreamget_LengthReadByteReadByteUInt32RuntimeHelpersInitializeArrayArrayRuntimeFieldHandleGetElementTypeCreateInstanceBufferBlockCopyget_UTF8GetStringInternModuleget_Moduleget_CharsMarshalGetHINSTANCEIntPtrop_Explicitget_FullyQualifiedNameMathMaxWriteEmptyInt32GetValueOrDefaultJsonConvertDeserializeObjectFormatIsNullOrWhiteSpaceEndsWithRemoveContainsReplaceCreateGetBytesset_Methodset_Timeoutset_ContentTypeset_ContentLengthGetRequestStreamGetResponseGetResponseStreamReadToEndDisposeget_MessageLoggerToStringget_TaskAwaitUnsafeOnCompletedget_IsCompletedGetResultCloseSetExceptionSetResultDelayGetAwaiterManagementExceptionGetGetEnumeratorget_Currentget_Itemget_StackTraceRegistryGetValueCurrentUserOpenSubKeyConvertToBooleanToInt64FromBinaryTryParseMinValueDateTimeKindop_Subtractionget_TicksToBinaryInt64SetValueget_NowToShortDateStringToShortTimeStringWriteLineLocalMachineget_HasValueSystem.CoreEnumerableSystem.LinqSelectToArrayget_MainWindowHandleZeroop_InequalityGetFileNameWithoutExtensionGetProcessesByNameIsNullOrEmptyop_EqualityClassesRootCharBooleanCryptoUtil.CryptoToolsEncryptStringAesAddGuidNewGuidFromMinutesop_Additionget_WidthEnumeratorReverseget_CountTupleget_Item2SysInfoget_Is64BitOSGetValueNamesUnauthorizedAccessExceptionAddRangeAddSecondsToLocalTimeIFormatProviderToUniversalTimeget_UtcNowget_ExitCodeget_Item1Subtractget_TotalSecondsget_TotalMillisecondsGetFolderPathCombineDirectoryExistsCreateDirectoryget_IsWin10TrimToLowerCopyExpandEnvironmentVariablesFileStartsWithDecryptStringAesConsoleget_Majorget_Minorget_BuildGetExecutingAssemblyGetNameget_Versionget_Reasonget_StatusAppendOpenReadReadAllTextNextBytesWriteAllTextget_QuerySystem.WebHttpUtilityParseQueryStringadd_DoWorkRunWorkerAsyncSplitset_WindowStyleget_SystemDirectoryset_FileNameset_ArgumentsWaitForExitCreateSubKeyget_CurrentCultureget_ThreeLetterWindowsLanguageNameget_Defaultget_EncodingNameget_OSVersionTypeConversionBoolToStringDeleteStringExtensionsContainsCaseInsensitiveNewTaskget_Triggersget_Settingsset_StopIfGoingOnBatteriesset_DisallowStartIfOnBatteriesget_IdleSettingsset_StopOnIdleEndget_RegistrationInfoset_Descriptionget_Actionsget_RootFolder
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSetup.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSQLite.Interop.dllF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTracking.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTreeViewFileExplorer.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUtil.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUtil.resources.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dll^ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1716368342.0000000006AAC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewininet.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCaByp.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSfxCA.dll\ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameExcelDataReader.dll@ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Deployment.WindowsInstaller.dll\ vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameResourceCleaner.dllF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePrereq.dllF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNetFirewall.dllF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameviewer.exeF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelzmaextractor.dllF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAICustAct.dllF vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileNameupdater.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWcDialog.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBouncyCastle.Crypto.dllP vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000071FD000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBsm.dllD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameArmt.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDecryptTool.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameInstAct.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePCPrivacyShield.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameschedc10.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTaskTools.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenametrialnotification.exeD vs PCPrivacyShieldSetup.exe
Source: PCPrivacyShieldSetup.exe, 00000003.00000003.1768133800.0000000003A51000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewininet.dllD vs PCPrivacyShieldSetup.exe
Uses 32bit PE files
Source: PCPrivacyShieldSetup.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Armt.exe.0.dr Static PE information: Section: nI7-I ZLIB complexity 1.0008928571428573
Source: DecryptTool.exe.0.dr Static PE information: Section: nI7-I ZLIB complexity 1.0005580357142858
Source: DecryptTool.exe0.0.dr Static PE information: Section: Hhex%(F ZLIB complexity 1.0005580357142858
Source: InstAct.exe.0.dr Static PE information: Section: Hhex%(F ZLIB complexity 1.0005387931034482
Source: PCPrivacyShield.exe.0.dr Static PE information: Section: nI7-I ZLIB complexity 1.0003095047923323
Source: schedc10.exe.0.dr Static PE information: Section: Hhex%(F ZLIB complexity 1.0009191176470589
Source: TaskTools.exe.0.dr Static PE information: Section: nI7-I ZLIB complexity 1.0004701967592593
Source: trialnotification.exe.0.dr Static PE information: Section: nI7-I ZLIB complexity 1.0007440476190477
Source: CaByp.dll.0.dr Static PE information: Section: Hhex%(F ZLIB complexity 1.0005396792763157
Source: ExcelDataReader.dll.0.dr, StandardEncryption.cs Cryptographic APIs: 'CreateDecryptor'
Source: ExcelDataReader.dll.0.dr, RC4Encryption.cs Cryptographic APIs: 'CreateDecryptor'
Source: ExcelDataReader.dll.0.dr, CryptoHelpers.cs Cryptographic APIs: 'CreateDecryptor'
Source: ExcelDataReader.dll.0.dr, XlsBiffStream.cs Cryptographic APIs: 'CreateDecryptor'
Source: ICSharpCode.SharpZipLib.dll.0.dr, InflaterInputBuffer.cs Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, DeflaterOutputStream.cs Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, ZipAESTransform.cs Cryptographic APIs: 'TransformBlock'
Source: classification engine Classification label: sus34.spyw.evad.winEXE@63/306@16/10
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDFDA0 FormatMessageW,GetLastError, 0_2_00CDFDA0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BD7310 CoCreateInstance,CharNextW,CharNextW,CharNextW,CLSIDFromString,CharNextW,CoCreateInstance,CoCreateInstance, 0_2_00BD7310
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BCA000 LoadResource,LockResource,SizeofResource, 0_2_00BCA000
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Mutant created: NULL
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Mutant created: \Sessions\1\BaseNamedObjects\PCPrivacyShield
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\shiBC20.tmp Jump to behavior
Source: PCPrivacyShieldSetup.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe System information queried: HandleInformation
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003046000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.0000000002839000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000293C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: select COUNT(*) from moz_places WHERE url LIKE 'http%' AND moz_places.id NOT IN (SELECT moz_bookmarks.fk FROM moz_bookmarks WHERE moz_bookmarks.fk IS NOT NULL);
Source: InstAct.exe, 00000007.00000002.1843409932.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000A.00000002.1860099028.0000000003046000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1898806369.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1943989651.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 0000000F.00000002.2010871467.000000000261C000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1938221449.0000000002839000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000012.00000002.1944193693.000000000293C000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000003DD9000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SELECT id, url, title, visit_count, datetime(last_visit_time/1000000-11644473600,'unixepoch','localtime') AS last_visit FROM urls WHERE url LIKE 'http%' ORDER BY last_visit ASC;
Source: PCPrivacyShield.exe, 00000013.00000002.4194644871.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, PCPrivacyShield.exe, 00000015.00000002.2039193870.00000000030A2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: create table tracking (name varchar(30), counter int, date datetime);
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000017.00000002.4208239417.00001D60025F1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index */ path TEXT, /* Path to page from root */ pageno INTEGER, /* Page number */ pagetype TEXT, /* 'internal', 'leaf' or 'overflow' */ ncell INTEGER, /* Cells on page (0 for overflow) */ payload INTEGER, /* Bytes of payload on this page */ unused INTEGER, /* Bytes of unused space on this page */ mx_payload INTEGER, /* Largest payload size of all cells */ pgoffset INTEGER, /* Offset of page in file */ pgsize INTEGER, /* Size of the page */ schema TEXT HIDDEN /* Database schema being analyzed */);
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File read: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6D9D21CE130F74F78C1DEE127FBFAB9C C
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process created: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe" /i "C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PCPrivacyShield.msi" /L*v "C:\Users\user\AppData\Roaming\\PC Privacy Shield\PC Privacy Shield 4.9.8\install\installlog.txt" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\PC Privacy Shield" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Privacy Shield" SECONDSEQUENCE="1" CLIENTPROCESSID="7256" AI_MORE_CMD_LINE=1
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F339063B2D7F5AA49C6D3BCEA32A4992
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1C300E307AD5246F63AB5C1721DD9590 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" xtend
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" removeOld
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" createini
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" install
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" installurl "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe"
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" skipuac
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" popuptask
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe" startscan "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe"
Source: unknown Process created: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe "C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe" run_program
Source: unknown Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe" popup
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,16932873091567761477,1262112429000342913,262144 /prefetch:8
Source: unknown Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe" minimized
Source: unknown Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe" minimized
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process created: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe" /i "C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PCPrivacyShield.msi" /L*v "C:\Users\user\AppData\Roaming\\PC Privacy Shield\PC Privacy Shield 4.9.8\install\installlog.txt" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\PC Privacy Shield" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Privacy Shield" SECONDSEQUENCE="1" CLIENTPROCESSID="7256" AI_MORE_CMD_LINE=1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6D9D21CE130F74F78C1DEE127FBFAB9C C Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F339063B2D7F5AA49C6D3BCEA32A4992 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1C300E307AD5246F63AB5C1721DD9590 E Global\MSI0000 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" xtend Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" removeOld Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" createini Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" install Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" installurl "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe" Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" skipuac Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" popuptask Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe" startscan "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe" Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,16932873091567761477,1262112429000342913,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: lpk.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: lpk.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: comsvcs.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: version.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: version.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasman.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rtutils.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: winnsi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: schannel.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: version.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasman.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rtutils.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: winnsi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: schannel.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: version.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasman.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rtutils.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: winnsi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: schannel.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: amsi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: edputil.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: appresolver.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: slc.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sppc.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: version.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: taskschd.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sxs.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: xmllite.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: version.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: taskschd.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: sxs.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: xmllite.dll
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: version.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: rasman.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: rtutils.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe File written: C:\Program Files (x86)\PC Privacy Shield\updater.ini
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: PCPrivacyShieldSetup.exe Static PE information: certificate valid
Source: PCPrivacyShieldSetup.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: PCPrivacyShieldSetup.exe Static file information: File size 14903080 > 1048576
Source: C:\Windows\System32\msiexec.exe File opened: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcr100.dll Jump to behavior
Source: PCPrivacyShieldSetup.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x256600
Source: PCPrivacyShieldSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PCPrivacyShieldSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PCPrivacyShieldSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PCPrivacyShieldSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PCPrivacyShieldSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PCPrivacyShieldSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: PCPrivacyShieldSetup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: PCPrivacyShieldSetup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wininet.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1716368342.0000000006AAC000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1768133800.0000000003A51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\NetFirewall.pdb: source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dropbox\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net40\Newtonsoft.Json.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 0000000B.00000002.1902083448.000000000C6A2000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\3\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\ChromeDownloads\ExcelDataReader-develop\ExcelDataReader-develop\src\ExcelDataReader\obj\Debug\net45\ExcelDataReader.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbl source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\NetFirewall.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: PCPrivacyShieldSetup.exe, PCPrivacyShieldSetup.exe, 00000000.00000000.1679879072.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000000.00000002.1966657651.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000002.1930059215.0000000000E18000.00000002.00000001.01000000.00000003.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000000.1762525754.0000000000E18000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: d:\agent\_work\3\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.000000000778B000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Branch\win\Release\stubs\x86\Updater.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.0000000006AA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcp100.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcr100.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb| source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\ChromeDownloads\ExcelDataReader-develop\ExcelDataReader-develop\src\ExcelDataReader\obj\Debug\net45\ExcelDataReader.pdbSHA256 source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074AC000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: msvcr120.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1939151292.0000000005E22000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: msvcp120.i386.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet\bin\2010\Win32\ReleaseStatic\System.Data.SQLite.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\ResourceCleaner.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.00000000044B5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\agent\_work\66\s\build\ship\x86\SfxCA.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000074A3000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wininet.pdbUGP source: PCPrivacyShieldSetup.exe, 00000000.00000003.1716368342.0000000006AAC000.00000004.00000020.00020000.00000000.sdmp, PCPrivacyShieldSetup.exe, 00000003.00000003.1768133800.0000000003A51000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdbp source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, 00000011.00000002.1939151292.0000000005E22000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dropbox\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net40\Newtonsoft.Json.pdb source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, InstAct.exe, 0000000B.00000002.1902083448.000000000C6A2000.00000002.00000001.01000000.00000010.sdmp
Source: PCPrivacyShieldSetup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PCPrivacyShieldSetup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PCPrivacyShieldSetup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PCPrivacyShieldSetup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PCPrivacyShieldSetup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Binary contains a suspicious time stamp
Source: Armt.exe.0.dr Static PE information: 0xA13B36D7 [Mon Sep 20 00:20:39 2055 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDFF30 LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_00CDFF30
PE file contains sections with non-standard names
Source: Armt.exe.0.dr Static PE information: section name: nI7-I
Source: Armt.exe.0.dr Static PE information: section name:
Source: DecryptTool.exe.0.dr Static PE information: section name: nI7-I
Source: DecryptTool.exe0.0.dr Static PE information: section name: Hhex%(F
Source: DecryptTool.exe0.0.dr Static PE information: section name:
Source: InstAct.exe.0.dr Static PE information: section name: Hhex%(F
Source: InstAct.exe.0.dr Static PE information: section name:
Source: PCPrivacyShield.exe.0.dr Static PE information: section name: nI7-I
Source: PCPrivacyShield.exe.0.dr Static PE information: section name:
Source: schedc10.exe.0.dr Static PE information: section name: Hhex%(F
Source: schedc10.exe.0.dr Static PE information: section name:
Source: TaskTools.exe.0.dr Static PE information: section name: nI7-I
Source: TaskTools.exe.0.dr Static PE information: section name:
Source: trialnotification.exe.0.dr Static PE information: section name: nI7-I
Source: trialnotification.exe.0.dr Static PE information: section name:
Source: CaByp.dll.0.dr Static PE information: section name: Hhex%(F
Source: CaByp.dll.0.dr Static PE information: section name:
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D073B push ds; ret 0_3_013D077E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D077F push ds; ret 0_3_013D078E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CAB55 push es; retf 0_3_013CACB6
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CAB55 push es; retf 0_3_013CACB6
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D07AD push ds; ret 0_3_013D07AE
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CEBD4 push es; retf 0_3_013CECBE
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D03C0 push cs; ret 0_3_013D03C6
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747D push es; retf 0_3_013C747E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747D push es; retf 0_3_013C747E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747F push es; iretd 0_3_013C748A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747F push es; iretd 0_3_013C748A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CB865 push eax; retf 0_3_013CB8D8
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CB865 push eax; retf 0_3_013CB8D8
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CEE63 push es; ret 0_3_013CEE66
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CAE5B push es; ret 0_3_013CAE5E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CAE5B push es; ret 0_3_013CAE5E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C7049 push es; ret 0_3_013C746A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C7049 push es; ret 0_3_013C746A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D073B push ds; ret 0_3_013D077E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D077F push ds; ret 0_3_013D078E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CAB55 push es; retf 0_3_013CACB6
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CAB55 push es; retf 0_3_013CACB6
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D07AD push ds; ret 0_3_013D07AE
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CEBD4 push es; retf 0_3_013CECBE
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013D03C0 push cs; ret 0_3_013D03C6
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747D push es; retf 0_3_013C747E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747D push es; retf 0_3_013C747E
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747F push es; iretd 0_3_013C748A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013C747F push es; iretd 0_3_013C748A
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CB865 push eax; retf 0_3_013CB8D8
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_3_013CB865 push eax; retf 0_3_013CB8D8
Source: Armt.exe.0.dr Static PE information: section name: nI7-I entropy: 7.988204850540779
Source: DecryptTool.exe.0.dr Static PE information: section name: nI7-I entropy: 7.9939755024410335
Source: DecryptTool.exe0.0.dr Static PE information: section name: Hhex%(F entropy: 7.993237953131477
Source: InstAct.exe.0.dr Static PE information: section name: Hhex%(F entropy: 7.993883626985112
Source: PCPrivacyShield.exe.0.dr Static PE information: section name: nI7-I entropy: 7.999877745648744
Source: schedc10.exe.0.dr Static PE information: section name: Hhex%(F entropy: 7.9891252827782
Source: TaskTools.exe.0.dr Static PE information: section name: nI7-I entropy: 7.996684801742378
Source: trialnotification.exe.0.dr Static PE information: section name: nI7-I entropy: 7.9906247052342305
Source: CaByp.dll.0.dr Static PE information: section name: Hhex%(F entropy: 7.994887791375117
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\CaByp.CA.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID2E4.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\TaskTools.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\msvcp120.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI703.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\de\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\de\Util.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\TreeViewFileExplorer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBE18.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\OpacityGuide.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Perpetuum.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Microsoft.Deployment.WindowsInstaller.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID84B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID4AF.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\BouncyCastle.Crypto.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID3D1.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ExcelDataReader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBD3B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Bsm.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID441.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDB5C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\ja\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID411.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\es\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID362.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\BouncyCastle.Crypto.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE485.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Bsm.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\WcDialog.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Armt.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBCBD.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\fr\Util.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Perpetuum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\schedc10.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\msvcp100.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\System.Data.SQLite.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBDF8.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBE48.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\es\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\es\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\shiD063.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x64\DecryptTool.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ICSharpCode.SharpZipLib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID966.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\NetFirewall.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Microsoft.Win32.TaskScheduler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6B4.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\lzmaextractor.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Armt.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\es\Util.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\msvcr120.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Setup.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\x86\DecryptTool.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\ja\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcr120.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\CaByp.CA.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\es\Util.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcp120.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Setup.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Deployment.WindowsInstaller.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBF24.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\fr\Util.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIF9C.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\fr\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\es\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\trialnotification.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\OpacityGuide.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID3A1.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\de\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Util.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Tracking.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\TreeViewFileExplorer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcp100.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\trialnotification.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PCPrivacyShield.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBE68.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcr100.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\x64\DecryptTool.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x86\DecryptTool.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDAFD.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\PdfReader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBFA3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\CaByp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\viewer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\WcDialog.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\fr\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ja\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\de\Util.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\schedc10.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\CaByp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\System.Data.SQLite.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Util.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ja\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\de\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIC1E8.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBFF3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\msvcr100.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIBF54.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\shiBC20.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\fr\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\ExcelDataReader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\fr\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Local\Temp\MSIF6C.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\InstAct.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\de\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\ICSharpCode.SharpZipLib.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PdfReader.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID86B.tmp Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID84B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID2E4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID362.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID3A1.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID4AF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI703.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE485.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID3D1.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID966.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6B4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID441.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDB5C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID411.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIDAFD.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSID86B.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\installlog.txt Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe File created: C:\Program Files (x86)\PC Privacy Shield\README.txt

Boot Survival
barindex
Installs Task Scheduler Managed Wrapper
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File created: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Microsoft.Win32.TaskScheduler.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Privacy Shield Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Privacy Shield\PC Privacy Shield.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Privacy Shield\Uninstall PC Privacy Shield.lnk Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCPrivacyShield
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCPrivacyShield
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process information set: NOOPENFILEERRORBOX
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 10A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2B10000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 28B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 50C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 60C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 61F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 71F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7AE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8AE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 50C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 61F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 9D60000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 1650000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 3010000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5010000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5640000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6640000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6770000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7770000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 80A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 90A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: A0A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: B0A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: B830000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: C830000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: D830000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: EBF0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5640000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: F10000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2A40000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 10E0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5070000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6070000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 61A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 71A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7A40000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8A40000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5070000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 61A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8A40000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 9F80000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: B080000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: B510000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2AC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2C30000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4C30000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 52D0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 62D0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6400000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7400000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7D60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8D60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 52D0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8D60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 9EA0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6900000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7D60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: AEA0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: B20000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2600000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4600000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4C60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5C60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5D90000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6D90000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 76A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 86A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4C60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5D90000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 98E0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8AA0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 76A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: A8E0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 25D0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2810000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2620000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4D90000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5D90000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5EC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6EC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7810000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8810000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4D90000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5EC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 9950000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8D10000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7810000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: A950000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2650000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2910000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 2650000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4F00000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 5F00000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6030000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 7030000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 78C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 88C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 4F00000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 6030000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 9B40000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 8CC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: 78C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 1220000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 2F60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 2DA0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5490000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6490000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 65C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 75C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 86F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 96F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5490000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 65C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 89F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: A8D0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 99F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: BF50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: CF50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: DF50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 10A10000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5490000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 89F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Memory allocated: 2D70000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Memory allocated: 1AFA0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 14B0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 3040000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 14B0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5550000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6550000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6680000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 7680000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 8770000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 9770000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: A770000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: B770000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: BDE0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: CDE0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: DDE0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: F120000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5550000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 1800000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 34E0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 3140000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5B20000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6B20000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6C50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 7C50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 8BE0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 9BE0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5B20000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6C50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6C50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 8E60000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 10F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 2E80000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 2BA0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 55C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 65C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 66F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 76F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 8740000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 9740000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 55C0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 66F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: A820000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 9AC0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 8740000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: B820000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 1930000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 36A0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 35B0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5CF0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6CF0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6E20000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 7E20000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 8F10000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 9F10000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 5CF0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 6E20000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: 9210000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: B0F0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Memory allocated: A210000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599875
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599760
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599594
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599317
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599188
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598969
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598848
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598719
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598594
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598485
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598372
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598250
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598138
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598016
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 597842
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 597734
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 597625
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599780
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599624
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599482
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599346
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599220
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599092
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598948
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598779
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598659
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598521
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598393
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598268
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598144
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598025
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597908
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597678
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597553
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597423
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597300
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597174
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597059
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596940
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596815
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596690
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596565
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596440
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596325
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596206
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596081
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595955
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595830
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595705
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595580
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595455
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595330
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595215
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595085
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594881
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594752
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594627
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594502
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594376
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Window / User API: threadDelayed 2337
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Window / User API: threadDelayed 1323
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Window / User API: threadDelayed 5409
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Window / User API: threadDelayed 3735
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\CaByp.CA.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID2E4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\msvcp120.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI703.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\de\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\de\Util.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\TreeViewFileExplorer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBE18.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\OpacityGuide.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Perpetuum.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Microsoft.Deployment.WindowsInstaller.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID84B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID4AF.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\BouncyCastle.Crypto.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID3D1.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ExcelDataReader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Bsm.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBD3B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID441.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIDB5C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\ja\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID411.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\es\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID362.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\BouncyCastle.Crypto.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE485.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Bsm.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\WcDialog.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Armt.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBCBD.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\fr\Util.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\schedc10.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Perpetuum.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\msvcp100.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\System.Data.SQLite.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBE48.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBDF8.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\es\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\es\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiD063.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Newtonsoft.Json.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x64\DecryptTool.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ICSharpCode.SharpZipLib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID966.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\NetFirewall.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Microsoft.Win32.TaskScheduler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI6B4.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\lzmaextractor.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Armt.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\es\Util.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\msvcr120.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Setup.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\x86\DecryptTool.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\ja\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcr120.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\es\Util.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\CaByp.CA.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcp120.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Setup.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Deployment.WindowsInstaller.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBF24.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\fr\Util.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIF9C.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\fr\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\es\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\trialnotification.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID3A1.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\OpacityGuide.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\de\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\Util.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Tracking.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\TreeViewFileExplorer.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcp100.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\trialnotification.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBE68.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcr100.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\x64\DecryptTool.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\x86\DecryptTool.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIDAFD.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\PdfReader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBFA3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\CaByp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\viewer.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\WcDialog.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\fr\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ja\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\de\Util.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\schedc10.exe Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\CaByp.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\System.Data.SQLite.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\Util.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\de\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\ja\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBFF3.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC1E8.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\msvcr100.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBF54.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\fr\PCPrivacyShield.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiBC20.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\ExcelDataReader.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\fr\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIF6C.tmp Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\de\OpacityGuide.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\PC Privacy Shield\ICSharpCode.SharpZipLib.dll Jump to dropped file
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PdfReader.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSID86B.tmp Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe API coverage: 7.4 %
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe API coverage: 8.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 7980 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 8176 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1436 Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 3752 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 7620 Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 6184 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 7500 Thread sleep count: 2337 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -599875s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 7500 Thread sleep count: 1323 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -599760s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -599594s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -599317s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -599188s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598969s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598848s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598719s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598594s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598485s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598372s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598250s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598138s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -598016s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -597842s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -597734s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 1440 Thread sleep time: -597625s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 5408 Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 7552 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 8152 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe TID: 2284 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 6928 Thread sleep time: -33000s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 7488 Thread sleep time: -34000s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -599780s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -599624s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -599482s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -599346s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -599220s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -599092s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598948s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598779s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598659s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598521s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598393s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598268s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598144s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -598025s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -597908s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -597678s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -597553s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -597423s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -597300s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -597174s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -597059s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596940s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596815s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596690s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596565s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596440s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596325s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596206s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -596081s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595955s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595830s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595705s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595580s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595455s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595330s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595215s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -595085s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -594881s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -594752s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -594627s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -594502s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8480 Thread sleep time: -594376s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe TID: 7616 Thread sleep count: 258 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe TID: 6616 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 7848 Thread sleep count: 273 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 7848 Thread sleep count: 227 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 7292 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 6536 Thread sleep count: 201 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 6584 Thread sleep count: 99 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 1720 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8828 Thread sleep count: 179 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8764 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 8180 Thread sleep count: 289 > 30
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe TID: 6548 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D027F0 ReadFile,FindFirstFileW,FindClose,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, 0_2_00D027F0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDC9A0 FindFirstFileW,GetLastError,FindClose, 0_2_00CDC9A0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDC040 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr, 0_2_00CDC040
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BE11B0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW, 0_2_00BE11B0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CC1130 GetShortPathNameW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00CC1130
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDE270 FindFirstFileW,FindClose, 0_2_00CDE270
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDC3D0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW, 0_2_00CDC3D0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D208C0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose, 0_2_00D208C0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00CDBDB0 _wcsrchr,_wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,SetFileAttributesW,FindNextFileW, 3_2_00CDBDB0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D76840 GetCurrentProcess,GetProcessAffinityMask,GetSystemInfo,GetModuleHandleA,GetProcAddress,GlobalMemoryStatusEx,GlobalMemoryStatus, 0_2_00D76840
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599875
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599760
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599594
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599317
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 599188
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598969
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598848
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598719
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598594
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598485
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598372
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598250
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598138
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 598016
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 597842
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 597734
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 597625
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599780
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599624
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599482
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599346
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599220
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 599092
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598948
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598779
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598659
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598521
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598393
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598268
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598144
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 598025
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597908
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597678
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597553
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597423
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597300
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597174
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 597059
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596940
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596815
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596690
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596565
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596440
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596325
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596206
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 596081
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595955
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595830
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595705
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595580
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595455
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595330
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595215
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 595085
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594881
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594752
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594627
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594502
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 594376
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Thread delayed: delay time: 922337203685477
Source: InstAct.exe, 0000000F.00000002.1982764222.000000000076A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
Source: PCPrivacyShield.exe, 00000015.00000002.2039193870.0000000003055000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: chrome.exe, 00000017.00000002.4221861331.00001D6003E04000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ~]lx{tn~lzyqeMu{_tvwpd
Source: chrome.exe, 00000017.00000002.4212338065.00001D6002C74000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=451a1c23-008d-4f3b-a011-618091986f8d
Source: TaskTools.exe, 00000014.00000002.1994705612.00000000012DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`$%
Source: PCPrivacyShield.exe, 00000013.00000002.4183416576.0000000000FD6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk
Source: TaskTools.exe, 00000014.00000002.1994705612.00000000012DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l.dll
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1710251405.0000000004290000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: InstAct.exe, 0000000B.00000002.1897935406.0000000000D42000.00000004.00000020.00020000.00000000.sdmp, InstAct.exe, 0000000E.00000002.1942206234.0000000001026000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.4194067287.0000026298637000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D950F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00D950F3
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDFF30 LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_00CDFF30
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00DAA0DB mov eax, dword ptr fs:[00000030h] 0_2_00DAA0DB
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00DAA11F mov eax, dword ptr fs:[00000030h] 0_2_00DAA11F
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D9B5D7 mov ecx, dword ptr fs:[00000030h] 0_2_00D9B5D7
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D8F9A7 mov esi, dword ptr fs:[00000030h] 0_2_00D8F9A7
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00DAA0DB mov eax, dword ptr fs:[00000030h] 3_2_00DAA0DB
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00DAA11F mov eax, dword ptr fs:[00000030h] 3_2_00DAA11F
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00D9B5D7 mov ecx, dword ptr fs:[00000030h] 3_2_00D9B5D7
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00D8F9A7 mov esi, dword ptr fs:[00000030h] 3_2_00D8F9A7
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D8FA13 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree, 0_2_00D8FA13
Enables debug privileges
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Process token adjusted: Debug
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Windows\System32\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe "C:\Program Files (x86)\PC Privacy Shield\InstAct.exe" install Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BFB0B0 __set_se_translator,SetUnhandledExceptionFilter, 0_2_00BFB0B0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D950F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00D950F3
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D90536 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00D90536
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BFDA20 __set_se_translator,SetUnhandledExceptionFilter, 0_2_00BFDA20
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BFB0B0 __set_se_translator,SetUnhandledExceptionFilter, 3_2_00BFB0B0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00D950F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_00D950F3
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00D90536 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_00D90536
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 3_2_00BFDA20 __set_se_translator,SetUnhandledExceptionFilter, 3_2_00BFDA20
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: Bsm.dll.0.dr, Basem.cs Reference to suspicious API methods: Kernel32.OpenProcess(ProcessAccessFlags.DuplicateHandle, bInheritHandle: true, (uint)targetPid)
Source: Microsoft.Deployment.WindowsInstaller.dll.0.dr, Installer.cs Reference to suspicious API methods: NativeMethods.LoadLibraryEx(modulePath, IntPtr.Zero, 2u)
Source: Microsoft.Deployment.WindowsInstaller.dll.0.dr, Installer.cs Reference to suspicious API methods: NativeMethods.FindResourceEx(intPtr, new IntPtr(10), new IntPtr(errorNumber), (ushort)num)
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CC4260 CreateFileW,CloseHandle,WriteFile,CloseHandle,ShellExecuteExW, 0_2_00CC4260
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process created: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe" /i "C:\Users\user\AppData\Roaming\PC Privacy Shield\PC Privacy Shield 4.9.8\install\12F779E\PCPrivacyShield.msi" /L*v "C:\Users\user\AppData\Roaming\\PC Privacy Shield\PC Privacy Shield 4.9.8\install\installlog.txt" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\PC Privacy Shield" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Privacy Shield" SECONDSEQUENCE="1" CLIENTPROCESSID="7256" AI_MORE_CMD_LINE=1 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe" startscan "C:\Users\user\Desktop\PCPrivacyShieldSetup.exe" Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://shieldapps.com/post-install/pc-privacy-shield-successful-installation/?lnT=PostInstall&ipA=173.254.250.78&mcA=2E65165C89BF&osN=Microsoft+Windows+10+Pro&osV=10.0.19045.0&lng=en&bdV=4.9.8&scR=&lcA=&lcE=
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Process created: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe "C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process created: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe "c:\users\user\desktop\pcprivacyshieldsetup.exe" /i "c:\users\user\appdata\roaming\pc privacy shield\pc privacy shield 4.9.8\install\12f779e\pcprivacyshield.msi" /l*v "c:\users\user\appdata\roaming\\pc privacy shield\pc privacy shield 4.9.8\install\installlog.txt" ai_euimsi=1 appdir="c:\program files (x86)\pc privacy shield" shortcutdir="c:\programdata\microsoft\windows\start menu\programs\pc privacy shield" secondsequence="1" clientprocessid="7256" ai_more_cmd_line=1
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Process created: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe "c:\users\user\desktop\pcprivacyshieldsetup.exe" /i "c:\users\user\appdata\roaming\pc privacy shield\pc privacy shield 4.9.8\install\12f779e\pcprivacyshield.msi" /l*v "c:\users\user\appdata\roaming\\pc privacy shield\pc privacy shield 4.9.8\install\installlog.txt" ai_euimsi=1 appdir="c:\program files (x86)\pc privacy shield" shortcutdir="c:\programdata\microsoft\windows\start menu\programs\pc privacy shield" secondsequence="1" clientprocessid="7256" ai_more_cmd_line=1 Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00CDE790 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle, 0_2_00CDE790
Source: PCPrivacyShieldSetup.exe, 00000000.00000003.1706802309.00000000077B9000.00000004.00001000.00020000.00000000.sdmp, InstAct.exe, InstAct.exe, 00000007.00000002.1843409932.0000000002B38000.00000004.00000800.00020000.00000000.sdmp, InstAct.exe, 00000007.00000002.1845762757.0000000007D9A000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: Shell_TrayWnd
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\installer_1.jpg VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\installer_1.jpg VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7256\installer_2.jpg VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\InstAct.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Perpetuum.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Tracking.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\OpacityGuide.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\System.Data.SQLite.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\System.Data.SQLite.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\System.Data.SQLite.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Bsm.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\TaskTools.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Perpetuum.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Perpetuum.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Perpetuum.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Setup.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Util.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Perpetuum.dll VolumeInformation
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe Queries volume information: C:\Program Files (x86)\PC Privacy Shield\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00D0F8F0 InitializeCriticalSection,EnterCriticalSection,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,LeaveCriticalSection,GetLocalTime, 0_2_00D0F8F0
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Code function: 0_2_00BC7480 GetVersionExW,GetVersionExW,GetVersionExW,IsProcessorFeaturePresent, 0_2_00BC7480
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Adds / modifies Windows certificates
Source: C:\Users\user\Desktop\PCPrivacyShieldSetup.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Program Files (x86)\PC Privacy Shield\PCPrivacyShield.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545595 Sample: PCPrivacyShieldSetup.exe Startdate: 30/10/2024 Architecture: WINDOWS Score: 34 60 pps.shieldappsverify.com 2->60 76 Multi AV Scanner detection for dropped file 2->76 78 .NET source code references suspicious native API functions 2->78 80 PE file contains section with special chars 2->80 82 PE file has nameless sections 2->82 9 PCPrivacyShieldSetup.exe 123 2->9         started        13 msiexec.exe 155 118 2->13         started        15 TaskTools.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 file5 44 C:\Users\user\AppData\...\DecryptTool.exe, PE32 9->44 dropped 46 C:\Users\user\AppData\...\DecryptTool.exe, PE32+ 9->46 dropped 48 C:\Users\user\AppData\Roaming\...\updater.exe, PE32 9->48 dropped 56 58 other files (50 malicious) 9->56 dropped 84 Installs Task Scheduler Managed Wrapper 9->84 19 PCPrivacyShieldSetup.exe 6 9->19         started        50 C:\Windows\Installer\MSIE485.tmp, PE32 13->50 dropped 52 C:\Windows\Installer\MSIDB5C.tmp, PE32 13->52 dropped 54 C:\Windows\Installer\MSIDAFD.tmp, PE32 13->54 dropped 58 57 other files (40 malicious) 13->58 dropped 22 msiexec.exe 1 13->22         started        24 InstAct.exe 13->24         started        26 InstAct.exe 13->26         started        31 7 other processes 13->31 29 PCPrivacyShield.exe 15->29         started        signatures6 process7 dnsIp8 42 C:\Users\user\AppData\Local\...\shiD063.tmp, PE32+ 19->42 dropped 33 PCPrivacyShield.exe 22->33         started        36 chrome.exe 24->36         started        72 pps.shieldappsverify.com 149.210.194.253, 443, 49738, 49740 TRANSIP-ASAmsterdamtheNetherlandsNL Netherlands 26->72 file9 process10 dnsIp11 74 Tries to harvest and steal browser information (history, passwords, etc) 33->74 62 192.168.2.4, 138, 443, 49240 unknown unknown 36->62 64 239.255.255.250 unknown Reserved 36->64 39 chrome.exe 36->39         started        signatures12 process13 dnsIp14 66 shieldapps.com 50.87.253.110, 443, 49750, 49751 UNIFIEDLAYER-AS-1US United States 39->66 68 142.250.185.100, 443, 49771 GOOGLEUS United States 39->68 70 5 other IPs or domains 39->70
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
74.125.133.154
 stats.g.doubleclick.net United States
15169 GOOGLEUS false
142.250.186.162
 td.doubleclick.net United States
15169 GOOGLEUS false
149.210.194.253
 pps.shieldappsverify.com Netherlands
20857 TRANSIP-ASAmsterdamtheNetherlandsNL false
142.250.185.100
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
50.87.253.110
 shieldapps.com United States
46606 UNIFIEDLAYER-AS-1US false
142.250.186.164
 www.google.com United States
15169 GOOGLEUS false
142.250.186.110
 analytics.google.com United States
15169 GOOGLEUS false
151.101.194.137
 code.jquery.com United States
54113 FASTLYUS false

Private

IP
192.168.2.4

Contacted Domains

Name IP Active
pps.shieldappsverify.com 149.210.194.253 true
code.jquery.com 151.101.194.137 true
www.google.com 142.250.186.164 true
analytics.google.com 142.250.186.110 true
td.doubleclick.net 142.250.186.162 true
shieldapps.com 50.87.253.110 true
stats.g.doubleclick.net 74.125.133.154 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://shieldapps.com/wp-content/themes/shield-apps2/js/skip-link-focus-fix.js?ver=20151215 false
    		unknown
    https://shieldapps.com/wp-content/themes/shield-apps2/css/slick.css?ver=6.6.2 false
      		unknown
      https://shieldapps.com/wp-content/uploads/2015/06/box-identity-theft-preventer1.png false
        		unknown
        https://shieldapps.com/wp-content/themes/shield-apps2/images/shield-apps-logo.png false
          		unknown
          https://shieldapps.com/wp-content/uploads/2016/03/box-ransomware-defender1.png false
            		unknown
            https://shieldapps.com/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2 false
              		unknown
              https://shieldapps.com/wp-content/uploads/2020/03/box-vpn1.png false
                		unknown
                https://shieldapps.com/wp-content/uploads/complianz/css/banner-1-optout.css?v=30 false
                  		unknown
                  https://shieldapps.com/wp-content/plugins/complianz-gdpr-premium/cookiebanner/js/complianz.min.js?ver=1720730544 false
                    		unknown
                    https://shieldapps.com/wp-content/themes/shield-apps2/images/about-bkg.jpg false
                      		unknown