24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 0632c5da568e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0632c5da568e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 12 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176d","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176d"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7b4,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223736" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223744" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223772" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223984" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223800" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223956" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223968" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "5568912" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223852" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223948" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "5568908" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223816" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "FindResourceA" with parameter "18223824" - (UID: 00000000-00004884)26:Tc4b,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270336'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270192'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270352'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270240'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270208'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270256'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270304'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270176'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270288'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270320'}" (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18270272'}" (UID: 00000000-00004884) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073728'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073584'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073744'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073632'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073600'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073648'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073696'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073568'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073680'}" (UID: 00000000-00002512) "OS1Nk65.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18073712'}" (UID: 00000000-00002512)27:T611,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004884) "OS1Nk65.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002512) "OS1Nk65.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00002512) "OS1Nk65.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00002512) "Po8zD98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006556) "Po8zD98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006556) "Po8zD98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00006556) "Po8zD98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00006556) "Tw8HY11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007420) "Tw8HY11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007420) "Tw8HY11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007420) "Tw8HY11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007420) "Tw8HY11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00007420) "5pS9Jb7.exe" called "RemoveDirectoryW" with parameter %TEMP%\50B2.tmp\50C3.tmp\ (UID: 00000000-00003740) "5pS9Jb7.exe" called "RemoveDirectoryW" with parameter %TEMP%\50B2.tmp (UID: 00000000-00003740)28:T131a,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-25-01162F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-25-01162F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-63-01162CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-63-01162CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-57-011653A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-57-011653A1 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004884-28604-28-01163BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004884-28604-28-01163BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-54-011655A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-54-011655A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-66-011636EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-66-011636EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-64-011618A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-64-011618A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-44-01164EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-44-01164EFD Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004884-28604-23-01162390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004884-28604-23-01162390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-52-0116597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-52-0116597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-51-0116621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-51-0116621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-33-01166495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-33-01166495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-14-0116681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-14-0116681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-55-01165467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-55-01165467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-49-01166298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-49-01166298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-8-011644B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-8-011644B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-34-0116202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004884-28604-34-0116202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-34-0116202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-32-01162267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-32-01162267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-21-011652B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-21-011652B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-58-01162630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-58-01162630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-65-011617EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-65-011617EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-69-01162773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-69-01162773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-36-01162AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-36-01162AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-29-01163FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-29-01163FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004884-28604-5-01161F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004884-28604-5-01161F9029:T96e,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=keqp0GBB7Nq7mDrBYZ0RContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache"2a:T4a5,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)2b:T1b98,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004884) "OS1Nk65.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512) "OS1Nk65.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512) "Po8zD98.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006556) "Po8zD98.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006556) "Tw8HY11.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007420) "Tw8HY11.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007420) "1IP71jL3.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000009dbe459723258e72481e5700e1ab9de50cec570030548e72995482e5feffffff1cec5700002a8d7200007b72feffffff5835730200007b72000000000000000000000000b0eb5700 (UID: 00000000-00007500) "1IP71jL3.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007500) "1IP71jL3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007500)2c:T7b4,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OS1Nk65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "OS1Nk65.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Po8zD98.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Po8zD98.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Tw8HY11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Tw8HY11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1IP71jL3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2ya8791.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2ya8791.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Ie42Oj.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Ie42Oj.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4rs071Wv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4rs071Wv.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2d:T11d55,Observed string: ""WalletECNewCtaDescriptionCashback": "ativar o programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupes automaticamente", "WalletECNewCtaDescriptionFillAddress": "preencha automaticamente as suas informaes de envio", "WalletECNewCtaDescriptionFillDetail": "preencha as suas informaes de envio e fatura "WalletECNewCtaDescriptionFillPayment": "preencher as suas informaes de fatura "WalletECNewCtaDescriptionGiftCard": "utilizar o carto de oferta", "WalletECNewCtaDescriptionTakeToBNPL": "encaminh-lo para $1", "WalletECNewUXErrorMessageForAutofill": "O preenchimento automtico no conseguiu preencher todos os seus detalhes. Introduza-os manualmente para concluir a transao.", "WalletECNewUXErrorMessageForCashback": "No foi possvel aplicar o reembolso sua compra neste momento. Tente novamente mais tarde.", "WalletECNewUXErrorMessageForCoupon": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "WalletECNewUXErrorMessageForGiftCard": "No conseguimos aplicar o seu carto de oferta a esta compra. $1", "WalletECNewUXErrorMessageForGiftCardLink": "Ver o estado do carto de oferta", "WalletECNewUXForNoSuccessMessage": "Pedimos desculpa mas no conseguimos ajudar neste momento", "WalletECNewUXForNoWorkingCoupon": "No encontrmos cupes vlidos", "WalletECNewUXMultiErrorMessageForAutofill": "preenchimento automtico", "WalletECNewUXMultiErrorMessageForCashback": "reembolso", "WalletECNewUXMultiErrorMessageForCoupon": "cupes", "WalletECNewUXMultiErrorMessageForiftCard": "carto de oferta", "WalletECNewUXPartialSuccessMessageForAutofill": "Alguns dos seus detalhes foram preenchidos. Introduza as informaes restantes para concluir a sua compra", "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "J poupou $1 com o melhor cupo e carto de oferta", "WalletECNewUXSuccessMessageForAutofill": "Os detalhes da finalizao da compra foram preenchidos", "WalletECNewUXSuccessMessageForCashback": "Receber $1 de reembolso $2", "WalletECNewUXSuccessMessageForCoupon": "J poupou $1 com o melhor cup "WalletECNewUXSuccessMessageForGiftCard": "J poupou $1 com o carto de oferta" "WalletECSimplifyAutofillSubTitle": "Ativar para utilizar a concluspida" "WalletECSimplifyAutofillTitle": "Detalhes do preenchimento automtico da finalizao da compra" "WalletECUXSimplifyCtaDescriptionSaving": "aplicar poupan "walletBNPLSmallCardBottomMessagePayInFour": "O $1 tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardBottomMessageZip": "O Zip tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardFooterMessage": "A Microsoft no lhe cobra nem paga por estes fornecedores.", "walletBNPLSmallCardTitle": "A compra ser dividida em quatro prestaes", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "A compra pode ser dividida em 4 prestaes", "walletChangeYourSettings": "alterar as definies", "walletDrawerFormPageMicroFeedbackPrompt": "Est contente com a Carteira?", "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplique automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardAutofillFailureTitle": "No foi possvel aplicar automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardRedeemFailureTitle": "No foi possvel resgatar os seus pontos do Rewards como carto de oferta. Pode continuar com a encomenda ou tentar a transao novamente mais tarde.", "walletDrawerGiftCardRedeemMultipleFailureTitle": "Resgate os seus pontos do Rewards como carto de oferta.", "walletECAllFailureMessageBottom": "No se preocupe ainda pode continuar a sua transao.", "walletECAllFailureTitle": "As seguintes funcionalidades no esto disponveis neste momento:", "walletECApplyCashBackTitle": "Reembolso", "walletECApplyCashCackTitle": "Receber $1 em reembolso.", "walletECApplySavingTitle": "Poupar $1 e receber $2 em reembolso.", "walletECAutoApplyApplyingBestCouponsNew": "Aplicando o melhor cupo que encontrmos...", "walletECAutoApplyFailureTitle": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "walletECAutoApplyFeature": "Cupes de teste", "walletECAutoApplyTryingCoupons": "A tentar $1...", "walletECAutofillErrorMessage": "Detalhes da Preenchimento Automtico", "walletECAutofillPaymentOnlySingleErrorMessage": "O preenchimento automtico no conseguiu concluir todos os seus detalhes. Introduza-os manualmente para continuar a sua transao.", "walletECAutofillPaymentOnlySuccessMessage": "Preenchemos automaticamente os seus dados de pagamento para uma finalizapida da compra.", "walletECAvailableRewardsPoints": "$1 pontos disponveis", "walletECCancelCouponButton": "Ignorar cupes", "walletECCancelCouponFooter": "45% dos utilizadores pouparam com cupes", "walletECCancelCouponStatus": "A aplicao de cupes cancelada", "walletECCashBackAndCouponTitle": "Reembolsos e cupes", "walletECCashBackDisplayValue": "At $1", "walletECCashBackEnableErrorMessage": "No foi possvel aplicar o cashback sua compra neste momento. Tente novamente mais tarde.", "walletECCashBackEnableSubErrorMessage": "Ativar cashback", "walletECCashBackInfo": "Receber atualizaes por e-mail e monitorizar os detalhes dos reembolsos em $1.", "walletECCashBackOptionText": "Obter reembolso", "walletECCashBackUpto": "At $1", "walletECCashbackActivateFailedLabel": "No foi possvel ativar o reembolso desta compra. Tente novamente mais tarde.", "walletECCashbackActivateLabel": "Ativar reembolso", "walletECCashbackEnrollDisclaimer": "Ter sesso iniciada no Microsoft Edge que ir fazer uma cpia de segurana dos seus dados de navegao e permitir-lhe ver os seus favoritos palavras-passe histrico e muito mais em todos os seus dispositivos. Tambm ir aderir e receber e-mails sobre o $1 que incluem ofertas sobre produtos de parceiros. $2 | $3", "walletECCashbackLinkLabel": "Ver detalhes da oferta no valor de $1", "walletECCashbackPrivacyLinkLabel": "Privacidade e Cookies", "walletECCashbackSigninLabel": "Aderir agora e ative o reembolso", "walletECCashbackStatus": "Reembolso ativado", "walletECCashbackTermsLinkLabel": "Termos", "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar poupanas e continuar", "walletECContinueSavingsAndFillDetailsLabel": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes automaticamente e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsLabelBNPL": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes e preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Ao continuar ativaremos o programa de reembolsos preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsButtonLabel": "Aplicar poupanas", "walletECContinueSavingsLabel": "Ao continuar iremos ativar o programa de reembolso e aplicar cupes automaticamente.", "walletECContinueSavingsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos.", "walletECCouponAverageSaving": "Em mdia poupou $1", "walletECCouponOptionText": "Utilizar cup "walletECCouponsCookieDisclaimer": "Permito a colocao de $1 no meu dispositivo para ajudar a faturao com o fornecedor do cupo tal como por $2" "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declarao de Privacidade da Microsoft" "walletECEnjoyMessage": "Desfrute do resto do seu percurso de compras." "walletECFillDetailsButtonLabelUXSimplify": "Preencher detalhes" "walletECFreBannerContent": "Encontre as melhores ofertas com cupes e reembolsos, tudo antes de pagar." "walletECFreBannerTitle": "Poupe dinheiro e tempo com a Carteira no Microsoft Edge" "walletECGetCashbackLabel": "Pode obter um reembolso de at $1 em $2." "walletECGiftCardTitle": "Carto de oferta" "walletECManagePersonalInfo": "Gerir informaes pessoais" "walletECMaskedCardDetailFetching": "Introduza o seu CVC para continuar" "walletECMaskedFetchErrorMessage": "Tente novamente e introduza o seu CVC quando lhe for solicitado. Em alternativa, selecione outro mtodo de pagamento para continuar." "walletECNewCtaDescriptionTemplateFive": "Ao continuar, iremos $1, $2, $3, $4 e $5." "walletECNewCtaDescriptionTemplateFour": "Ao continuar, iremos $1, $2, $3 e $4." "walletECNewCtaDescriptionTemplateOne": "Ao continuar, iremos $1." "walletECNewCtaDescriptionTemplateThree": "Ao continuar, iremos $1, $2 e $3." "walletECNewCtaDescriptionTemplateTwo": "Ao continuar, iremos $1 e $2." "walletECNewShippingAddressTitle": "Detalhes do envio" "walletECNewUXErrorMessageTemplateFive": "Os $1, $2, $3, $4 e $5 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateFour": "Os $1, $2, $3 e $4 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateThree": "Os $1, $2 e $3 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateTwo": "Os $1 e $2 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNoSavedAddress": "Sem Endereo Guardado" "walletECNoSavedName": "Nenhum Nome Guardado" "walletECRebatesCouponsSelectorDescription": "Aplicmos as melhores poupanas para si e descobrimos que s pode utilizar uma nesta compra. Selecione uma das opes abaixo para continuar." "walletECRebatesCouponsSelectorTitle": "Selecione um para continuar" "walletECReturnToCheckoutButtonAria": "Fechar o painel e regressar gina de finalizao da compra" "walletECRewardsDonotRedeemOptionPoints": "No resgatar pontos de recompensas" "walletECRewardsNoGiftCardSelected": "Nenhum carto de oferta selecionado" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 pontos" "walletECRewardsRedeemOptionPoints": "$1 pontos" "walletECRewardsRedeemOptionTitle": "Resgatar carto de oferta de $1" "walletECRewardsTitle": "Carto de oferta do Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar poupanas e preencher detalhes" "walletECSavingsDisableMessage": "$1 para ativar o reembolso e aplicar cupes automaticamente. Isto pode poupar-lhe tempo e dinheiro quando fizer compras no Edge." "walletECShoppingInfo": "Est a utilizar cupes e reembolsos de compras da Microsoft." "walletECShoppingInfoForCoupon": "e cupes" "walletECShoppingInfoNew": "Est a utilizar o reembolso de $1 para compras da Microsoft." "walletECSkipCouponProgressStatus": "A ignorar cupes..." "walletECThirdPartyCookies": "cookies de terceiros" "walletECTokenizationCardDetailFetching": "Estamos a estabelecer uma ligao com o seu banco para gerar os detalhes do carto para esta transao. Isto pode demorar alguns segundos." "walletECTokenizationFetchErrorMessage": "N possvel gerar os detalhes do carto virtual. Tente novamente ou escolha outro carto." "walletECUXAffirmDescription": "Dividir pagamentos ao longo de 8 semanas" "walletECUXAffirmDescriptionFinanced": "Compre agora, pague ao longo do tempo com o Affirm." "walletECUXBNPLDropdownTitle": "Pagar ao longo do tempo" "walletECUXCardKlarnaDescription": "Sem taxas de juros, podero aplicar-se taxas de atraso" "walletECUXKlarnaDescription": "Compre agora. Pague ao longo do tempo com a Klarna." "walletECUXManagePaymentButtonTitle": "Gerir mtodos de pagamento" "walletECUXNewAddressDropdownLabel": "Selecionar endereo para envio" "walletECUXNewOnlyCardDropdownTitle": "Pagar com cart "walletECUXNewPaymentDropdownLabel": "Selecionar mtodo de pagamento", "walletECUXNewPaymentDropdownTitle": "Pagar com carto ou pagar ao longo do tempo", "walletECUXSBillingTheSameWithShipAddress": "O endereo de fatura o mesmo que o endereo de envio", "walletECUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletECUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "walletECUXSmallCardAffirmDescription": "Sem taxas de atraso sem juros", "walletECUXSmallCardZipDescription": "Sem impacto na classificao de crdito podero aplicar-se taxas de atraso", "walletECUXZipDescription": "Dividir pagamentos ao longo de 6 semanas", "walletECUXsimplifyBGAANegativeContent": "A Carteira testou todos os cupes mas no encontrou nenhum desconto", "walletECUXsimplifyBGAANegativeTitle": "Tem o melhor pre "walletECUXsimplifyBGAAPostiveCouponContent": "A Carteira testou todos os cupes disponveis" "walletECUXsimplifyBGAAPostiveTitle": "Est a poupar $1" "walletECUXsimplifyCashbackEnrollText": "Obtenha at $1 com o $2" "walletECUXsimplifyCashbackValue": "At $1" "walletECUXsimplifyMutipleCoupon": "$1 cupes" "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar poupan "walletECUXsimplifyShoppingToggleOffCashback": "Ativar o Microsoft Cashback" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Ativar o Microsoft Cashback e aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para poupar tempo e dinheiro quando faz compras online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Ativar as compras no Microsoft Edge" "walletECUXsimplifyStandardCouponContent": "Poupandia: $1 em $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "A Carteira encontrar a melhor oferta para si" "walletECUXsimplifyStandardCouponTitle": "$1 ser testado" "walletSelectString": "$1 ou $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""WalletECNewCtaDescriptionCashback": "activar el programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupones automticamente", "WalletECNewCtaDescriptionFillAddress": "autorrellenar la informacin de env "WalletECNewCtaDescriptionFillDetail": "rellene la informacin de envo y facturaci "WalletECNewCtaDescriptionFillPayment": "rellene la informacin de facturaci "WalletECNewCtaDescriptionGiftCard": "canjear la tarjeta de regalo" "WalletECNewCtaDescriptionTakeToBNPL": "llevarle a $1" "WalletECNewUXErrorMessageForAutofill": "El autorrellenado no pudo completar todos los detalles. Solo tiene que escribirlos manualmente para completar la compra." "WalletECNewUXErrorMessageForCashback": "No se ha podido aplicar la devolucin de dinero a la compra en este momento. Intntelo de nuevo ms tarde." "WalletECNewUXErrorMessageForCoupon": "La prueba de cupones no est disponible en este momento, pero todava puede probar los cupones manualmente." "WalletECNewUXErrorMessageForGiftCard": "No pudimos aplicar tu tarjeta regalo a esta compra. $1" "WalletECNewUXErrorMessageForGiftCardLink": "Ver el estado de la tarjeta regalo" "WalletECNewUXForNoSuccessMessage": "Lo sentimos, no podemos ayudarle en este momento" "WalletECNewUXForNoWorkingCoupon": "No encontramos ningn cupn de trabajo" "WalletECNewUXMultiErrorMessageForAutofill": "Autorrellenar" "WalletECNewUXMultiErrorMessageForCashback": "efectivo devuelto" "WalletECNewUXMultiErrorMessageForCoupon": "cupones" "WalletECNewUXMultiErrorMessageForiftCard": "Tarjeta de regalo" "WalletECNewUXPartialSuccessMessageForAutofill": "Se han rellenado algunos de los detalles. Introducir la informacin restante para completar la compra" "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "Ya ha guardado $1 con el mejor cupn y la tarjeta regalo" "WalletECNewUXSuccessMessageForAutofill": "Se han rellenado los detalles de la finalizacin de la compra" "WalletECNewUXSuccessMessageForCashback": "Obtendr hasta $1 en efectivo de devolucin de $2" "WalletECNewUXSuccessMessageForCoupon": "Ya ha guardado $1 con el mejor cup "WalletECNewUXSuccessMessageForGiftCard": "Ya ha guardado $1 con la tarjeta regalo", "WalletECSimplifyAutofillSubTitle": "Activar para habilitar autorrellenar", "WalletECSimplifyAutofillTitle": "Autorellenar detalles de finalizacin de la compra", "WalletECUXSimplifyCtaDescriptionSaving": "aplicar descuento", "walletBNPLSmallCardBottomMessagePayInFour": "$1 tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardBottomMessageZip": "Zip tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardFooterMessage": "Microsoft no le cobra ni recibe pagos de estos proveedores.", "walletBNPLSmallCardTitle": "La compra se dividir en 4 plazos", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "La compra se puede dividir en 4 entregas.", "walletChangeYourSettings": "cambiar la configuraci "walletDrawerFormPageMicroFeedbackPrompt": "s satisfecho con Cartera?" "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplica automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y Escrbelo manualmente para usarlo." "walletDrawerGiftCardAutofillFailureTitle": "No pudimos aplicar automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y escrbelo manualmente para usarlo." "walletDrawerGiftCardRedeemFailureTitle": "No pudimos canjear tus puntos de Rewards como tarjeta regalo. Puedes continuar con el pedido o volver a intentar la transaccis tarde." "walletDrawerGiftCardRedeemMultipleFailureTitle": "Canjea tus puntos de Rewards como tarjeta regalo." "walletECAllFailureMessageBottom": "No te preocupes, todava puedes continuar con la transaccin." "walletECAllFailureTitle": "Las siguientes caractersticas no estn disponibles en este momento:" "walletECApplyCashBackTitle": "Dinero devuelto" "walletECApplyCashCackTitle": "Obtendr hasta $1 en efectivo devuelto." "walletECApplySavingTitle": "Ahorrar $1 y obtendr hasta $2 en efectivo." "walletECAutoApplyApplyingBestCouponsNew": "Aplicando el mejor cupn que encontramos..." "walletECAutoApplyFailureTitle": "Las pruebas de cupones no estn disponibles en este momento, pero todava puede probar los cupones manualmente." "walletECAutoApplyFeature": "Cupones de prueba" "walletECAutoApplyTryingCoupons": "Intentando $1..." "walletECAutofillErrorMessage": "Detalles de Autorrellenar" "walletECAutofillPaymentOnlySingleErrorMessage": "Autorrellenar no pudo completar todos los detalles. Introdcelos manualmente para continuar con la transaccin." "walletECAutofillPaymentOnlySuccessMessage": "Hemos rellenado automticamente sus datos de pago para finalizar la compra rpidamente." "walletECAvailableRewardsPoints": "$1 puntos disponibles" "walletECCancelCouponButton": "Omitir cupones" "walletECCancelCouponFooter": "Un 45% de los usuarios ahorraron con cupones" "walletECCancelCouponStatus": "Cancelar cupones que se estn aplicando" "walletECCashBackAndCouponTitle": "Efectivo devuelto y cupones" "walletECCashBackDisplayValue": "Hasta $1" "walletECCashBackEnableErrorMessage": "No se pudo aplicar el reembolso a la compra en este momento. Intntalo de nuevo ms tarde." "walletECCashBackEnableSubErrorMessage": "Activar reembolso" "walletECCashBackInfo": "Recibir actualizaciones por correo electrnico y har un seguimiento del efectivo devuelto por $1." "walletECCashBackOptionText": "Obtener una devolucin de dinero" "walletECCashBackUpto": "Hasta $1" "walletECCashbackActivateFailedLabel": "No pudimos activar la devolucin de efectivo para esta compra. Intntalo de nuevo ms tarde." "walletECCashbackActivateLabel": "Activar reembolso" "walletECCashbackEnrollDisclaimer": "Iniciars sesin en Microsoft Edge, que realizar una copia de seguridad de sus datos de navegacin y te permitir ver tus favoritos, contraseas, historial y ms en todos sus dispositivos. Tambin te unirs y recibirs correos electrnicos de alrededor de $1, que incluyen ofertas sobre productos de socios. $2 | $3" "walletECCashbackLinkLabel": "Ver detalles de la oferta en $1" "walletECCashbackPrivacyLinkLabel": "Privacidad y cookies" "walletECCashbackSigninLabel": "nete ahora y activa la devolucin de dinero" "walletECCashbackStatus": "Reembolso activado" "walletECCashbackTermsLinkLabel": "Trminos" "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar descuento y continuar" "walletECContinueSavingsAndFillDetailsLabel": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones automticamente y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsLabelBNPL": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Al continuar, activaremos el programa de reembolsos y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Al continuar, activaremos el programa de reembolsos y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsButtonLabel": "Aplicar descuento" "walletECContinueSavingsLabel": "Al continuar, activaremos el programa de reembolsos y aplicaremos cupones automticamente." "walletECContinueSavingsNoCouponLabel": "Si contina, activaremos el programa de reembolsos." "walletECCouponAverageSaving": "De media, se ha ahorrado $1" "walletECCouponOptionText": "Usar cup "walletECCouponsCookieDisclaimer": "Permito colocar $1 en mi dispositivo para ayudar a facturar con el proveedor de cupones segn $2", "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declaracin de privacidad de Microsoft", "walletECEnjoyMessage": "Disfrute del resto de su recorrido de compra.", "walletECFillDetailsButtonLabelUXSimplify": "Rellenar detalles", "walletECFreBannerContent": "Encuentre las mejores ofertas con cupones y reembolsos todo antes de pagar.", "walletECFreBannerTitle": "Ahorre dinero y tiempo con Wallet en Microsoft Edge", "walletECGetCashbackLabel": "Puede conseguir hasta $1 de reembolso en $2.", "walletECGiftCardTitle": "Tarjeta regalo", "walletECManagePersonalInfo": "Administrar la informacin personal", "walletECMaskedCardDetailFetching": "Escriba su CVC para continuar", "walletECMaskedFetchErrorMessage": "Intntelo de nuevo y escriba su CVC cuando se le solicite. O bien seleccione otro mtodo de pago para continuar.", "walletECNewCtaDescriptionTemplateFive": "Si contina se le pedir $1 $2 $3 $4 y $5.", "walletECNewCtaDescriptionTemplateFour": "Si contina se le pedir $1 $2 $3 y $4.", "walletECNewCtaDescriptionTemplateOne": "Si contina se le pedir $1.", "walletECNewCtaDescriptionTemplateThree": "Si contina se le pedir $1 $2 y $3.", "walletECNewCtaDescriptionTemplateTwo": "Si contina se le pedir $1 y $2.", "walletECNewShippingAddressTitle": "Detalles del env "walletECNewUXErrorMessageTemplateFive": "Los $1, $2, $3, $4 y $5 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateFour": "Los $1, $2, $3 y $4 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateThree": "Los $1, $2 y $3 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateTwo": "Los $1 y $2 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNoSavedAddress": "No hay direccin guardada" "walletECNoSavedName": "No hay nombre guardado" "walletECRebatesCouponsSelectorDescription": "Le hemos aplicado los mejores descuentos y hemos encontrado que solo puede utilizar uno para esta compra. Seleccione una de las opciones siguientes para continuar." "walletECRebatesCouponsSelectorTitle": "Elija uno para continuar" "walletECReturnToCheckoutButtonAria": "Cerrar el panel y volver a la pgina de finalizacin de la compra" "walletECRewardsDonotRedeemOptionPoints": "No canjear puntos de recompensa" "walletECRewardsNoGiftCardSelected": "No hay ninguna tarjeta regalo seleccionada" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 puntos" "walletECRewardsRedeemOptionPoints": "$1 puntos" "walletECRewardsRedeemOptionTitle": "Canjear tarjeta regalo de $1" "walletECRewardsTitle": "tarjeta regalo Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar los descuentos y rellenar los detalles" "walletECSavingsDisableMessage": "$1 para activar el reembolso y aplicar cupones automticamente. Esto puede ahorrarle tiempo y dinero cuando compre en Edge." "walletECShoppingInfo": "Est usando el efectivo devuelto y cupones de compra de Microsoft." "walletECShoppingInfoForCoupon": "y cupones" "walletECShoppingInfoNew": "Est usando la devolucin de dinero de Microsoft$1." "walletECSkipCouponProgressStatus": "Omitiendo cupones "walletECThirdPartyCookies": "Cookies de terceros", "walletECTokenizationCardDetailFetching": "Estamos conectando con su banco para generar los detalles de la tarjeta para esta transaccin. Esto puede llevar unos segundos.", "walletECTokenizationFetchErrorMessage": "No se pueden generar los detalles de la tarjeta virtual. Vuelva a intentarlo o elija otra tarjeta.", "walletECUXAffirmDescription": "Dividir pagos en 8 semanas", "walletECUXAffirmDescriptionFinanced": "Compre ahora. Pague con el tiempo con Affirm.", "walletECUXBNPLDropdownTitle": "Pagar a lo largo del tiempo", "walletECUXCardKlarnaDescription": "Sin cuotas de inters pueden aplicarse recargo por demora", "walletECUXKlarnaDescription": "Compre ahora. Pague con el tiempo con Klarna.", "walletECUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletECUXNewAddressDropdownLabel": "Seleccionar direccin de env "walletECUXNewOnlyCardDropdownTitle": "Pagar con tarjeta" "walletECUXNewPaymentDropdownLabel": "Seleccionar mtodo de pago" "walletECUXNewPaymentDropdownTitle": "Pagar con tarjeta o pagar a lo largo del tiempo" "walletECUXSBillingTheSameWithShipAddress": "La direccin de facturacin es la misma que la direccin de env "walletECUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletECUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "walletECUXSmallCardAffirmDescription": "Sin recargo por demora sin intereses", "walletECUXSmallCardZipDescription": "Sin impacto en la puntuacin de crdito pueden aplicarse recargo por demora", "walletECUXZipDescription": "Dividir pagos en 6 semanas", "walletECUXsimplifyBGAANegativeContent": "Cartera prob todos los cupones pero no encontr ningn ahorro", "walletECUXsimplifyBGAANegativeTitle": "Tiene el mejor precio", "walletECUXsimplifyBGAAPostiveCouponContent": "Cartera ha probado todos los cupones disponibles", "walletECUXsimplifyBGAAPostiveTitle": "Ests ahorrando $1", "walletECUXsimplifyCashbackEnrollText": "Obtener hasta $1 con $2", "walletECUXsimplifyCashbackValue": "Hasta $1", "walletECUXsimplifyMutipleCoupon": "$1 cupones", "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar descuento" "walletECUXsimplifyShoppingToggleOffCashback": "Activar Reembolso de Microsoft" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Activar MicrosoftCashback y aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para ahorrar tiempo y dinero al comprar online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Activar las compras en MicrosoftEdge" "walletECUXsimplifyStandardCouponContent": "Ahorro medio: $1 en $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "Cartera encontrar la mejor oferta para ti" "walletECUXsimplifyStandardCouponTitle": "Se probar $1" "walletSelectString": "$1 o $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declarao de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Utilizao do Microsoft Edge", "affirmDescriptionText": "Compre agora pague de forma faseada com o Affirm. $1", "affirmDisclaimerLinkText": "Contacte a Affirm", "affirmDisclaimerText": "O Carto Affirm um carto virtual de utilizao limitada financiado pelo Cross River Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ou pela Affirm Loan Services LLC dependendo dos termos do seu contrato de emprstimo. emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A. Inc. O Carto Affirm emitido pela Marqeta. Se tiver alguma questo $1.", "affirmEstimatedFeesText": "No aplicadas taxas por atrasos", "affirmLogoDesc": "Compre agora pague de forma faseada com a Affirm", "affirmPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Affirm de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Affirm podem aplicar-se os termos de pagamento com essa aprovao.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicie sesso na sua aplicao de banca online para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para o seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "O seu banco est a enviar-lhe um cdigo de verificao para o seu endereo de e-mail $1.", "challengeDescriptionOnlineBanking": "Introduza abaixo o cdigo que recebeu do seu banco.", "challengeDescriptionOutboundCall": "O seu banco ir ligar para o seu nmero de telemvel $1 com um cdigo de verificao.", "challengeDescriptionSMS": "O seu banco est a enviar-lhe um cdigo de verificao para o nmero de telemvel $1.", "close": "Fechar", "commonSubtitle": "Veja se elegvel para pagamentos faseados", "dismiss": "Dispensar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outro", "feedbackOptionTookTooMuchTime": "Demorou demasiado tempo", "klarnaDescriptionText": "Faa as suas compras agora. Pague ao longo do tempo com a Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Klarna Visa emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A Inc. O Carto Klarna tem tecnologia da Marqeta. Apoio a Clientes: $1", "klarnaEstimatedFeesText": "Podem aplicar-se taxas do servio Klarna de atraso", "klarnaFeeTermLinkText": "Servio \"Pague Depois\" da Klarna em $1", "klarnaLogoDesc": "Poupe dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Klarna de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Klarna podem aplicar-se os termos de pagamento com essa aprovao.", "learnMore": "Saber mais", "manageYourPaymentMethodsLinkText": "Gerir os seus mtodos de pagamento", "msPayAddCardAgreement": "Ao continuar concorda com $1 $2 e $3 relativamente forma como os seus dados so tratados.", "nextButtonAriaLabel": "Ir para a pgina seguinte", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos do Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Inscrever-se", "tokenizationEnrollConfirmDialogTitle": "Pague em segurana com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configure um carto virtual e ganhe 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou pedir o cdigo de segurana do carto para verificar se se trata de si.", "tokenizationEnrollConfirmModalDescription": "Um carto virtual oculta os detalhes do seu carto a comerciantes quando fizer compras online. Se algum deles tiver uma falha de segurana de dados os seus detalhes permanecero protegidos. $1", "tokenizationTerms": "Ao continuar concorda com os $1.", "tokenizeCardBack": "Voltar", "tokenizeCardChallengeMethodAPPToAPP": "Aplicao de servio bancrio mvel", "tokenizeCardChallengeMethodCustomerService": "Suporte ao cliente do banco", "tokenizeCardChallengeMethodEmail": "E-mail", "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria", "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensagem de texto", "tokenizeCardCvvInvalidError": "Verifique o seu cdigo de segurana e tente novamente.", "tokenizeCardEnterCode": "Introduzir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos efetuar a verifica "tokenizeCardEnterCvvStepDescription": "O seu banco exige que verifique o cdigo de segurana CVV associado ao seu carto $1 que termina em $2." "tokenizeCardErrorStepTitle": "Ocorreu um erro" "tokenizeCardFetchCodeError": "O emissor do seu carto teve um problema ao enviar o cdigo. Pea outro cdigo ou utilize um mtodo de verificao diferente." "tokenizeCardFetchCodeErrorCustomerService": "O emissor do seu carto teve um problema ao gerar o cdigo. Experimente um mtodo de verificao diferente ou tente novamente mais tarde." "tokenizeCardGeneralError": "O emissor do seu carto est a ter problemas neste momento. Tente novamente mais tarde." "tokenizeCardLoadingTitle": "A contactar o seu banco "tokenizeCardNext": "Seguinte", "tokenizeCardResendCode": "Reenviar o cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos efetuar a verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tentar novamente" "tokenizeCardValidationError": "O emissor do seu carto consegue efetuar a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "A verificar" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "No conseguimos preencher automaticamente as informaes do seu carto a partir do $1. Insira manualmente as informaes do seu carto $1 durante a compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto e do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha o seu endereo de faturao." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de expira "walletDrawerLinkErrorMessage": "No conseguimos associar a sua conta Microsoft a $1. Tente novamente mais tarde.", "walletDrawerNameAndAddressLabel": "O seu nome e endereo para fatura "walletDrawerPayWithVirtualCard": "Pague com o seu carto $1 $2" "walletDrawerSystemErrorHeader": "Ups" "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado pelo seu feedback. Ir ajudar-nos a melhorar a Carteira." "walletMicrofeedbackPrompt": "Est contente com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerir mtodos de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "zipDescriptionText": "Compre agora pague durante seis semanas com o Zip. $1", "zipEstimatedFeesText": "Podem aplicar-se taxas de atraso", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip compre agora pague depois", "zipPolicy": "Ao continuar concorda com os nossos $1 e reconhece que o seu valor total de compra ser partilhado com a Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Poltica de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Uso do Microsoft Edge", "affirmDescriptionText": "Compre agora pague ao longo do tempo com Affirm. $1", "affirmDisclaimerLinkText": "Contactar a Affirm", "affirmDisclaimerText": "O Carto Afirmativo um carto virtual de uso limitado e financiamento pelo Cross River Bank membro da FDIC ou Affirm Loan Services empresa de responsabilidade limitada dependendo dos termos do seu contrato de emprstimo e emitido por Mila Bank membro da FDIC de acordo com a licena da Visa U.S.A. Inc. O Carto da Affirm emitido pela Marqeta. $1 se voc tiver alguma dvida.", "affirmEstimatedFeesText": "No se aplicam tarifas atrasadas", "affirmLogoDesc": "Compre agora pague a longo prazo com a Affirm", "affirmPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Affirm de acordo com $2. Se voc tiver sido aprovado recentemente pela Affirm para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Entre em seu aplicativo online do banco para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "Seu banco est lhe enviando um cdigo de verificao para seu endereo de email $1.", "challengeDescriptionOnlineBanking": "Insira abaixo o cdigo que voc recebeu de seu banco.", "challengeDescriptionOutboundCall": "Seu banco ligar para seu nmero de celular $1 com um cdigo de verificao.", "challengeDescriptionSMS": "Seu banco est lhe enviando um cdigo de verificao para seu nmero do telefone celular $1.", "close": "Fechar", "commonSubtitle": "Confira se est qualificado para pagamento a longo prazo", "dismiss": "Ignorar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outros", "feedbackOptionTookTooMuchTime": "Demorou muito tempo", "klarnaDescriptionText": "Compre agora. Pague depois com o Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Visa Klarna emitido pelo Sutton Bank membro da FDIC de acordo com uma licena da Visa U.S.A Inc. O Carto Klarna da plataforma Marqeta. Servio de Atendimento ao Cliente $1", "klarnaEstimatedFeesText": "Servio Klarna e taxas atrasadas podem ser aplicadas", "klarnaFeeTermLinkText": "Pagar mais tarde em $1 do Klarna", "klarnaLogoDesc": "Economize dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Klarna de acordo com $2. Se voc tiver sido aprovado recentemente pela Klarna para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "learnMore": "Saiba mais", "manageYourPaymentMethodsLinkText": "Gerenciar suas formas de pagamento", "msPayAddCardAgreement": "Ao continuar voc concorda com os $1 $2 e $3 sobre como seus dados so tratados.", "nextButtonAriaLabel": "Ir para a prxima pgina", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos e Condies de Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Registrar", "tokenizationEnrollConfirmDialogTitle": "Pague de forma segura com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar um carto virtual e ganhar 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou solicitar o cdigo de segurana do carto para verificar se voc "tokenizationEnrollConfirmModalDescription": "Um carto virtual esconde os detalhes do seu carto dos comerciantes quando voc faz compras online. Se algum deles sofrer uma violao de dados, seus dados permanecero protegidos. $1" "tokenizationTerms": "Ao continuar, voc concorda com $1." "tokenizeCardBack": "Voltar" "tokenizeCardChallengeMethodAPPToAPP": "Aplicativo de dispositivo mvel do banco" "tokenizeCardChallengeMethodCustomerService": "Servio de atendimento ao cliente do banco" "tokenizeCardChallengeMethodEmail": "Email" "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria" "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica" "tokenizeCardChallengeMethodSMS": "Mensagem de texto" "tokenizeCardCvvInvalidError": "Verifique seu cdigo de segurana e tente novamente." "tokenizeCardEnterCode": "Inserir cdigo" "tokenizeCardEnterCodeStepTitle": "Vamos fazer sua verifica "tokenizeCardEnterCvvStepDescription": "Seu banco exige que voc verifique o cdigo de segurana CVV associado ao seu $1 que termina em $2.", "tokenizeCardErrorStepTitle": "Algo deu errado", "tokenizeCardFetchCodeError": "O emissor do carto teve um problema ao enviar o cdigo. Solicite outro cdigo ou use um mtodo de verificao diferente.", "tokenizeCardFetchCodeErrorCustomerService": "O emissor do carto teve um problema ao gerar o cdigo. Tente um mtodo de verificao diferente ou tente novamente mais tarde.", "tokenizeCardGeneralError": "O emissor de seu carto est tendo problemas no momento. Tente novamente mais tarde.", "tokenizeCardLoadingTitle": "Contatando seu banco...", "tokenizeCardNext": "Avanar", "tokenizeCardResendCode": "Reenviar cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos fazer sua verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tente novamente" "tokenizeCardValidationError": "O emissor de seu carto pode fazer a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "Verificando" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "N possvel preencher automaticamente as informaes do carto a partir de $1. Insira manualmente as informaes do carto de $1 durante a finalizao da compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique no carto e nos detalhes do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha seu endereo de cobrana residencial." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de validade" "walletDrawerLinkErrorMessage": "N possvel vincular sua conta Microsoft a $1. Tente novamente mais tarde." "walletDrawerNameAndAddressLabel": "Seu nome e endereo para cobran "walletDrawerPayWithVirtualCard": "Pague com seu carto $1 $2", "walletDrawerSystemErrorHeader": "Ah n "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado por seus comentrios. Isso nos ajudar a melhorar a velocidade da Carteira." "walletMicrofeedbackPrompt": "Satisfeito com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerenciar formas de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta carto virtual", "walletUXSTokenCardLogoContent": "Nmero do carto virtual $1 ativado para proteger suas informaes de pagamento", "zipDescriptionText": "Compre agora pague em 6 semanas com Zip. $1", "zipEstimatedFeesText": "Taxas atrasadas podem ser aplicadas", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip comprar agora pagar depois", "zipPolicy": "Ao continuar voc concorda com nossos $1 e reconhece que o valor total da compra ser compartilhado com o Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declaracin de privacidad de Microsoft", "aboutTermsOfUseLinkText": "Trminos de uso de Microsoft Edge", "affirmDescriptionText": "Compra ahora y paga despus con Affirm. $1", "affirmDisclaimerLinkText": "Ponerme en contacto con Affirm", "affirmDisclaimerText": "La tarjeta Affirm es una tarjeta virtual de uso limitado con fondos de Cross River Bank FDIC o Affirm Loan Services LLC en funcin de los trminos del contrato de prstamo y emitida por Sutton Bank banco miembro de FDIC en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Affirm cuenta con tecnologa de Marqeta. $1 si tienes alguna pregunta.", "affirmEstimatedFeesText": "No se aplican cargos con retraso", "affirmLogoDesc": "Compra ahora y paga despus con Affirm", "affirmPolicy": "Al continuar acepta $1 y reconoce que el importe total de la compra junto con el lugar en el que compra se compartirn con La autorizacin de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Parte de la Funcin pueden aplicarse los trminos de pago con esa aprobacin.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicia sesin en tu aplicacin de banca en lnea para recibir un cdigo de verificacin.", "challengeDescriptionCustomerService": "Llama a tu banco al $1 para recibir un cdigo de verificacin.", "challengeDescriptionEmail": "Tu banco te est enviando un cdigo de verificacin a tu direccin de correo electrnico $1.", "challengeDescriptionOnlineBanking": "Introduce a continuacin el cdigo que recibiste de tu banco.", "challengeDescriptionOutboundCall": "Tu banco llamar a tu nmero de telfono mvil $1 con un cdigo de verificacin.", "challengeDescriptionSMS": "Tu banco te est enviando un cdigo de verificacin a tu nmero de telfono mvil $1.", "close": "Cerrar", "commonSubtitle": "Comprueba si cumples los requisitos para pagar despu "dismiss": "Descartar" "feedbackOptionAutofillDontWork": "Error al autorrellenar" "feedbackOptionOthers": "Otro" "feedbackOptionTookTooMuchTime": "Se tard demasiado tiempo" "klarnaDescriptionText": "Compra ahora. Paga despus con Klarna. $1" "klarnaDisclaimerText": "La tarjeta Klarna Visa Commercial Card es emitida por Sutton Bank, banco miembro de la Corporacin Federal de Seguro de Depsitos (FDIC), en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Klarna cuenta con tecnologa de Marqeta. Atencin al cliente $1" "klarnaEstimatedFeesText": "Pueden aplicarse cargos por servicio y demora de Klarna" "klarnaFeeTermLinkText": "\"Paga despus\" de Klarna en $1" "klarnaLogoDesc": "Ahorra dinero con Klarna." "klarnaPolicy": "Al continuar, acepta $1 y reconoce que el importe total de la compra junto con el lugar donde compre se compartir con Klarna, de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Klarna, pueden aplicarse los trminos de pago con esa aprobacin." "learnMore": "Obtener ms informaci "manageYourPaymentMethodsLinkText": "Administrar los mtodos de pago", "msPayAddCardAgreement": "Al continuar aceptas $1 $2 y $3 relativos a cmo se administran sus datos.", "nextButtonAriaLabel": "Ir a la pgina siguiente", "paginationButtonAriaLabel": "Ir a la pgina $1", "paymentServiceTermsLinkText": "Trminos del servicio de pago", "previousButtonAriaLabel": "Ir a la pgina anterior", "textOfChangeButton": "Cambiar", "textOfCreateButton": "Crear", "tokenizationEnroll": "Inscribirse", "tokenizationEnrollConfirmDialogTitle": "Paga de forma segura con una tarjeta virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar una tarjeta virtual y ganar 20 puntos de Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "El emisor de la tarjeta puede enviar un cdigo de verificacin o solicitar el cdigo de seguridad de la tarjeta para comprobar que eres t "tokenizationEnrollConfirmModalDescription": "Una tarjeta virtual oculta los detalles de la tarjeta a los comerciantes cuando compras en lnea. Si alguno de ellos experimenta una vulneracin de datos, tus detalles permanecern protegidos. $1" "tokenizationTerms": "Al continuar, aceptas el $1." "tokenizeCardBack": "Atr "tokenizeCardChallengeMethodAPPToAPP": "Aplicacin de banca mvil", "tokenizeCardChallengeMethodCustomerService": "Servicio de atencin al cliente del banco", "tokenizeCardChallengeMethodEmail": "Correo electrnico", "tokenizeCardChallengeMethodOnlineBanking": "Cuenta bancaria", "tokenizeCardChallengeMethodOutboundCall": "Llamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensaje de texto", "tokenizeCardCvvInvalidError": "Comprueba el cdigo de seguridad e intntalo de nuevo.", "tokenizeCardEnterCode": "Introducir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos a realizar la comprobaci "tokenizeCardEnterCvvStepDescription": "Tu banco requiere que compruebes el cdigo de seguridad CVV asociado a tu $1 que termina en $2." "tokenizeCardErrorStepTitle": "Hubo un problema" "tokenizeCardFetchCodeError": "El emisor de la tarjeta tuvo un problema para enviar el cdigo. Solicite otro cdigo o use otro mtodo de verificacin." "tokenizeCardFetchCodeErrorCustomerService": "El emisor de la tarjeta tuvo un problema al generar el cdigo. Pruebe con otro mtodo de verificacin o intntelo de nuevo ms tarde." "tokenizeCardGeneralError": "El emisor de la tarjeta tiene problemas en este momento. Vuelve a intentarlo ms tarde." "tokenizeCardLoadingTitle": "Contactando con tu banco..." "tokenizeCardNext": "Siguiente" "tokenizeCardResendCode": "Reenviar cdigo" "tokenizeCardSelectMethodDescription": "Elige uno de los mtodos de comprobacin siguientes:" "tokenizeCardSelectMethodStepTitle": "Vamos a realizar la comprobaci "tokenizeCardSendingCode": "Cdigo enviado", "tokenizeCardTryAgain": "Volver a intentarlo", "tokenizeCardValidationError": "El emisor de la tarjeta no pudo comprobarlo. Intntalo de nuevo en breve.", "tokenizeCardVerify": "Comprobar", "tokenizeCardVerifyWithAnotherMethod": "Comprobar con otro mtodo", "tokenizeCardVerifying": "Verificando", "walletCommonAccountCount": "$1 cuenta", "walletDrawerAutoFillErrorMessage": "No podemos rellenar automticamente la informacin de tu tarjeta desde $1. Escribe manualmente esta informacin de $1 durante la finalizacin de la compra.", "walletDrawerAutoFillMessage": "Hemos rellenado automticamente la informacin de la tarjeta desde $1.", "walletDrawerAutoFillMessageWithBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en la tarjeta y los detalles de direccin siguientes para copiar.", "walletDrawerAutoFillMessageWithoutBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en los detalles de la tarjeta a continuacin para copiar. Para completar esta compra rellene la direccin de facturacin de su hogar.", "walletDrawerCvcLabel": "CVC", "walletDrawerExpirationLabel": "Expiraci "walletDrawerLabelCopyCardNumber": "Copiar nmero de la tarjeta" "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nombre y direcci "walletDrawerLabelShowCardNumber": "Mostrar nmero de tarjeta", "walletDrawerLabelShowCvc": "Mostrar CVC", "walletDrawerLabelShowExpirationDate": "Copiar fecha de expiraci "walletDrawerLinkErrorMessage": "No podemos vincular tu cuenta Microsoft a $1. Vuelve a intentarlo ms tarde." "walletDrawerNameAndAddressLabel": "Tu nombre y direccin de facturaci "walletDrawerPayWithVirtualCard": "Pagar con tu tarjeta $1 $2", "walletDrawerSystemErrorHeader": "Vaya!", "walletDrawerVirtualCardNumberLabel": "Nmero de tarjeta virtual", "walletFeedbackThankYouText": "Gracias por los comentarios. Nos ayudar a mejorar Cartera.", "walletMicrofeedbackPrompt": "s satisfecho con Cartera?", "walletSeeDetailsAriaLabel": "ver detalles", "walletUXAddPaymentButtonTitle": "Agregar nueva tarjeta", "walletUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "zipDescriptionText": "Compra ahora paga en 6 semanas con Zip. $1", "zipEstimatedFeesText": "Pueden aplicarse cargos con retraso", "zipFeeTermLinkText": "Trminos del servicio de Zip", "zipLogoDesc": "Zip compra ahora paga despu "zipPolicy": "Al continuar, aceptas nuestros $1 y reconoces que el importe total de la compra se compartir con Zip, de acuerdo con $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Ativar carto virtual", "featurePromotionActionLinkText": "Experimentar agora", "learnMoreLinkTextShort": "Saber mais", "membershipsDescription": "Mantenha tudo organizado e sob controlo.", "membershipsPromotionTitle": "Faa a gesto das suas associaes na Carteira", "msWalletNotificationCardExpired": "O seu carto expirou", "msWalletNotificationCardExpiring": "O seu carto expira em breve", "msWalletNotificationCardTokenizationEligibleDescription": "Os cartes virtuais so credenciais de pagamento de utilizanica que so geradas aleatoriamente sempre que faz uma compra online. Isto ajuda a garantir que o seu $1 est protegido.", "msWalletNotificationCardTokenizationEligibleHeader": "Proteja os detalhes do seu cart "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure um carto virtual para tornar as compras online mais seguras e convenientes." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure um carto virtual para tornar as compras online mais seguras e ganhar 20 pontos do Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar para $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteja as suas compras com cartes virtuais" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explore a Web3 de forma segura com esta carteira sem depositrio" "msWalletNotificationCryptowalletSignupTitle": "Configurar a sua Carteira Criptogrfica" "msWalletNotificationDismissLabel": "Dispensar" "msWalletNotificationDismissPermanently": "Dispensar permanentemente" "msWalletNotificationDismissText": "No ver esta notificao novamente" "msWalletNotificationDonationSummaryLinkText": "Conferir" "msWalletNotificationDonationSummaryTitle": "Veja todo o seu resumo de donativos e n "msWalletNotificationFixLeakage": "Ver detalhes", "msWalletNotificationHotelReservationBody": "A sua data de reserva de $1 de $2 a $3 est a aproximar-se.", "msWalletNotificationHotelReservationTitle": "Alojamento futuro", "msWalletNotificationHotelReservationViewDetails": "Ver detalhes", "msWalletNotificationLeakageBody": "$1 das suas $2 palavras-passe foram divulgadas.", "msWalletNotificationLeakageTitle": "Divulgao de palavra-passe", "msWalletNotificationOrderStatusTitle": "Estado da encomenda atualizado", "msWalletNotificationPOMessage": "A sua oferta selecionada de $1 do Microsoft Cashback expira dentro de $2", "msWalletNotificationPOTitle": "Oferta a expirar em breve", "msWalletNotificationPasswordCompromiseBody": "Microsoft Edge detected that $1 of your passwords were found in a known online leak.", "msWalletNotificationPasswordCompromiseTitle": "Password compromise", "msWalletNotificationRebatesCashoutAction": "Transferir para Paypal", "msWalletNotificationRebatesCashoutAmountDescription": "Parabns tem $1 de reembolso. Levante com o PayPal.", "msWalletNotificationRebatesCashoutDescription": "Saiba mais sobre o programa de reembolso e o levantamento com o PayPal.", "msWalletNotificationRebatesCashoutTitle": "Est na hora de receber o seu reembolso!", "msWalletNotificationRoamCardAction": "Guardar o cart "msWalletNotificationRoamCardActionV2": "Guardar carto na conta Microsoft" "msWalletNotificationRoamCardHeader": "Guardar o carto na conta Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pague mais rapidamente e a partir de diferentes dispositivos em compras futuras" "msWalletNotificationRoamCardHeaderV3": "Pague mais rapidamente a partir de qualquer dispositivo" "msWalletNotificationSnoozeLabel": "Suspender" "msWalletNotificationSnoozeText": "Notificao suspensa durante sete dias" "msWalletNotificationSnoozeText1": "Notificao suspensa durante $1 dias" "msWalletNotificationTrackOrderLink": "Monitorizar encomenda" "msWalletNotificationTrackOrderSubTitle": "A carteira ajuda a monitorizar a sua encomenda quando compra em determinados sites." "msWalletNotificationTrackOrderTitle": "Monitorizar a sua encomenda" "msWalletNotificationUpdateButton": "Atualizar agora" "msWalletNotificationUpdateButton1": "Atualizar ou remover cart "msWalletNotificationUpdateButton2": "Corrigir", "msWalletNotificationUpdateCardFailText": "A atualizao falhou. Tente novamente em $1", "msWalletNotificationUpdateExpText": "Edite as informaes do seu carto para continuar a utilizar o seu carto que termina em $1.", "msWalletNotificationUpdateExpTextV2MissingIssuer": "Atualize o seu carto com terminao em $1 para continuar a utiliz-lo.", "msWalletNotificationUpdatedCardText": "Carto atualizado com xito!", "msWalletNotificationViewDetailLink": "Ver detalhes", "passwordsDescription": "Desfrute da nova experincia de gesto na Carteira.", "passwordsPromotionTitle": "Gerir as suas palavras-passe na Carteira", "personalizedOffersCashBackDescription": "Ganhe $1 de reembolso com a $2.", "personalizedOffersNoThanksText": "No obrigado", "personalizedOffersOfferExpiresInText": "A oferta expira dentro de", "personalizedOffersViewOfferText": "Ver oferta", "rewardsPromotionActionLinkText": "Adicionar nova associa "rewardsPromotionDescription": "Ganhe at 20 pontos Rewards ao adicionar novas associa carteira" "rewardsPromotionTitle": "Adicione associaes para obter Microsoft Rewards" "walletTitle": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Activar tarjeta virtual", "featurePromotionActionLinkText": "Probar ahora", "learnMoreLinkTextShort": "Obtener ms informaci "membershipsDescription": "Mantngase organizado y en control." "membershipsPromotionTitle": "Administra tus suscripciones en Cartera" "msWalletNotificationCardExpired": "Su tarjeta ha caducado" "msWalletNotificationCardExpiring": "Su tarjeta expirar pronto" "msWalletNotificationCardTokenizationEligibleDescription": "Las tarjetas virtuales son credenciales de pago de un solo uso que se generan aleatoriamente cada vez que se realiza una compra en lnea. Esto ayuda a garantizar que su tarjeta $1 est protegida." "msWalletNotificationCardTokenizationEligibleHeader": "Proteja los datos de sus tarjetas" "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure una tarjeta virtual para que las compras en lnea sean ms seguras y mmodas." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure una tarjeta virtual para que sus compras en lnea sean ms seguras y gane 20 puntos de Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar por $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteger las compras con tarjetas virtuales" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explorar Web3 de forma segura con esta cartera que no es custodio" "msWalletNotificationCryptowalletSignupTitle": "Configure su Cartera criptogrfica" "msWalletNotificationDismissLabel": "Descartar" "msWalletNotificationDismissPermanently": "Descartar permanentemente" "msWalletNotificationDismissText": "No volvers a ver esta notificaci "msWalletNotificationDonationSummaryLinkText": "Comprubelo", "msWalletNotificationDonationSummaryTitle": "Ver todo el resumen de la entrega y mucho m "msWalletNotificationFixLeakage": "Ver detalles" "msWalletNotificationHotelReservationBody": "Tu fecha de reserva de $1 del $2 al $3 estxima." "msWalletNotificationHotelReservationTitle": "Prximo alojamiento" "msWalletNotificationHotelReservationViewDetails": "Ver detalles" "msWalletNotificationLeakageBody": "Se han filtrado $1 de sus $2 contraseas." "msWalletNotificationLeakageTitle": "Filtracin de contraseas" "msWalletNotificationOrderStatusTitle": "Estado del pedido actualizado" "msWalletNotificationPOMessage": "Tu oferta seleccionada de Microsoft Cashback de $1 expira en $2" "msWalletNotificationPOTitle": "La oferta expirar pronto" "msWalletNotificationPasswordCompromiseBody": "Microsoft Edge detected that $1 of your passwords were found in a known online leak." "msWalletNotificationPasswordCompromiseTitle": "Password compromise" "msWalletNotificationRebatesCashoutAction": "Transferir a PayPal" "msWalletNotificationRebatesCashoutAmountDescription": "Enhorabuena, tienes $1 en efectivo. Reembolso con PayPal." "msWalletNotificationRebatesCashoutDescription": "Ms informacin sobre el programa de devolucin de efectivo y el reembolso con PayPal." "msWalletNotificationRebatesCashoutTitle": "Es hora de cobrar!" "msWalletNotificationRoamCardAction": "Guardar la tarjeta" "msWalletNotificationRoamCardActionV2": "Guardar tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeader": "Guardar la tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pagar mpido y desde diferentes dispositivos en futuras compras" "msWalletNotificationRoamCardHeaderV3": "Pagar mpido desde cualquier dispositivo" "msWalletNotificationSnoozeLabel": "Posponer" "msWalletNotificationSnoozeText": "Notificacin pospuesta durante 7 das" "msWalletNotificationSnoozeText1": "Notificacin pospuesta durante $1 das" "msWalletNotificationTrackOrderLink": "Seguimiento de pedidos" "msWalletNotificationTrackOrderSubTitle": "La Cartera se ayuda a realizar un seguimiento de su pedido cuando compra en determinados sitios." "msWalletNotificationTrackOrderTitle": "Realizar un seguimiento del pedido" "msWalletNotificationUpdateButton": "Actualizar ahora" "msWalletNotificationUpdateButton1": "Actualizar o quitar tarjeta" "msWalletNotificationUpdateButton2": "Corregir" "msWalletNotificationUpdateCardFailText": "Error al actualizar. Intntalo de nuevo en $1" "msWalletNotificationUpdateExpText": "Edita la informacin de la tarjeta para seguir usando la tarjeta que termina en $1." "msWalletNotificationUpdateExpTextV2MissingIssuer": "Actualice la tarjeta que termina en $1 para seguir usndola." "msWalletNotificationUpdatedCardText": "La tarjeta se actualiz correctamente" "msWalletNotificationViewDetailLink": "Ver detalles" "passwordsDescription": "Probar la nueva experiencia de administracin en Cartera." "passwordsPromotionTitle": "Administrar las contraseas en Cartera" "personalizedOffersCashBackDescription": "Recupera $1 en efectivo con $2." "personalizedOffersNoThanksText": "No, gracias" "personalizedOffersOfferExpiresInText": "La oferta caduca en" "personalizedOffersViewOfferText": "Ver la oferta" "rewardsPromotionActionLinkText": "Agregar nueva suscripci "rewardsPromotionDescription": "Gane hasta 20 puntos de recompensa agregando nuevas suscripciones a la cartera", "rewardsPromotionTitle": "Agrega suscripciones para ganar Microsoft Rewards", "walletTitle": "Cartera"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e futuras", "address": "Endereos", "all": "Tudo", "bookingId": "ID da Reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Cartas", "cashback": "Reembolso", "checkIn": "Check-in", "checkOut": "Check-out", "digitalIdMembershipAddMembership": "Adicionar nova", "digitalIdMembershipEmptySubtitle": "Armazenamos a sua associao para ajudar a preencher rapidamente as informaes quando reserva bilhetes de voo e fornecemos capacidades diversas para que consiga maximizar as suas poupanas em conformidade.", "digitalIdMembershipEmptyTitle": "Ainda no existe nenhuma associa "done": "Concludo" "earn": "Ganhe" "edit": "Editar" "in1Day": "Dentro de 1 dia" "inUse": "Em utiliza "inXDays": "Dentro de $1 dias", "join": "Participar", "manage": "Gerir", "membership": "ASSOCIA "membershipAdded": "New membership added" "membershipCardHolderFirstName": "Nome prprio" "membershipCardHolderLastName": "Apelido" "membershipCardHolderMiddleName": "Nome do meio" "membershipCardHolderName": "TITULAR DO CART "membershipCopied": "Membership number copied", "membershipFormAddButtonLabel": "Adicionar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Guardar", "membershipInvalid": "Required field(s) missing", "membershipNumber": "N. DE ASSOCIA "membershipRemoveTitle": "Are you sure to remove?" "membershipRemoved": "Membership removed" "membershipType": "Tipo de associa "membershipUpdated": "Membership updated", "memberships": "Associaes", "open": "Abrir", "openTicketUrlMessage": "Abra a pgina \"$1\" para gerir as suas reservas.", "openUrlTitle": "Abrir o \"$1\"", "passwordLeakActionMessage": "As palavras-passe de $1 apareceram em fugas", "passwordLeakActionMessageSingular": "Uma palavra-passe apareceu em fugas de informa "passwordSectionTitle": "$1 palavras-passe divulgadas" "passwordSectionTitleSingular": "1 palavra-passe divulgada" "passwordSectionViewMore": "Ver mais $1 palavras-passe divulgadas" "passwordSectionViewMoreSingular": "Ver mais 1 palavra-passe divulgada" "passwords": "Palavras-passe" "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Mtodos de pagamento", "providedBy": "Fornecido por $1", "remove": "Remover", "removeTicketMessage": "Remover este passe da Carteira", "rewards": "Recompensas", "tickets": "Pedidos", "ticketsEmptySubTitle": "Podemos sincronizar os seus bilhetes do Bing Travel e do Outlook para a Carteira agora.", "ticketsEmptyTitle": "Ainda no existem pedidos", "ticketsViewExpired": "Ver $1 passes expirados", "ticketsViewExpiredSingular": "Ver 1 passe expirado", "today": "Hoje", "tomorrow": "Amanh "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalles", "actionsAndUpcomingTitle": "Acciones y prximos", "address": "Direcciones", "all": "Todos", "bookingId": "Id. de reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Tarjetas", "cashback": "Reembolso", "checkIn": "Registro", "checkOut": "Salida", "digitalIdMembershipAddMembership": "Agregar nueva", "digitalIdMembershipEmptySubtitle": "Almacenamos tu suscripcin para ayudarte a rellenar rpidamente la informacin cuando reserves vuelos y proporcionamos diversas funcionalidades para maximizar tus ahorros consecuentemente.", "digitalIdMembershipEmptyTitle": "An no hay ninguna suscripci "done": "Listo" "earn": "Ganar" "edit": "Editar" "in1Day": "En 1 d "inUse": "En uso", "inXDays": "En $1 das", "join": "Unirse", "manage": "Administrar", "membership": "MEMBRES "membershipAdded": "New membership added" "membershipCardHolderFirstName": "Nombre" "membershipCardHolderLastName": "Apellidos" "membershipCardHolderMiddleName": "Segundo nombre" "membershipCardHolderName": "TITULAR" "membershipCopied": "Membership number copied" "membershipFormAddButtonLabel": "Agregar" "membershipFormNumber": "Nmero" "membershipFormOptionalField": "(Opcional)" "membershipFormSaveButtonLabel": "Guardar" "membershipInvalid": "Required field(s) missing" "membershipNumber": "NO DE PERTENENCIA." "membershipRemoveTitle": "Are you sure to remove?" "membershipRemoved": "Membership removed" "membershipType": "Tipo de suscripci "membershipUpdated": "Membership updated", "memberships": "Suscripciones", "open": "Abrir", "openTicketUrlMessage": "Abra la pgina \"$1\" para administrar sus reservas.", "openUrlTitle": "Abrir \"$1\"", "passwordLeakActionMessage": "Han aparecido $1 contraseas en filtraciones", "passwordLeakActionMessageSingular": "Ha aparecido 1 contrasea en filtraciones", "passwordSectionTitle": "$1 Contraseas filtradas por", "passwordSectionTitleSingular": "1 contrasea filtrada", "passwordSectionViewMore": "Ver $1 ms contraseas filtradas", "passwordSectionViewMoreSingular": "Ver 1 contrases filtradas", "passwords": "Contraseas", "paymentSectionAddNew": "Agregar una nueva tarjeta", "paymentSectionTitle": "Mtodos de pago", "providedBy": "Proporcionado por $1", "remove": "Quitar", "removeTicketMessage": "Quitar este pase de Cartera", "rewards": "Recompensas", "tickets": "Entradas", "ticketsEmptySubTitle": "Ahora podemos sincronizar sus vales de Bing Travel y Outlook con Cartera.", "ticketsEmptyTitle": "An no hay ningn vale", "ticketsViewExpired": "Ver $1 pases expirados", "ticketsViewExpiredSingular": "Ver 1 pase expirado", "today": "Hoy", "tomorrow": "Maana", "wallet": "Cartera"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e prximos passos", "address": "Endereos", "all": "Tudo", "bookingId": "ID da Reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Cartes", "cashback": "Cashback", "checkIn": "Fazer check-in", "checkOut": "Check-out", "digitalIdMembershipAddMembership": "Adicionar novo", "digitalIdMembershipEmptySubtitle": "Armazenamos sua associao para ajudar voc a preencher rapidamente as informaes ao reservar passagens areas e fornecer diversos recursos para maximizar suas economias adequadamente.", "digitalIdMembershipEmptyTitle": "Ainda n nenhuma associa "done": "Concludo" "earn": "Ganhe" "edit": "Editar" "in1Day": "Em 1 dia" "inUse": "Em uso" "inXDays": "Em $1 dias" "join": "Ingressar" "manage": "Gerenciar" "membership": "ASSOCIA "membershipAdded": "New membership added", "membershipCardHolderFirstName": "Nome", "membershipCardHolderLastName": "Sobrenome", "membershipCardHolderMiddleName": "Sobrenome", "membershipCardHolderName": "TITULAR", "membershipCopied": "Membership number copied", "membershipFormAddButtonLabel": "Adicionar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Salvar", "membershipInvalid": "Required field(s) missing", "membershipNumber": "N. DE ASSOCIAO.", "membershipRemoveTitle": "Are you sure to remove?", "membershipRemoved": "Membership removed", "membershipType": "Tipo de associa "membershipUpdated": "Membership updated" "memberships": "Associaes" "open": "Abrir" "openTicketUrlMessage": "Abra a pgina \"$1\" para gerenciar suas reservas." "openUrlTitle": "Abra o \"$1\"" "passwordLeakActionMessage": "Senhas de $1 apareceram em vazamentos" "passwordLeakActionMessageSingular": "A senha de $1 apareceu em vazamentos" "passwordSectionTitle": "$1 senhas vazadas" "passwordSectionTitleSingular": "1 senha vazada" "passwordSectionViewMore": "Exibir mais $1 senhas vazadas" "passwordSectionViewMoreSingular": "Exibir mais 1 senha vazada" "passwords": "Senhas" "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Formas de pagamento", "providedBy": "Fornecido por $1", "remove": "Remover", "removeTicketMessage": "Remover este passe da Carteira", "rewards": "Rewards", "tickets": "Tquetes", "ticketsEmptySubTitle": "Podemos sincronizar seus tquetes do Bing Travel e do Outlook para a Carteira agora.", "ticketsEmptyTitle": "Ainda n nenhum tquete", "ticketsViewExpired": "Exibir $1 passes expirados", "ticketsViewExpiredSingular": "Exibir 1 passagem expirada", "today": "Hoje", "tomorrow": "Amanh "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json2e:T468,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "5pS9Jb7.exe.1272895912") Found reference to API "873627474,8172,3024,,RtlGetVersion,NTDLL.dll,"00:17:40.234",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")2f:T57a,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\OS1Nk65.exe" - (UID: 00000000-00004884) "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5pS9Jb7.exe" - (UID: 00000000-00004884) "OS1Nk65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\Po8zD98.exe" - (UID: 00000000-00002512) "OS1Nk65.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4rs071Wv.exe" - (UID: 00000000-00002512) "Po8zD98.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\Tw8HY11.exe" - (UID: 00000000-00006556) "Po8zD98.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3Ie42Oj.exe" - (UID: 00000000-00006556) "Tw8HY11.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1IP71jL3.exe" - (UID: 00000000-00007420) "Tw8HY11.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2ya8791.exe" - (UID: 00000000-00007420) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" - (UID: 00000000-00000512) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00000512)30:T941,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.001E0000.00000004.mdmp, 00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.001F0000.00000004.mdmp, 00000000-00002512.00000000.68149.00420000.00000004.mdmp, 00000000-00002512.00000000.68149.006B0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "874840918,8172,3136,,CreateProcessA,kernel32.dll,"00:17:40.234",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMit?" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.006B0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")31:T99bc,Found reference to API (Indicator: "CheckTokenMembership"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "HeapSetInformation"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "DecryptFileA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetTokenInformation"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RegDeleteValueA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FreeSid"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "OpenProcessToken"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RegSetValueExA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RegQueryValueExA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "EqualSid"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RegCloseKey"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetShortPathNameA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FindFirstFileA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetCurrentProcess"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FindNextFileA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FindClose"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LocalAlloc"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "lstrcmpA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CompareStringA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetLastError"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetFileAttributesA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LoadLibraryA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "DeleteFileA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GlobalAlloc"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GlobalFree"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CloseHandle"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetFileAttributesA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetProcAddress"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GlobalLock"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LocalFree"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FreeLibrary"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CreateDirectoryA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GlobalUnlock"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "ReadFile"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SizeofResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "WriteFile"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetDriveTypeA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LoadLibraryExA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetFileTime"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetFilePointer"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FindResourceA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CreateMutexA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "WaitForSingleObject"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FreeResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetVersion"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetTempPathA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CreateFileA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetEvent"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "TerminateThread"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetVersionExA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LockResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetSystemInfo"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CreateThread"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "ResetEvent"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LoadResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "ExitProcess"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetModuleHandleW"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CreateProcessA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FormatMessageA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetTempFileNameA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CreateEventA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetDeviceCaps"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetDesktopWindow"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CharUpperA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "ExitWindowsEx"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "MessageBeep"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CharPrevA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "LoadStringA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CharNextA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "EnableWindow"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "ReleaseDC"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetForegroundWindow"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "PeekMessageA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SendMessageA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "MessageBoxA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetWindowTextA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetWindowLongA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "CallWindowProcA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetWindowLongA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "ShowWindow"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetWindowPos"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetDC"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetWindowRect"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "DispatchMessageA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "VerQueryValueA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "Sleep"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetStartupInfoW"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "TerminateProcess"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetTickCount"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "MulDiv"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "GetSystemMetrics"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API (Indicator: "FlsAlloc"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "FlsGetValue"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "FlsSetValue"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "FlsFree"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetActiveWindow"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetLastActivePopup"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetProcessWindowStation"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "EncodePointer"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "DecodePointer"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "RaiseException"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "MultiByteToWideChar"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "lstrlenA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "InterlockedDecrement"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetModuleHandleA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "Module32Next"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "Module32First"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "OleInitialize"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "HeapFree"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetProcessHeap"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "HeapAlloc"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetCommandLineA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "HeapCreate"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "VirtualFree"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "DeleteCriticalSection"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "LeaveCriticalSection"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "EnterCriticalSection"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "VirtualAlloc"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "HeapReAlloc"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "HeapSize"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "IsDebuggerPresent"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetStdHandle"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "WideCharToMultiByte"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetConsoleCP"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetConsoleMode"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "TlsGetValue"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "TlsAlloc"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "TlsSetValue"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "TlsFree"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "InterlockedIncrement"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "SetLastError"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "FlushFileBuffers"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "SetHandleCount"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetFileType"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetStartupInfoA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "RtlUnwind"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetCPInfo"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetACP"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetOEMCP"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "IsValidCodePage"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "CompareStringW"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "WriteConsoleA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "WriteConsoleW"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "SetStdHandle"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetLocaleInfoA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "LCMapStringA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "LCMapStringW"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetStringTypeA"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "GetStringTypeW"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "SetEndOfFile"; File: "1IP71jL3.exe.2601628960") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "GetLongPathNameW"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "RtlGetVersion"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "CreateFileW"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "UnregisterWait"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "GetCurrentThread"; File: "5pS9Jb7.exe.1272895912") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002512.00000000.68149.01131000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002512.00000000.68149.01131000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00002512.00000000.68149.01131000.00000020.mdmp") Found reference to API (Indicator: "SHBrowseForFolder"; Source: "00000000-00002512.00000000.68149.01138000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "00000000-00002512.00000000.68149.01138000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")32:T58f,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")33:T572,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe "DSystem\CurrentControlSet\Control\Session Manager" in Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe "System\CurrentControlSet\Control\Session Manager" in Source: 25108-17-0040256D "8355-1207367261-1001\Software\Mi" in Source: 00000000-00002512.00000000.68149.00178000.00000004.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00002512.00000000.68149.001F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002512.00000000.68149.01131000.00000020.mdmp "System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002512.00000000.68149.01138000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002512.00000000.68149.01138000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 00000000-00002512.00000000.68149.01138000.00000004.mdmp34:T4f7,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4rs071Wv.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2ya8791.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "OS1Nk65.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3Ie42Oj.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Po8zD98.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Tw8HY11.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT35:T108e,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "50C4.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "Session_13341272277929247") file/memory contains long string with (Indicator: "facebook.com"; File: "Social") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3i7M54/yn/l/en_US/WW_dM8tCcty.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "33bd99500895911e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3iqES4/yQ/l/en_US/riV0sq4fGtL.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "f658fdd182550cbb_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yj/r/5ZTMade4JZA.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "8c16ae2e374c4303_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yi/r/K1u8FojW_L0.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/TNlXf" (Indicator: "facebook.com"; File: "3b9b063938b2e939_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "7faaeb6d807041bb_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yd/r/D8yA-TXiNuk.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/,T,E" (Indicator: "facebook.com"; File: "42ce332cdbe9fa73_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "40701b42ebc1cb18_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "49d0896e54e4faca_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "4b1691c2d8c552f5_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "2556f6e9598d5fb0_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/HyZZ" (Indicator: "facebook.com"; File: "4945a7b4b1e84510_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "42f4c516cc7fb026_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yF/r/FLJXkx8ys-6.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "ee9a8283c80e3e52_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "9e35b0c2ae3dcde4_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/Hzy&" (Indicator: "facebook.com"; File: "7a9bea57b8cf5f41_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yk/r/kg_LcWkMBGy.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/oKhi" (Indicator: "facebook.com"; File: "7b95d65eb18c490e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ym/r/R_qswDMOLWA.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/01bt" (Indicator: "facebook.com"; File: "ebcedc747b584a9b_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ys/r/_f5wO_K1viW.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "ac9537cd8ef7244a_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yF/r/gb_2sOlx922.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/M[YS]f.g" (Indicator: "facebook.com"; File: "22a1dfae96f6cc61_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yr/r/6XlDJXhMTmo.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "8d5e1c410a09c25f_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/" (Indicator: "facebook.com"; File: "d3776b2d341e7614_0")36:T576,Launches browser "msedge.exe" (UID: 00000000-00004504) Launches browser "msedge.exe" (UID: 00000000-00006780) Launches browser "msedge.exe" (UID: 00000000-00007816) Launches browser "msedge.exe" (UID: 00000000-00005500) Launches browser "msedge.exe" (UID: 00000000-00005924) Launches browser "msedge.exe" (UID: 00000000-00005876) Launches browser "msedge.exe" (UID: 00000000-00000192) Launches browser "msedge.exe" (UID: 00000000-00005684) Launches browser "msedge.exe" (UID: 00000000-00004620) Launches browser "msedge.exe" (UID: 00000000-00003300) Launches browser "msedge.exe" (UID: 00000000-00002412) Launches browser "msedge.exe" (UID: 00000000-00007916) Launches browser "msedge.exe" (UID: 00000000-00001348) Launches browser "msedge.exe" (UID: 00000000-00006856) Launches browser "msedge.exe" (UID: 00000000-00007580) Launches browser "msedge.exe" (UID: 00000000-00007068) Launches browser "msedge.exe" (UID: 00000000-00002436) Launches browser "msedge.exe" (UID: 00000000-00007780) Launches browser "msedge.exe" (UID: 00000000-00006680) Launches browser "msedge.exe" (UID: 00000000-00002952) Launches browser "msedge.exe" (UID: 00000000-00006812) Launches browser "msedge.exe" (UID: 00000000-00002804) Launches browser "msedge.exe" (UID: 00000000-00006748) Launches browser "msedge.exe" (UID: 00000000-00007132) Launches browser "msedge.exe" (UID: 00000000-00004296)37:T6d2,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "OS1Nk65.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "OS1Nk65.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "Po8zD98.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "Po8zD98.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "Tw8HY11.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "Tw8HY11.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "1IP71jL3.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "1IP71jL3.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "2ya8791.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "2ya8791.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "3Ie42Oj.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "3Ie42Oj.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "4rs071Wv.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "4rs071Wv.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "5pS9Jb7.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 742E0000 "5pS9Jb7.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72960000 "cmd.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 4377000038:Te5f,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" was detected as "Microsoft Cabinet" and name: "sfx" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" was detected as "Microsoft Cabinet File" and name: "Archive" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" was detected as "Microsoft Linker" and name: "Linker" "4rs071Wv.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4rs071Wv.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4rs071Wv.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4rs071Wv.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4rs071Wv.exe" was detected as "Microsoft Linker" and name: "Linker" "2ya8791.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2ya8791.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2ya8791.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2ya8791.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2ya8791.exe" was detected as "Microsoft Linker" and name: "Linker" "OS1Nk65.exe" was detected as "Microsoft Cabinet" and name: "sfx" "OS1Nk65.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "OS1Nk65.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "OS1Nk65.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "OS1Nk65.exe" was detected as "Microsoft Linker" and name: "Linker" "3Ie42Oj.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Ie42Oj.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Ie42Oj.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Ie42Oj.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Ie42Oj.exe" was detected as "Microsoft Linker" and name: "Linker" "Po8zD98.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Po8zD98.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Po8zD98.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Po8zD98.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Po8zD98.exe" was detected as "Microsoft Linker" and name: "Linker" "Tw8HY11.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Tw8HY11.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Tw8HY11.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Tw8HY11.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Tw8HY11.exe" was detected as "Microsoft Linker" and name: "Linker" "1IP71jL3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1IP71jL3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1IP71jL3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1IP71jL3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1IP71jL3.exe" was detected as "Microsoft Linker" and name: "Linker" "5pS9Jb7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5pS9Jb7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5pS9Jb7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5pS9Jb7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5pS9Jb7.exe" was detected as "Microsoft Linker" and name: "Linker"39:T6bf,"1IP71jL3.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "5pS9Jb7.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5pS9Jb7.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "5pS9Jb7.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "5pS9Jb7.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "5pS9Jb7.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "5pS9Jb7.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "5pS9Jb7.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "5pS9Jb7.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "5pS9Jb7.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "cmd.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "cmd.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "cmd.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS")3a:T10ef,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4rs071Wv.exe" file has an entrypoint instructions - "jmp 0x448fdd,jmp 0x45fb24,jmp 0x414a30,jmp 0x451160,jmp 0x43be37,jmp 0x42672f,jmp 0x4ab690,jmp 0x43c3a6,jmp 0x460907,jmp 0x4b270a,jmp 0x421948,jmp 0x449aeb,jmp 0x420605,jmp 0x459af7,jmp 0x431e5b,jmp 0x45adc6,jmp 0x4229fc,jmp 0x41f6a5,jmp 0x495478,jmp 0x416699," "2ya8791.exe" file has an entrypoint instructions - "jmp 0x448fdd,jmp 0x45fb24,jmp 0x414a30,jmp 0x451160,jmp 0x43be37,jmp 0x42672a,jmp 0x4ab690,jmp 0x43c3a6,jmp 0x460907,jmp 0x4b270a,jmp 0x421943,jmp 0x449aeb,jmp 0x420600,jmp 0x459af7,jmp 0x431e5b,jmp 0x45adc6,jmp 0x4229f7,jmp 0x41f6a0,jmp 0x495478,jmp 0x416699," "OS1Nk65.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Ie42Oj.exe" file has an entrypoint instructions - "jmp 0x448fdd,jmp 0x45fb24,jmp 0x414a30,jmp 0x451160,jmp 0x43be37,jmp 0x42672f,jmp 0x4ab690,jmp 0x43c3a6,jmp 0x460907,jmp 0x4b270a,jmp 0x421948,jmp 0x449aeb,jmp 0x420605,jmp 0x459af7,jmp 0x431e5b,jmp 0x45adc6,jmp 0x4229fc,jmp 0x41f6a5,jmp 0x495478,jmp 0x416699," "Po8zD98.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Tw8HY11.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1IP71jL3.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "5pS9Jb7.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329,"3b:Tcdc,Process "OS1Nk65.exe" (UID: 00000000-00002512) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "OS1Nk65.exe" (UID: 00000000-00002512) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00000512) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "msedge.exe" (UID: 00000000-00004504) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00004504) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004504) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00006780) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4504_LDOGXQQGIPBQVKDJ", EDGE_BROWSER_PID="4504"" Process "msedge.exe" (UID: 00000000-00007816) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005500) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7816_RFMYJTPYJCZZFFVU", EDGE_BROWSER_PID="7816"" Process "msedge.exe" (UID: 00000000-00005924) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00005924) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005876) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00002412) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002412) was launched with missing environment variables: "CHROME_RESTART" Process "msedge.exe" (UID: 00000000-00007916) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00007916) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007068) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007068) was launched with missing environment variables: "CHROME_RESTART" Process "msedge.exe" (UID: 00000000-00002436) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00002436) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID"3c:T716,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OS1Nk65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "OS1Nk65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OS1Nk65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Po8zD98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Po8zD98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Po8zD98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Tw8HY11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Tw8HY11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Tw8HY11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1IP71jL3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1IP71jL3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1IP71jL3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1IP71jL3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2ya8791.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")3d:T588,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1IP71jL3.exe.log] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004884-00000BC1-30285075] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002512-00000BC1-30714362] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00006556-00000BC1-31105609] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007420-00000BC1-31554739] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007500-00000C28-536916554] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 1IP71jL3.exe.log]3e:T8b9,Spawned process "OS1Nk65.exe" (UID: 00000000-00002512) Spawned process "Po8zD98.exe" (UID: 00000000-00006556) Spawned process "Tw8HY11.exe" (UID: 00000000-00007420) Spawned process "1IP71jL3.exe" (UID: 00000000-00007500) Spawned process "2ya8791.exe" (UID: 00000000-00007476) Spawned process "AppLaunch.exe" (UID: 00000000-00007112) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7476 -ip 7476" (UID: 00000000-00006768) Spawned process "WerFault.exe" with commandline "-u -p 7476 -s 144" (UID: 00000000-00007160) Spawned process "3Ie42Oj.exe" (UID: 00000000-00006476) Spawned process "AppLaunch.exe" (UID: 00000000-00002944) Spawned process "AppLaunch.exe" (UID: 00000000-00007448) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 6476 -ip 6476" (UID: 00000000-00007220) Spawned process "WerFault.exe" with commandline "-u -p 6476 -s 652" (UID: 00000000-00005508) Spawned process "4rs071Wv.exe" (UID: 00000000-00007256) Spawned process "AppLaunch.exe" (UID: 00000000-00000812) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 7256 -ip 7256" (UID: 00000000-00003580) Spawned process "WerFault.exe" with commandline "-u -p 7256 -s 664" (UID: 00000000-00006616) Spawned process "5pS9Jb7.exe" (UID: 00000000-00003740) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\50B2.tmp\\50C3.tmp\\50C4.bat %TEMP%\\IXP000.TMP\\5pS ..." (UID: 00000000-00000512), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004504), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006780) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00007816) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005500), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00005924), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005876)3f:T8b9,Spawned process "OS1Nk65.exe" (UID: 00000000-00002512) Spawned process "Po8zD98.exe" (UID: 00000000-00006556) Spawned process "Tw8HY11.exe" (UID: 00000000-00007420) Spawned process "1IP71jL3.exe" (UID: 00000000-00007500) Spawned process "2ya8791.exe" (UID: 00000000-00007476) Spawned process "AppLaunch.exe" (UID: 00000000-00007112) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7476 -ip 7476" (UID: 00000000-00006768) Spawned process "WerFault.exe" with commandline "-u -p 7476 -s 144" (UID: 00000000-00007160) Spawned process "3Ie42Oj.exe" (UID: 00000000-00006476) Spawned process "AppLaunch.exe" (UID: 00000000-00002944) Spawned process "AppLaunch.exe" (UID: 00000000-00007448) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 6476 -ip 6476" (UID: 00000000-00007220) Spawned process "WerFault.exe" with commandline "-u -p 6476 -s 652" (UID: 00000000-00005508) Spawned process "4rs071Wv.exe" (UID: 00000000-00007256) Spawned process "AppLaunch.exe" (UID: 00000000-00000812) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 7256 -ip 7256" (UID: 00000000-00003580) Spawned process "WerFault.exe" with commandline "-u -p 7256 -s 664" (UID: 00000000-00006616) Spawned process "5pS9Jb7.exe" (UID: 00000000-00003740) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\50B2.tmp\\50C3.tmp\\50C4.bat %TEMP%\\IXP000.TMP\\5pS ..." (UID: 00000000-00000512), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004504), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006780) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00007816) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005500), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00005924), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005876)40:Tcc06,"4rs071Wv.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4rs071Wv.exe]- [targetUID: 00000000-00002512] "2ya8791.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2ya8791.exe]- [targetUID: 00000000-00007476] "OS1Nk65.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\OS1Nk65.exe]- [targetUID: 00000000-00002512] "3Ie42Oj.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3Ie42Oj.exe]- [targetUID: 00000000-00006556] "Po8zD98.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Po8zD98.exe]- [targetUID: 00000000-00002512] "Tw8HY11.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Tw8HY11.exe]- [targetUID: 00000000-00006556] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "1IP71jL3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1IP71jL3.exe]- [targetUID: 00000000-00007420] "5pS9Jb7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5pS9Jb7.exe]- [targetUID: 00000000-00004884] "wallet-icon.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "1IP71jL3.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1IP71jL3.exe.log]- [targetUID: 00000000-00007500] "50C4.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\50B2.tmp\50C3.tmp\50C4.bat]- [targetUID: 00000000-00000512] "shopping.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\shopping.js]- [targetUID: 00000000-00001776] "data_3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00004504] "data_2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00005876] "Ruleset Data" has type "data"- [targetUID: 00000000-00004504] "wallet.bundle.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%TEMP%\4504_732552254\wallet.bundle.js]- [targetUID: 00000000-00008100] "wallet-stable.json" has type "ASCII text"- [targetUID: 00000000-00004504] "wallet-pre-stable.json" has type "ASCII text"- [targetUID: N/A] "recovery-component-inner.crx" has type "Google Chrome extension version 3"- Location: [%TEMP%\4504_950463935\recovery-component-inner.crx]- [targetUID: 00000000-00004504] "edge_driver.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%TEMP%\4504_732552254\edge_driver.js]- [targetUID: 00000000-00008100] "Filtering Rules" has type "data"- Location: [%TEMP%\4504_1633267847\Filtering Rules]- [targetUID: 00000000-00004504] "edge_driver.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\edge_driver.js]- [targetUID: 00000000-00008100] "vendor.bundle.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wallet-drawer.bundle.js" has type "UTF-8 Unicode text with very long lines"- Location: [%TEMP%\4504_732552254\Wallet-Checkout\wallet-drawer.bundle.js]- [targetUID: 00000000-00008100] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00004504] "auto_open_controller.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\auto_open_controller.js]- [targetUID: 00000000-00001776] "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00004504] "edge_confirmation_page_validator.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\edge_confirmation_page_validator.js]- [targetUID: 00000000-00001776] "edge_checkout_page_validator.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\edge_checkout_page_validator.js]- [targetUID: 00000000-00001776] "product_page.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\product_page.js]- [targetUID: 00000000-00001776] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00000192] "000009.log" has type "data"- [targetUID: N/A] "000013.ldb" has type "data"- [targetUID: N/A] "bnpl.bundle.js" has type "UTF-8 Unicode text with very long lines"- Location: [%TEMP%\4504_732552254\bnpl\bnpl.bundle.js]- [targetUID: 00000000-00008100] "tokenized-card.bundle.js" has type "UTF-8 Unicode text with very long lines"- Location: [%TEMP%\4504_732552254\Tokenized-Card\tokenized-card.bundle.js]- [targetUID: 00000000-00004504] "f_0004c9" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00005876] "v1FieldTypes.json" has type "JSON data"- Location: [%TEMP%\4504_1548228785\v1FieldTypes.json]- [targetUID: 00000000-00004504] "notification.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "000014.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00004504] "wallet-checkout-eligible-sites.json" has type "ASCII text"- [targetUID: N/A] "Filtering Rules-AA" has type "data"- Location: [%TEMP%\4504_1633267847\Filtering Rules-AA]- [targetUID: 00000000-00004504] "5d15eb31-c8ff-4c5c-bd00-351db2d945f0.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 210893"- Location: [%TEMP%\5d15eb31-c8ff-4c5c-bd00-351db2d945f0.tmp]- [targetUID: 00000000-00005684] "load_statistics.db" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db]- [targetUID: 00000000-00004504] "miniwallet.bundle.js" has type "UTF-8 Unicode text with very long lines"- Location: [%TEMP%\4504_732552254\Mini-Wallet\miniwallet.bundle.js]- [targetUID: 00000000-00008100] "shoppingfre.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\shoppingfre.js]- [targetUID: 00000000-00001776] "notification_fast.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00004504] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00004504] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00004504] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00004504] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00004504] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0 dBase III DBT version number 0 next free block index 3238251203"- [targetUID: 00000000-00004504] "d0a7100b-aa0b-436d-9d9e-d4069513c536.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 15933"- Location: [%TEMP%\d0a7100b-aa0b-436d-9d9e-d4069513c536.tmp]- [targetUID: 00000000-00004504] "f_0004c7" has type "gzip compressed data original size modulo 2^32 769711"- [targetUID: N/A] "edge_autofill_field_data.json" has type "JSON data"- Location: [%TEMP%\4504_1548228785\edge_autofill_field_data.json]- [targetUID: 00000000-00004504] "History" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00000512] "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00004504] "wallet-checkout-eligible-sites-pre-stable.json" has type "ASCII text"- Location: [%TEMP%\4504_732552254\json\wallet\wallet-checkout-eligible-sites-pre-stable.json]- [targetUID: 00000000-00004504] "Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00004504] "Visited Links" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00004504] "Tabs_13341272288118729" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13341272288118729]- [targetUID: 00000000-00004504] "72ddd672-5a82-4e5c-8b9e-f0459c8957c0.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\72ddd672-5a82-4e5c-8b9e-f0459c8957c0.tmp]- [targetUID: 00000000-00004504] "f_0004c8" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00005876] "e40465d3-2fdb-4c99-b229-77f8391a3041.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e40465d3-2fdb-4c99-b229-77f8391a3041.tmp]- [targetUID: 00000000-00004504] "731c8d9c-fdf6-4049-94e2-8d89bd1ad212.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\731c8d9c-fdf6-4049-94e2-8d89bd1ad212.tmp]- [targetUID: 00000000-00004504] "eae5e574-0fba-400b-bcc0-c38bede27714.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\eae5e574-0fba-400b-bcc0-c38bede27714.tmp]- [targetUID: 00000000-00004504] "196cd73a-c93e-4857-bfaa-2ddd04e5f8e2.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\196cd73a-c93e-4857-bfaa-2ddd04e5f8e2.tmp]- [targetUID: 00000000-00004504] "5a2e9598-9e9c-45b3-bc93-aee1d3881628.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5a2e9598-9e9c-45b3-bc93-aee1d3881628.tmp]- [targetUID: 00000000-00004504] "5c7f98c9-ae41-4dc1-8d51-4739ed458d0e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5c7f98c9-ae41-4dc1-8d51-4739ed458d0e.tmp]- [targetUID: 00000000-00004504] "f2fa45e0-1043-4a93-8174-bb974e50169f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\f2fa45e0-1043-4a93-8174-bb974e50169f.tmp]- [targetUID: 00000000-00004504] "5681ccd6-7efb-4675-a08a-fdf288c9286c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5681ccd6-7efb-4675-a08a-fdf288c9286c.tmp]- [targetUID: 00000000-00004504] "f4aaafc3-b423-4dbd-9689-0f3c56d8875d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\f4aaafc3-b423-4dbd-9689-0f3c56d8875d.tmp]- [targetUID: 00000000-00004504] "cc3ddb19-9903-4bba-9625-7c010bd92f5f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cc3ddb19-9903-4bba-9625-7c010bd92f5f.tmp]- [targetUID: 00000000-00004504] "5731a8cb-8d7a-4394-9786-b25f426d59d6.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5731a8cb-8d7a-4394-9786-b25f426d59d6.tmp]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\ru\strings.json]- [targetUID: 00000000-00008100] "cafbafc8-1cdd-457c-8eb1-20f5b5646b8b.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cafbafc8-1cdd-457c-8eb1-20f5b5646b8b.tmp]- [targetUID: 00000000-00004504] "data.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4504_1170222786\data.txt]- [targetUID: 00000000-00004504] "edge_tracking_page_validator.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\4504_674435121\edge_tracking_page_validator.js]- [targetUID: 00000000-00001776] "Diagnostic Data-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Diagnostic Data-wal]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\ar\strings.json]- [targetUID: 00000000-00008100] "f_0004c5" has type "gzip compressed data original size modulo 2^32 210893"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00005876] "Entities" has type "UTF-8 Unicode text"- Location: [%TEMP%\4504_2055628990\Mu\Entities]- [targetUID: 00000000-00003600] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00005876] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\ja\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\fr-CA\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\fr\strings.json]- [targetUID: 00000000-00008100] "5d67e0ef-45bd-44c4-88fb-fe9446313c76.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\de\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\pt-PT\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\es\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\it\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\pt-BR\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\nl\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\sv\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\id\strings.json]- [targetUID: 00000000-00008100] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Network Action Predictor" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network Action Predictor]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\en-GB\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\zh-Hant\strings.json]- [targetUID: 00000000-00008100] "HubApps Icons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\HubApps Icons]- [targetUID: 00000000-00004504] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00000192] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-hub\zh-Hans\strings.json]- [targetUID: 00000000-00008100] "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00005876] "Favicons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons]- [targetUID: 00000000-00004504] "checkoutdata.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\wallet\wallet-checkout\checkoutdata.json]- [targetUID: 00000000-00008100] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00005876] "LICENSE" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\LICENSE]- [targetUID: 00000000-00003600] "f_0004c6" has type "gzip compressed data original size modulo 2^32 112544"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00005876] "shopping_iframe_driver.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: 00000000-00001776] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00000192] "84ca3a8c-5f1b-4b36-82e2-b7c1289c1c79.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\84ca3a8c-5f1b-4b36-82e2-b7c1289c1c79.tmp]- [targetUID: 00000000-00004504] "bb08466f-d108-4bbf-ae89-47daf2fc3f92.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\bb08466f-d108-4bbf-ae89-47daf2fc3f92.tmp]- [targetUID: 00000000-00004504] "81bbec18-ce61-4431-b846-572ac655b4f0.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\81bbec18-ce61-4431-b846-572ac655b4f0.tmp]- [targetUID: 00000000-00004504] "Advertising" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\Advertising]- [targetUID: 00000000-00003600] "LICENSE" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\4504_1633267847\LICENSE]- [targetUID: 00000000-00003600] "wallet-tokenization-config.json" has type "ASCII text"- [targetUID: N/A] "bbd32e54-12f5-4f51-949e-8124b43825fe.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\bbd32e54-12f5-4f51-949e-8124b43825fe.tmp]- [targetUID: 00000000-00004504] "7503b98a-390e-4bb8-bc6c-96cfce8ed8f9.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\7503b98a-390e-4bb8-bc6c-96cfce8ed8f9.tmp]- [targetUID: 00000000-00004504] "6ec694cd-05d6-4a18-bcbf-8d2a370afd5c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6ec694cd-05d6-4a18-bcbf-8d2a370afd5c.tmp]- [targetUID: 00000000-00004504] "f4e8b87c-7c82-44e7-9ed6-2526b7b044ad.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f4e8b87c-7c82-44e7-9ed6-2526b7b044ad.tmp]- [targetUID: 00000000-00004504] "93cb4f73-bb05-4a6d-8746-a1f9f45f9a10.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\93cb4f73-bb05-4a6d-8746-a1f9f45f9a10.tmp]- [targetUID: 00000000-00004504] "42a68f42-15cd-4290-a37c-c58c1d55aa01.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\42a68f42-15cd-4290-a37c-c58c1d55aa01.tmp]- [targetUID: 00000000-00004504] "crl-set" has type "data"- Location: [%TEMP%\4504_1987952334\crl-set]- [targetUID: 00000000-00007132] "f_0004c4" has type "Web Open Font Format (Version 2) TrueType length 21700 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00005876] "f_0004c3" has type "Web Open Font Format (Version 2) TrueType length 21464 version 1.0"- [targetUID: N/A] "super_coupon.json" has type "JSON data"- [targetUID: N/A] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\ru\strings.json]- [targetUID: 00000000-00008100] "Shortcuts" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Shortcuts]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\ar\strings.json]- [targetUID: 00000000-00008100] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00004504] "Entities" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Entities]- [targetUID: 00000000-00003600] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\ja\strings.json]- [targetUID: 00000000-00008100] "load-ec-i18n.bundle.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4504_732552254\Wallet-Checkout\load-ec-i18n.bundle.js]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\fr-CA\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\fr\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\de\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\pt-PT\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\it\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\es\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\nl\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\pt-BR\strings.json]- [targetUID: 00000000-00008100] "driver-signature.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4504_732552254\driver-signature.txt]- [targetUID: 00000000-00008100] "WebAssistDatabase" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\WebAssistDatabase]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\sv\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\id\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\zh-Hant\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\en-GB\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-ec\zh-Hans\strings.json]- [targetUID: 00000000-00008100] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- [targetUID: 00000000-00008100] "shopping_iframe_driver.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4504_674435121\shopping_iframe_driver.js]- [targetUID: 00000000-00001776] "bnpl_driver.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4504_732552254\bnpl_driver.js]- [targetUID: 00000000-00008100] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log]- [targetUID: 00000000-00000192] "data_2" has type "dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00005876] "data_3" has type "dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00004504] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0 dBase III DBT version number 0 next free block index 3238316739"- [targetUID: 00000000-00004504] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log]- [targetUID: 00000000-00000192] "Session_13341272277929247" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Session_13341272277929247]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\ru\strings.json]- [targetUID: 00000000-00008100] "4354c442-b95b-4c89-b1bf-f0c00e1902e1.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\4354c442-b95b-4c89-b1bf-f0c00e1902e1.tmp]- [targetUID: 00000000-00005876] "c714054d-a678-411f-b4b8-dc2efc0c1205.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\c714054d-a678-411f-b4b8-dc2efc0c1205.tmp]- [targetUID: 00000000-00005876] "23dcf968-7676-4363-8a17-e42018b9a48e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\23dcf968-7676-4363-8a17-e42018b9a48e.tmp]- [targetUID: 00000000-00005876] "Content" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\Content]- [targetUID: 00000000-00003600] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\ar\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\ja\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\fr-CA\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\de\strings.json]- [targetUID: 00000000-00008100] "Staging" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Staging]- [targetUID: 00000000-00003600] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\pt-PT\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\es\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\it\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\nl\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\pt-BR\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\id\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\en-GB\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\zh-Hant\strings.json]- [targetUID: 00000000-00008100] "notification.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00004504] "Analytics" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\Analytics]- [targetUID: 00000000-00003600] "edge_autofill_global_block_list.json" has type "JSON data"- Location: [%TEMP%\4504_1548228785\edge_autofill_global_block_list.json]- [targetUID: 00000000-00004504] "deny_full_domains.list" has type "data"- Location: [%TEMP%\4504_2103180555\deny_full_domains.list]- [targetUID: 00000000-00004504] "398b0bc0-a105-48ac-9941-2b7542cf25f5.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\398b0bc0-a105-48ac-9941-2b7542cf25f5.tmp]- [targetUID: 00000000-00005876] "6c595c51-b8d0-441b-9832-e140a1281c1f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\6c595c51-b8d0-441b-9832-e140a1281c1f.tmp]- [targetUID: 00000000-00005876] "460fa0a1-ae8d-4c17-b433-2484fc7b3f94.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\460fa0a1-ae8d-4c17-b433-2484fc7b3f94.tmp]- [targetUID: 00000000-00005876] "98b7be1f-0314-4a77-a6a4-d44cbd1a3efb.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\98b7be1f-0314-4a77-a6a4-d44cbd1a3efb.tmp]- [targetUID: 00000000-00005876] "a214d7b6-6375-4b1a-aa17-59c9d40630c4.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\a214d7b6-6375-4b1a-aa17-59c9d40630c4.tmp]- [targetUID: 00000000-00005876] "9746476b-f87f-4b31-94d5-2e8fd122aebb.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\9746476b-f87f-4b31-94d5-2e8fd122aebb.tmp]- [targetUID: 00000000-00005876] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\ru\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\ar\strings.json]- [targetUID: 00000000-00008100] "Social" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Social]- [targetUID: 00000000-00003600] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\ja\strings.json]- [targetUID: 00000000-00008100] "bd64699c-8935-4400-b03a-bb646cf4f927.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260"- Location: [%TEMP%\bd64699c-8935-4400-b03a-bb646cf4f927.tmp]- [targetUID: 00000000-00002436] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\fr\strings.json]- [targetUID: 00000000-00008100] "nav_config.json" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\4504_1330060161\nav_config.json]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\de\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\pt-PT\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\nl\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\id\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\it\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\es\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\pt-BR\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\sv\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\en-GB\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\zh-Hans\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\zh-Hant\strings.json]- [targetUID: 00000000-00008100] "vendor.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- [targetUID: N/A] "adblock_snippet.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4504_1633267847\adblock_snippet.js]- [targetUID: 00000000-00004504] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-tokenized-card\pt-BR\strings.json]- [targetUID: 00000000-00008100] "runtime.bundle.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "wallet-crypto.html" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "wallet.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00004504] "wallet-drawer.html" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "wallet-drawer.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A] "bnpl.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4504_732552254\bnpl\bnpl.bundle.js.LICENSE.txt]- [targetUID: 00000000-00008100] "mini-wallet.html" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "notification_fast.html" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "bb085fd7ff1c37f7_0" has type "data"- [targetUID: N/A] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\Fingerprinting]- [targetUID: 00000000-00003600] "d66fc88fa4410aac_0" has type "data"- [targetUID: N/A] "90f13fe0332b1ec3_0" has type "data"- [targetUID: N/A] "f0bf847b72e9be52_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f0bf847b72e9be52_0]- [targetUID: 00000000-00004504] "99fcc45af9bdb7c3_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\99fcc45af9bdb7c3_0]- [targetUID: 00000000-00004504] "ab833005514b90ae_0" has type "data"- [targetUID: N/A] "bf28156a9f893413_0" has type "data"- [targetUID: N/A] "6ded268f137f0645_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\6ded268f137f0645_0]- [targetUID: 00000000-00004504] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00000192] "tokenized-card.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\4504_732552254\Tokenized-Card\tokenized-card.html]- [targetUID: 00000000-00008100] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00000192] "bnpl.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\4504_732552254\bnpl\bnpl.html]- [targetUID: 00000000-00008100] "shopping.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\4504_674435121\shopping.html]- [targetUID: 00000000-00001776] "0993e4fd7514ce03_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\0993e4fd7514ce03_0]- [targetUID: 00000000-00004504] "load-hub-i18n.bundle.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "tokenized-card.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A] "shopping_fre.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\4504_674435121\shopping_fre.html]- [targetUID: 00000000-00001776] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\Cryptomining]- [targetUID: 00000000-00003600] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\000003.log]- [targetUID: 00000000-00000192] "shimmer.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "c69025f7ccf55c6a_0" has type "data"- [targetUID: N/A] "Advertising" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Advertising]- [targetUID: 00000000-00003600] "hub-signature.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4504_732552254\hub-signature.txt]- [targetUID: 00000000-00008100] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00000192] "wallet_donation_driver.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "wallet-notification-config.json" has type "ASCII text"- Location: [%TEMP%\4504_732552254\json\wallet\wallet-notification-config.json]- [targetUID: 00000000-00008100] "CompatExceptions" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\CompatExceptions]- [targetUID: 00000000-00003600] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG]- [targetUID: 00000000-00000192] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001]- [targetUID: 00000000-00004504] "deny_etld1_domains.list" has type "data"- Location: [%TEMP%\4504_2103180555\deny_etld1_domains.list]- [targetUID: 00000000-00004504] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG]- [targetUID: 00000000-00000192] "554b64473fcc6c6c_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\554b64473fcc6c6c_0]- [targetUID: 00000000-00004504] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log]- [targetUID: 00000000-00000192] "Social" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\Social]- [targetUID: 00000000-00003600] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\LOG]- [targetUID: 00000000-00000192] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00000192] "manifest.webapp.json" has type "UTF-8 Unicode (with BOM) text"- Location: [%TEMP%\4504_732552254\manifest.webapp.json]- [targetUID: 00000000-00008100] "notification_fast.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00006780] "33bd99500895911e_0" has type "data"- [targetUID: N/A] "f658fdd182550cbb_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f658fdd182550cbb_0]- [targetUID: 00000000-00004504] "8c16ae2e374c4303_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8c16ae2e374c4303_0]- [targetUID: 00000000-00004504] "3b9b063938b2e939_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\3b9b063938b2e939_0]- [targetUID: 00000000-00004504] "7faaeb6d807041bb_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7faaeb6d807041bb_0]- [targetUID: 00000000-00004504] "42ce332cdbe9fa73_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42ce332cdbe9fa73_0]- [targetUID: 00000000-00004504] "40701b42ebc1cb18_0" has type "data"- [targetUID: N/A] "49d0896e54e4faca_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\49d0896e54e4faca_0]- [targetUID: 00000000-00004504] "4b1691c2d8c552f5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4b1691c2d8c552f5_0]- [targetUID: 00000000-00004504] "2556f6e9598d5fb0_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2556f6e9598d5fb0_0]- [targetUID: 00000000-00004504] "4945a7b4b1e84510_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4945a7b4b1e84510_0]- [targetUID: 00000000-00004504] "42f4c516cc7fb026_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\42f4c516cc7fb026_0]- [targetUID: 00000000-00004504] "ee9a8283c80e3e52_0" has type "data"- [targetUID: N/A] "9e35b0c2ae3dcde4_0" has type "data"- [targetUID: N/A] "7a9bea57b8cf5f41_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7a9bea57b8cf5f41_0]- [targetUID: 00000000-00004504] "7b95d65eb18c490e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7b95d65eb18c490e_0]- [targetUID: 00000000-00004504] "ebcedc747b584a9b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ebcedc747b584a9b_0]- [targetUID: 00000000-00004504] "ac9537cd8ef7244a_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ac9537cd8ef7244a_0]- [targetUID: 00000000-00004504] "22a1dfae96f6cc61_0" has type "data"- [targetUID: N/A] "8d5e1c410a09c25f_0" has type "data"- [targetUID: N/A] "d3776b2d341e7614_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d3776b2d341e7614_0]- [targetUID: 00000000-00004504] "0fe2e0c1a33ed442_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\0fe2e0c1a33ed442_0]- [targetUID: 00000000-00004504] "4375vtb45tv8225nv4285n2.txt" has type "ASCII text"- Location: [%TEMP%\4375vtb45tv8225nv4285n2.txt]- [targetUID: 00000000-00007112] "app-setup.js" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\app-setup.js]- [targetUID: 00000000-00008100] "regex_patterns.json" has type "JSON data"- Location: [%TEMP%\4504_1548228785\regex_patterns.json]- [targetUID: 00000000-00004504] "manifest.json" has type "JSON data"- [targetUID: 00000000-00001776] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Fingerprinting]- [targetUID: 00000000-00003600] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\4504_1330060161\manifest.json]- [targetUID: 00000000-00001776] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\4504_950463935\manifest.json]- [targetUID: 00000000-00001776] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\4504_674435121\manifest.json]- [targetUID: 00000000-00001776] "manifest.json" has type "JSON data"- Location: [%TEMP%\4504_2055628990\manifest.json]- [targetUID: 00000000-00001776] "Analytics" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Analytics]- [targetUID: 00000000-00003600] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\4504_732552254\manifest.json]- [targetUID: 00000000-00001776] "crypto.bundle.js" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\crypto.bundle.js]- [targetUID: 00000000-00008100] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00004504] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\4504_1548228785\manifest.json]- [targetUID: 00000000-00001776] "manifest.json" has type "JSON data"- Location: [%TEMP%\4504_1633267847\manifest.json]- [targetUID: 00000000-00001776] "manifest.json" has type "JSON data"- Location: [%TEMP%\4504_1987952334\manifest.json]- [targetUID: 00000000-00001776] "ef244baa-648d-401e-87be-d9b4cf280e73.tmp" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ef244baa-648d-401e-87be-d9b4cf280e73.tmp]- [targetUID: 00000000-00005876] "TransparentAdvertisers" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\TransparentAdvertisers]- [targetUID: 00000000-00003600] "README.md" has type "ASCII text"- [targetUID: N/A] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00004504] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log]- [targetUID: 00000000-00000192] "Other" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Other]- [targetUID: 00000000-00003600] "manifest.fingerprint" has type "ASCII text with no line terminators"- [targetUID: 00000000-00004504] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_2103180555\manifest.fingerprint]- [targetUID: 00000000-00004504] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\manifest.fingerprint]- [targetUID: 00000000-00004504] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_1548228785\manifest.fingerprint]- [targetUID: 00000000-00004504] "LICENSE" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_2055628990\Sigma\LICENSE]- [targetUID: 00000000-00003600] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_674435121\manifest.fingerprint]- [targetUID: 00000000-00004504] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_2055628990\manifest.fingerprint]- [targetUID: 00000000-00004504] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_950463935\manifest.fingerprint]- [targetUID: 00000000-00004504] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_1330060161\manifest.fingerprint]- [targetUID: 00000000-00004504] "000012.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000012.log]- [targetUID: 00000000-00004504] "manifest.json" has type "JSON data"- Location: [%TEMP%\4504_1170222786\manifest.json]- [targetUID: 00000000-00001776] ".ses" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "app-setup.js" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\Wallet-Checkout\app-setup.js]- [targetUID: 00000000-00008100] "Content" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Content]- [targetUID: 00000000-00003600] "Other" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Mu\Other]- [targetUID: 00000000-00003600] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\4504_2055628990\Sigma\Cryptomining]- [targetUID: 00000000-00003600] "Last Version" has type "ASCII text with no line terminators"- [targetUID: N/A] "deny_domains.list" has type "data"- Location: [%TEMP%\4504_2103180555\deny_domains.list]- [targetUID: 00000000-00004504] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\json\i18n-notification\zh-Hant\strings.json]- [targetUID: 00000000-00008100] "2126856a-244e-4149-b969-661c214f81f8.tmp" has type "very short file (no magic)"- [targetUID: N/A] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1]- [targetUID: 00000000-00004504] "8acb8e1a-ef61-4fd7-aad1-98b98388eeb1.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8acb8e1a-ef61-4fd7-aad1-98b98388eeb1.tmp]- [targetUID: 00000000-00004504] "70ba8c05-b5af-4533-b6fd-5b67ba15b5c8.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "LICENSE" has type "ASCII text with CRLF line terminators"- [targetUID: 00000000-00003600] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-notification-shared\fr\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "JSON data"- Location: [%TEMP%\4504_732552254\json\i18n-mobile-hub\fr-CA\strings.json]- [targetUID: 00000000-00008100] "notification.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A] "miniwallet.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4504_732552254\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt]- [targetUID: 00000000-00004504] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\json\i18n-notification\pt-BR\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "ASCII text with no line terminators"- [targetUID: 00000000-00008100] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\json\i18n-notification\de\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\json\i18n-notification\fr-CA\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\json\i18n-notification\zh-Hans\strings.json]- [targetUID: 00000000-00008100] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4504_732552254\json\i18n-notification\es\strings.json]- [targetUID: 00000000-00008100]41:T13d5,"5d15eb31-c8ff-4c5c-bd00-351db2d945f0.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 210893" - Location: [%TEMP%\5d15eb31-c8ff-4c5c-bd00-351db2d945f0.tmp] "d0a7100b-aa0b-436d-9d9e-d4069513c536.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 15933" - Location: [%TEMP%\d0a7100b-aa0b-436d-9d9e-d4069513c536.tmp] "72ddd672-5a82-4e5c-8b9e-f0459c8957c0.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\72ddd672-5a82-4e5c-8b9e-f0459c8957c0.tmp] "e40465d3-2fdb-4c99-b229-77f8391a3041.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e40465d3-2fdb-4c99-b229-77f8391a3041.tmp] "731c8d9c-fdf6-4049-94e2-8d89bd1ad212.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\731c8d9c-fdf6-4049-94e2-8d89bd1ad212.tmp] "eae5e574-0fba-400b-bcc0-c38bede27714.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\eae5e574-0fba-400b-bcc0-c38bede27714.tmp] "196cd73a-c93e-4857-bfaa-2ddd04e5f8e2.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\196cd73a-c93e-4857-bfaa-2ddd04e5f8e2.tmp] "5a2e9598-9e9c-45b3-bc93-aee1d3881628.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5a2e9598-9e9c-45b3-bc93-aee1d3881628.tmp] "5c7f98c9-ae41-4dc1-8d51-4739ed458d0e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5c7f98c9-ae41-4dc1-8d51-4739ed458d0e.tmp] "f2fa45e0-1043-4a93-8174-bb974e50169f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\f2fa45e0-1043-4a93-8174-bb974e50169f.tmp] "5681ccd6-7efb-4675-a08a-fdf288c9286c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5681ccd6-7efb-4675-a08a-fdf288c9286c.tmp] "f4aaafc3-b423-4dbd-9689-0f3c56d8875d.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\f4aaafc3-b423-4dbd-9689-0f3c56d8875d.tmp] "cc3ddb19-9903-4bba-9625-7c010bd92f5f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\cc3ddb19-9903-4bba-9625-7c010bd92f5f.tmp] "5731a8cb-8d7a-4394-9786-b25f426d59d6.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5731a8cb-8d7a-4394-9786-b25f426d59d6.tmp] "cafbafc8-1cdd-457c-8eb1-20f5b5646b8b.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cafbafc8-1cdd-457c-8eb1-20f5b5646b8b.tmp] "5d67e0ef-45bd-44c4-88fb-fe9446313c76.tmp" has type "ASCII text with very long lines with no line terminators" "84ca3a8c-5f1b-4b36-82e2-b7c1289c1c79.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\84ca3a8c-5f1b-4b36-82e2-b7c1289c1c79.tmp] "bb08466f-d108-4bbf-ae89-47daf2fc3f92.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\bb08466f-d108-4bbf-ae89-47daf2fc3f92.tmp] "81bbec18-ce61-4431-b846-572ac655b4f0.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\81bbec18-ce61-4431-b846-572ac655b4f0.tmp] "bbd32e54-12f5-4f51-949e-8124b43825fe.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\bbd32e54-12f5-4f51-949e-8124b43825fe.tmp] "7503b98a-390e-4bb8-bc6c-96cfce8ed8f9.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\7503b98a-390e-4bb8-bc6c-96cfce8ed8f9.tmp] "6ec694cd-05d6-4a18-bcbf-8d2a370afd5c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6ec694cd-05d6-4a18-bcbf-8d2a370afd5c.tmp] "f4e8b87c-7c82-44e7-9ed6-2526b7b044ad.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f4e8b87c-7c82-44e7-9ed6-2526b7b044ad.tmp] "93cb4f73-bb05-4a6d-8746-a1f9f45f9a10.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\93cb4f73-bb05-4a6d-8746-a1f9f45f9a10.tmp] "42a68f42-15cd-4290-a37c-c58c1d55aa01.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\42a68f42-15cd-4290-a37c-c58c1d55aa01.tmp]42:T7d6,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")43:Tf69,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "NEAS.0632C5DA568E3550AEC7DEA9AC3C56E7D8A0AA14780B4593E4CEEA48C66F176DEXE"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")44:T559,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"45:T4f4,"AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "5pS9Jb7.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "5pS9Jb7.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"46:Td5a,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\OS1NK65.EXE" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5PS9JB7.EXE" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\PO8ZD98.EXE" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4RS071WV.EXE" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\TW8HY11.EXE" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3IE42OJ.EXE" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CABINET.DLL" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VERSION.DLL" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FLTLIB.DLL" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1IP71JL3.EXE" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2YA8791.EXE" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"47:T8f0,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\NEAS.0632C5DA568E3550AEC7DEA9AC3C56E7D8A0AA14780B4593E4CEEA48C66F176DEXE.LOCAL" "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\OS1NK65.EXE.LOCAL" "OS1Nk65.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\PO8ZD98.EXE.LOCAL" "Po8zD98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\TW8HY11.EXE.LOCAL" "Tw8HY11.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1IP71JL3.EXE.CONFIG" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1IP71JL3.EXE.LOG" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "1IP71jL3.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"48:T92b,Observed string: ""curlbible.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlcandi.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curldaze.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curldefinition.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlflip.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlfriendcollective.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlfrodisiac.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlkalon.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlmix.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curls.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlsandpotions.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlsdynasty.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlsmith.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlsnolye.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlsofcolor.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlsponge.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curltastic.co"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlyair.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlycupcakes.ca"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlygirlboutique.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlygirlzcandy.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlyheaven.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlykisses.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlyshayco.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json Observed string: ""curlyshiny.com"," (Indicator: ""curl") in Source: wallet-pre-stable.json49:T642,file/memory contains long string with (Indicator: "githubusercontent.com"; File: "History") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "000003.log") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "4354c442-b95b-4c89-b1bf-f0c00e1902e1.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "4354c442-b95b-4c89-b1bf-f0c00e1902e1.tmp") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "c714054d-a678-411f-b4b8-dc2efc0c1205.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "c714054d-a678-411f-b4b8-dc2efc0c1205.tmp") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "23dcf968-7676-4363-8a17-e42018b9a48e.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "23dcf968-7676-4363-8a17-e42018b9a48e.tmp") file/memory contains long string with (Indicator: "drive.google.com"; File: "Content") file/memory contains long string with (Indicator: "docs.google.com"; File: "Content") file/memory contains long string with (Indicator: "script.google.com"; File: "Content") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpsaccounts.google.com") file/memory contains long string with (Indicator: ".googleapis.com"; File: "wallet-pre-stable.json") Found string ""maps.googleapis.com"," (Indicator: ".googleapis.com"; File: "wallet-pre-stable.json") file/memory contains long string with (Indicator: ".googleapis.com"; File: "wallet-stable.json")4a:T770,Observed email domain:"n(mx.qg" [Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe] Observed email domain:""colourpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""aepop.net"," [Source: wallet-pre-stable.json] Observed email domain:""artpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""avenuepop.com"," [Source: wallet-pre-stable.json] Observed email domain:""bassettbmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""canvasmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""drinkolipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""fashionfunpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""fastandloosebmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""flitebmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""fofopop.com"," [Source: wallet-pre-stable.json] Observed email domain:""gellipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""gforcemx.com"," [Source: wallet-pre-stable.json] Observed email domain:""happipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""hauzofpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""hiccapop.com"," [Source: wallet-pre-stable.json] Observed email domain:""hijabipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""jellypop.la"," [Source: wallet-pre-stable.json] Observed email domain:""kinkbmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""kloudkpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""knitpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""kpop.exchange"," [Source: wallet-pre-stable.json] Observed email domain:""laperlamx.com"," [Source: wallet-pre-stable.json] Observed email domain:""lovepop.com"," [Source: wallet-pre-stable.json]4b:T350e,Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "D~.CU" Heuristic match: "ug.nG" Heuristic match: "7.SO" Pattern match: "xc.p3s.xj/k#8b[-YB![P;l" Pattern match: "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AYZoVhcJ45uxjOl6frSe2Jhg_f70d5VdPqzDeWk5pfuq-6jPkm7vTux4QNtGyvkEpW3a7FTc2H5VCgSign" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531edge://settings/profileskeygjgieestate_{edge://settingsedge://settings/edge://settings/?search=smartkeygr10nmstate_{edge://settingsedge://settings/?search=smartedge" Pattern match: "edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_etree_light.png/1.1.9/asset2caf0cf4-ea42-4083-b928-29b39da1182bhttps://edgeassetservice.azureedge.net/assets/edge_hub_apps_dall_e_light.png/1.0.11/asset64be4f9b-3b81-4b6e-b354-0ba00d6ba485https://" Pattern match: "https://ntp.www.office.com&_https://ntp.msn.comCookieSyncExpiry'_https://ntp.msn.comDefaultFeedPolicy_https://ntp.msn.comGpuExist/_https://ntp.msn.comNOTIFICATION_CACHE_LS_KEY_https://ntp.msn.combkgdV+_https://ntp.msn.combreakingNewsDismissed" Pattern match: "www.clarity.msCLIDv10" Pattern match: "www.facebook.com/loginhttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AYZoVhfgPpHNK7W8M0c5tWTAWQWTC-ZeuXEKsZi8mHMOQmgI74WXbooC_ozf3Wwko-nTfXe9r-jlkw&passive=1" Pattern match: "csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signersn([]httpswww.google.comstatic-on-bigtablehttps://csp.withgoogle.com/csp/report-to/static-on-bigtables'[]httpswww.facebook.comdefaulthttps://www.facebook.com/ajax/browser_error_reports/?d" Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-A" Pattern match: "https://chrome.google.com/webstore},urls:[https://chrome.google.com/webstore]},description:Discover" Pattern match: "avocet.io/aprecision.net/adpdealerservices.com/nuffnang.com.my/demdex.net/augur.io/cmmeglobal.com/adrolays.com/atrinsic.com/acuityads.com/wishabi.net/admedia.com/vertamedia.com/adworx.at/2leep.com/globe7.com/awaps.yandex.ru/i-behavior.com/reklamstore.com/m" Pattern match: "https://github.com/easylist" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://www.coupert.com" Pattern match: "https://www.facebook.com/loginLog" Pattern match: "https://www.bestbuy.com/site/help-topics/price-match-guarantee/pcmcat290300050002.c?id=pcmcat290300050002},costco.com:{policyDays:30,supportPageUrl:https://customerservice.costco.com/app/answers/detail/a_id/628/~/price-adjustment---costco.com-orders,u" Pattern match: "http://www.w3.org/2000/svg,svg" Pattern match: "https://ntp.msn.com/REG:https://ntp.msn.com/https://ntp.msn.com/edge/ntp.https://ntp.msn.com/edge/ntp/service-worker.js" Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U" Pattern match: "https://www.facebook.com/loginhttps://www.facebook.com/loginhttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AYZoVhfgPpHNK7W8M0c5tWTAWQWTC-ZeuXEKsZi8mHMOQmgI74" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "google.as/cambio.com/chrome.google.com/theboombox.com/baynote.com/aolanswers.com/tidaltv.com/disqus.com/heyzap.com/google.com.au/google.co.id/google.kg/google.co.ve/google.nr/yahoo.com/autoblog.com/feedproxy.google.com/s-msn.com/mandatory.com/noisecreep.co" Pattern match: "cmail26.com/indexww.com/mkt5654.com/snapchat.com/mgid.com/zendable.com/mkt3798.com/adsafety.net/technical-service.net/hybrid.ai/contentsquare.net/mkt32.net/helpscout.net/admanmedia.com/mkt8756.com/dmxleo.com/mkt9430.com/basis.net/mailstat.us/mkt7832.com/bf" Pattern match: "acxiom.com/atinternet.com/hitslink.com/mm7.net/go-mpulse.net/retailautomata.com/free-pagerank.com/amplitude.com/i-stats.com/dl-rms.com/enquisite.com/p.brsrvr.com/onestat.com/lyris.com/alexametrics.com/inboundwriter.com/awio.com/betssonpalantir.com/xiti.com" Pattern match: "autofill.account.microsoft.com/,type" Pattern match: "emaillabs.co/open.mkt4477.com/open.mkt10008.com/open.mkt6917.com/open.mkt1946.com/convertkit-mail5.com/social-tracker.msedgedemo.example/open.mkt8062.com/open.mkt8008.com/open.mkt6316.com/m3651.net/open.mkt6793.com/open.mkt3838.com/open.mkt4158.com/eds5.ma" Pattern match: "www.microsoft365.com" Pattern match: "jedwatson.github.io/classnames" Pattern match: "https://github.com/focus-trap/tabbable/blob/master/LICENSE" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63," Pattern match: "ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.s" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAk" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1" Pattern match: "https://github.com/jsstyles/css-vendor" Pattern match: "anybest.site/webmine.pro/jsecoin.com/flightzy.bid/nerohut.com/flightsy.bid/coinpot.co/yololike.space/flightzy.win/zymerget.bid/bitcoin-pay.eu/freecontent.stream/authedwebmine.cz/zymerget.faith/hostingcloud.racing/mineralt.io/dinorslick.icu/coinhive.com/bms" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/ck=boq-identity.AccountsSignInUi.h054YajHleE.L.W.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEml" Pattern match: "ufpcdn.com/vdx.tv/ebaystatic.com/ad4m.at/00px.net/warumbistdusoarm.space/ownpage.fr/smct.io/ansira.com/photorank.me/fengkongcloud.com/vtex.com.br/vocento.com/ie8eamus.com/flocktory.com/justpremium.com/dynata.com/stripst.com/adskeeper.com/curalate.com/vptms" Pattern match: "auth.adobe.com/^/horizonte.browserapps.amazon.com/^/horizonte.browserapps.amazon.de/^/horizonte.browserapps.amazon.ca/^/acrobatservices.adobe.com/^/signin.aws.amazon.com/^/horizonte-browserapps.amazon.com.br/^/zendesk.com/^/my.salesforce.com/^/disqus.com/^" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/am=DoCfiInHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEWxJh2X2eTkMcHjarL7EJ8Tp6etA/m=_b,_tp" Pattern match: "mail.google.com/apps.fbsbx.com/fb.com/developers.google.com/friendfeed.com/social-tracker.msedgedemo.example/googlemail.com/facebook.com/plus.google.com/fbsbx.com/voice.google.com/facebook.de/facebook.fr/wave.google.com/twimg.com/orkut.com/twitter.jp/gmail" Pattern match: "assets.db/MANIFEST-0000012023/10/08-13:58:00.788" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yn/l/en_US/WW_dM8tCcty.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3iqES4/yQ/l/en_US/riV0sq4fGtL.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yj/r/5ZTMade4JZA.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yi/r/K1u8FojW_L0.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yd/r/D8yA-TXiNuk.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yo/r/j5B70NmINXl.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yF/r/FLJXkx8ys-6.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yI/r/8iBPf52GdU5.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yn/r/FQIPxzEyFvX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yk/r/kg_LcWkMBGy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ym/r/R_qswDMOLWA.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ys/r/_f5wO_K1viW.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yF/r/gb_2sOlx922.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yr/r/6XlDJXhMTmo.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yb/r/X98p6omdveu.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yA/r/gYsh5OsZKde.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "http://5.42.92.211/2023-10-08" Pattern match: "zadn.vn/ansira.com/fcmatch.google.com/origo.hu/fcmatch.youtube.com/refersion.com/flocktory.com/vtex.com.br/rqtrk.eu/vocento.com/fingerprinter.msedgedemo.example/" Pattern match: "gimbal.com/thirdwatch.ai/fndrsp.net/analytics-tracker.msedgedemo.example/cuebiq.com/inrix.com/zoominfo.com/clarity.ms/" Pattern match: "microsoftedgeinsider.com/Fabrikam^microsoftedgeinsider.com/VanArsdel^microsoftedgeinsider.com/" Pattern match: "fcmatch.youtube.com/fcmatch.google.com/other-tracker.msedgedemo.example/" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "play.google.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "Math.PI/180,grad:Math.PI/200,rad:1,turn:2*Math.PI},turn:{deg:1/360,grad:1/400,rad:.5/Math.PI,turn:1},s:{s:1,ms:.001},ms:{s:1e3,ms:1},Hz:{Hz:1,kHz:1e3},kHz:{Hz:.001,kHz:1},dpi:{dpi:1,dpcm:1/2.54,dppx:1/96},dpcm:{dpi:2.54,dpcm:1,dppx:2.54/96},dppx:{dpi:96,dp" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://github.com/microsoft/fast/issues/5848\n" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.itxXp8cph_Q.L.B1.O/am=DoCfiJnHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/ed=1/rs=AOaEmlHWGNRLnwyFXvV3t6JmKckErWLe_Q/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.5Bikz2SRVqI.es5.O/am=DoCfiJnHBkD808T5e8bJYQAAAAAAAAAAgDWQHQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGz13KoY8w4veCAVSzCDSLSfnEmvA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "www.klarna.com" Pattern match: "www.transunion.com" Pattern match: "www.googletagmanager.com" Pattern match: "www.googleadservices.com" Pattern match: "https://accounts.google.com" Pattern match: "http://www.w3.org/2001/XMLSchema-instance"4c:T811,"OS1Nk65.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002512) "OS1Nk65.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002512) "Po8zD98.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00006556) "Po8zD98.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006556) "Tw8HY11.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00007420) "Tw8HY11.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007420) "1IP71jL3.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007500) "1IP71jL3.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007500)4d:T92a,file/memory contains long string with (Indicator: "base64"; File: "wallet-icon.svg") file/memory contains long string with (Indicator: "base64"; File: "Web Data") file/memory contains long string with (Indicator: "aes"; File: "wallet-tokenization-config.json") file/memory contains long string with (Indicator: "aes"; File: "strings.json") file/memory contains long string with (Indicator: "aes"; File: "driver-signature.txt") file/memory contains long string with (Indicator: "aes"; File: "4354c442-b95b-4c89-b1bf-f0c00e1902e1.tmp") file/memory contains long string with (Indicator: "aes"; File: "c714054d-a678-411f-b4b8-dc2efc0c1205.tmp") file/memory contains long string with (Indicator: "aes"; File: "23dcf968-7676-4363-8a17-e42018b9a48e.tmp") file/memory contains long string with (Indicator: "aes"; File: "bb085fd7ff1c37f7_0") file/memory contains long string with (Indicator: "aes"; File: "d66fc88fa4410aac_0") file/memory contains long string with (Indicator: "aes"; File: "90f13fe0332b1ec3_0") file/memory contains long string with (Indicator: "aes"; File: "f0bf847b72e9be52_0") file/memory contains long string with (Indicator: "aes"; File: "99fcc45af9bdb7c3_0") file/memory contains long string with (Indicator: "aes"; File: "ab833005514b90ae_0") file/memory contains long string with (Indicator: "aes"; File: "bf28156a9f893413_0") file/memory contains long string with (Indicator: "aes"; File: "6ded268f137f0645_0") file/memory contains long string with (Indicator: "aes"; File: "0993e4fd7514ce03_0") file/memory contains long string with (Indicator: "aes"; File: "c69025f7ccf55c6a_0") Found string "{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}" (Indicator: "aes"; File: "ef244baa-648d-401e-87be-d9b4cf280e73.tmp") Found string ""403designs.com"," (Indicator: "3des"; File: "wallet-pre-stable.json") Found string ""8bitaesthetics.com"," (Indicator: "aes"; File: "wallet-pre-stable.json") Found string ""acceleratedaesthetics.shop"," (Indicator: "aes"; File: "wallet-pre-stable.json") Found string ""aesajewelry.com"," (Indicator: "aes"; File: "wallet-pre-stable.json") Found string ""aesbowco.com"," (Indicator: "aes"; File: "wallet-pre-stable.json") Found string ""aeshaafricanbaskets.com"," (Indicator: "aes"; File: "wallet-pre-stable.json")4e:T627,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1IP71jL3.exe.2601628960") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "1IP71jL3.exe.2601628960") Found reference to API "Module32First" (Indicator: "Module32First"; File: "1IP71jL3.exe.2601628960") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "1IP71jL3.exe.2601628960") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "1IP71jL3.exe.2601628960") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1IP71jL3.exe.2601628960") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")4f:T54c,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "N="RegOpenKeyExW"/>" (Indicator: "RegOpenKey"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")50:T996,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")51:T47a,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "1IP71jL3.exe.2601628960") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "1IP71jL3.exe.2601628960") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")52:T9d3,file/memory contains long string with (Indicator: "password"; File: "shimmer.js") Found string ""MEANINGFUL_NAME": { "en": [ { "positive_pattern": "^(((field|input)(_|-)?\\d+)|.*captcha.*|(security|access).*code|one.*time.*password)$|(_|-|^)+otp+(_|-)?" } ]" (Indicator: "password"; File: "regex_patterns.json") Found string ""victoriassecret.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""airmidbeautysecrets.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""amirasecretscosmedic.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""aphroditessecret.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""beautysecretscosmetics.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""beautysecretsusa.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""bellessecrets.org"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""bestkeptsecret.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""chicsecretsjewelry.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""cinemasecrets.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""daintysecrets.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""danassecretcloset.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""dbeautysecrets.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""desirablesecrets.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""dirtysecret.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""eastafricansecrets.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""fantasyandsecret.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""godivassecretwigs.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""herhiddensecrets.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""herlittlesecretcollection.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""honeysnailsecret.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""humboldtssecretsupplies.com"," (Indicator: "secret"; File: "wallet-pre-stable.json") Found string ""kinkysecretsbeauty.com"," (Indicator: "secret"; File: "wallet-pre-stable.json")53:T619,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002512.00000000.68149.01131000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002512.00000000.68149.01131000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")54:T72b,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002512.00000000.68149.00420000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002512.00000000.68149.0113A000.00000002.mdmp")55:Tc43,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: OS1Nk65.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: OS1Nk65.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: OS1Nk65.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: OS1Nk65.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: OS1Nk65.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Po8zD98.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Po8zD98.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Po8zD98.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Po8zD98.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Po8zD98.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Tw8HY11.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Tw8HY11.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Tw8HY11.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Tw8HY11.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Tw8HY11.exe]56:Tfec,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\OS1NK65.EXE"; Value: "") "NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\5PS9JB7.EXE"; Value: "") "OS1Nk65.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\PO8ZD98.EXE"; Value: "") "OS1Nk65.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\4RS071WV.EXE"; Value: "") "Po8zD98.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\TW8HY11.EXE"; Value: "") "Po8zD98.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3IE42OJ.EXE"; Value: "") "Tw8HY11.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1IP71JL3.EXE"; Value: "") "Tw8HY11.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2YA8791.EXE"; Value: "") "2ya8791.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "2ya8791.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")57:T7bf,""4amscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""6whiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""99centsubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""allieandmickey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""alteregoscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""annabelbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com") ""aspirefashionscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""augustbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com") ""bananasmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""baseballmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""beautiiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""beautyandwhiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""bellagracehealthscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""belleandbubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""beyondblessedscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""blingbykey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""boosted-luckey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""bowlingmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""burgeonbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com") ""busybeescrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""cabbagekey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""coatsandscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""codenxtscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""cognitiontsscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""concreterosescrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")58:T4be,"4rs071Wv.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4rs071Wv.exe]- [targetUID: 00000000-00002512] "2ya8791.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2ya8791.exe]- [targetUID: 00000000-00007476] "OS1Nk65.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\OS1Nk65.exe]- [targetUID: 00000000-00002512] "3Ie42Oj.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3Ie42Oj.exe]- [targetUID: 00000000-00006556] "Po8zD98.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\Po8zD98.exe]- [targetUID: 00000000-00002512] "Tw8HY11.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\Tw8HY11.exe]- [targetUID: 00000000-00006556] "1IP71jL3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1IP71jL3.exe]- [targetUID: 00000000-00007420] "5pS9Jb7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5pS9Jb7.exe]- [targetUID: 00000000-00004884]59:Tf13,Dropped file: "1IP71jL3.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1IP71jL3.exe.log]- [targetUID: 00000000-00007500] Dropped file: "data_3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00004504] Dropped file: "data_2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00005876] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00004504] Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00004504] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00000192] Dropped file: "f_0004c9" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00005876] Dropped file: "000014.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00004504] Dropped file: "load_statistics.db" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db]- [targetUID: 00000000-00004504] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00004504] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00004504] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00004504] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00004504] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00004504] Dropped file: "History" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00000512] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00004504] Dropped file: "Web Data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00004504] Dropped file: "Visited Links" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00004504] Dropped file: "Tabs_13341272288118729" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13341272288118729]- [targetUID: 00000000-00004504] Dropped file: "72ddd672-5a82-4e5c-8b9e-f0459c8957c0.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\72ddd672-5a82-4e5c-8b9e-f0459c8957c0.tmp]- [targetUID: 00000000-00004504] Dropped file: "f_0004c8" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00005876] Dropped file: "e40465d3-2fdb-4c99-b229-77f8391a3041.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e40465d3-2fdb-4c99-b229-77f8391a3041.tmp]- [targetUID: 00000000-00004504] Dropped file: "731c8d9c-fdf6-4049-94e2-8d89bd1ad212.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\731c8d9c-fdf6-4049-94e2-8d89bd1ad212.tmp]- [targetUID: 00000000-00004504] Dropped file: "eae5e574-0fba-400b-bcc0-c38bede27714.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\eae5e574-0fba-400b-bcc0-c38bede27714.tmp]- [targetUID: 00000000-00004504] Dropped file: "196cd73a-c93e-4857-bfaa-2ddd04e5f8e2.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\196cd73a-c93e-4857-bfaa-2ddd04e5f8e2.tmp]- [targetUID: 00000000-00004504]5a:T559,"NEAS.0632c5da568e3550aec7dea9ac3c56e7d8a0aa14780b4593e4ceea48c66f176dexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "OS1Nk65.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Po8zD98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Tw8HY11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1IP71jL3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1IP71jL3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2ya8791.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3Ie42Oj.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4rs071Wv.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "5pS9Jb7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")5b:T4001,"initAft()