24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T434,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 647051600c12… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 647051600c12…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5"],"about":{"@type":"SoftwareApplication","name":"BANDIZIP-SETUP-STD-X64.exe","applicationCategory":["peexe","executable"],"identifier":"647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":40},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T509,SetUnhandledExceptionFilter@KERNEL32.dll at 7215-2876-00458962 SetUnhandledExceptionFilter@KERNEL32.dll at 7215-4483-0045B73F SetUnhandledExceptionFilter@KERNEL32.dll at 27660-679-004036E1 SetUnhandledExceptionFilter@KERNEL32.dll at 27660-1144-00403BE6 SetUnhandledExceptionFilter@api-ms-win-core-errorhandling-l1-1-0.dll at 32424-1414-00403FFA SetUnhandledExceptionFilter@KERNEL32.dll at 36914-276-00000001400040C0 SetUnhandledExceptionFilter@KERNEL32.dll at 36914-282-00000001400086C4 SetUnhandledExceptionFilter@KERNEL32.dll at 36914-448-00000001400044B4 SetUnhandledExceptionFilter@KERNEL32.dll at 36914-1089-000000014000469C SetUnhandledExceptionFilter@KERNEL32.dll at 40278-412-000000018002FB98 SetUnhandledExceptionFilter@KERNEL32.dll at 40278-414-0000000180022E48 SetUnhandledExceptionFilter@KERNEL32.dll at 40278-1295-0000000180023558 SetUnhandledExceptionFilter@KERNEL32.dll at 61263-608-0000000140007324 SetUnhandledExceptionFilter@KERNEL32.dll at 61263-634-000000014000BC34 SetUnhandledExceptionFilter@KERNEL32.dll at 61263-898-0000000140007848 SetUnhandledExceptionFilter@KERNEL32.dll at 61263-1588-0000000140007A2C SetUnhandledExceptionFilter@KERNEL32.dll at 65045-1681-000000014018E080 SetUnhandledExceptionFilter@KERNEL32.dll at 65045-1813-0000000140192DA026:T7f8,"BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")27:T5e2,"BANDIZIP-SETUP-STD-X64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "BANDIZIP-SETUP-STD-X64.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB")28:T859,Antivirus vendors marked dropped file "RegDll.x86.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "bzshell.x64.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "Arkview.x64.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "Uninstall.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Amsiman.x64.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "lm.x64.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ark.x86.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "RegPackage.x86.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "RegDll.x64.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ark.x86.lgpl.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "webview.x86.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "bdzshl.x64.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ark.x64.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "bz.exe" as clean (type is "PE32+ executable (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "Updater.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ark.x64.lgpl.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "web32.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows")29:T9e5,"BANDIZIP-SETUP-STD-X64.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCSERVER32") "BANDIZIP-SETUP-STD-X64.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "BANDIZIP-SETUP-STD-X64.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\INPROCSERVER32") "BANDIZIP-SETUP-STD-X64.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "BANDIZIP-SETUP-STD-X64.exe" touched "Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\PROGID") "BANDIZIP-SETUP-STD-X64.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "BANDIZIP-SETUP-STD-X64.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID") "BANDIZIP-SETUP-STD-X64.exe" touched "ShellWindows" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\TREATAS") "BANDIZIP-SETUP-STD-X64.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\PROGID") "BANDIZIP-SETUP-STD-X64.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\PROGID") "Bandizip.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "updater.exe" touched "Microsoft Web Browser" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\PROGID") "updater.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS") "updater.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\PROGID") "updater.exe" touched "Browser Application State" (Path: "HKCU\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "updater.exe" touched "JScript Language" (Path: "HKCU\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "Bandizip.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "Bandizip.exe" touched "Sharing Overlay (Private)" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\INPROCSERVER32") "Bandizip.exe" touched "Task Bar Communication" (Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS")2a:T4d7,Spawned process "Bandizip.exe" with commandline "/regmandatoryadmin" (UID: 00000000-00003568) Spawned process "RegDll.x86.exe" with commandline "/regieemulation Bandizip.exe" (UID: 00000000-00004016) Spawned process "RegDll.x86.exe" with commandline "/regieemulation Updater.exe" (UID: 00000000-00002652) Spawned process "RegDll.x86.exe" with commandline "/regieemulation web32.exe" (UID: 00000000-00003720) Spawned process "RegDll.x86.exe" with commandline "/calldll "%PROGRAMFILES%\Bandizip\bdzshl.x86.dll" RegSvr" (UID: 00000000-00001396) Spawned process "RegDll.x64.exe" with commandline "/calldll "%PROGRAMFILES%\Bandizip\bdzshl.x64.dll" RegSvr" (UID: 00000000-00003084) Spawned process "RegDll.x64.exe" with commandline "/addpath "%PROGRAMFILES%\Bandizip\"" (UID: 00000000-00002064) Spawned process "RegDll.x64.exe" with commandline "/removepath "%PROGRAMFILES%\Bandizip\7z"" (UID: 00000000-00003336) Spawned process "Bandizip.exe" with commandline "/setdefaultprogram" (UID: 00000000-00001128) Spawned process "Bandizip.exe" with commandline "/setupiffirst" (UID: 00000000-00002228) Spawned process "updater.exe" with commandline "/nosleep" (UID: 00000000-00001756) Spawned process "Bandizip.exe" (UID: 00000000-00002172)2b:T4d7,Spawned process "Bandizip.exe" with commandline "/regmandatoryadmin" (UID: 00000000-00003568) Spawned process "RegDll.x86.exe" with commandline "/regieemulation Bandizip.exe" (UID: 00000000-00004016) Spawned process "RegDll.x86.exe" with commandline "/regieemulation Updater.exe" (UID: 00000000-00002652) Spawned process "RegDll.x86.exe" with commandline "/regieemulation web32.exe" (UID: 00000000-00003720) Spawned process "RegDll.x86.exe" with commandline "/calldll "%PROGRAMFILES%\Bandizip\bdzshl.x86.dll" RegSvr" (UID: 00000000-00001396) Spawned process "RegDll.x64.exe" with commandline "/calldll "%PROGRAMFILES%\Bandizip\bdzshl.x64.dll" RegSvr" (UID: 00000000-00003084) Spawned process "RegDll.x64.exe" with commandline "/addpath "%PROGRAMFILES%\Bandizip\"" (UID: 00000000-00002064) Spawned process "RegDll.x64.exe" with commandline "/removepath "%PROGRAMFILES%\Bandizip\7z"" (UID: 00000000-00003336) Spawned process "Bandizip.exe" with commandline "/setdefaultprogram" (UID: 00000000-00001128) Spawned process "Bandizip.exe" with commandline "/setupiffirst" (UID: 00000000-00002228) Spawned process "updater.exe" with commandline "/nosleep" (UID: 00000000-00001756) Spawned process "Bandizip.exe" (UID: 00000000-00002172)2c:T44e,The input sample is signed with a certificate issued by "CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US" (SHA1: 7C:8D:1C:32:08:A6:10:75:97:36:68:B9:BB:16:25:88:5D:52:39:A1; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 00:77:90:F6:56:1D:AD:89:B0:BC:D8:55:85:76:24:95:E3:58:F8:A5; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 02:D6:5B:95:E2:83:70:C1:57:00:95:FA:88:F9:23:DD:93:7F:AD:8F; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo RSA Time Stamping CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 95:11:37:10:1D:88:2F:31:BD:51:3F:94:9A:DA:4C:68:AD:8C:08:F5; see report for more information)2d:T795,"RegDll.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "bzshell.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "Arkview.x64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "Uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "Uninstall.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Archive ctime=Thu Nov 18 15:08:22 2021 mtime=Thu Nov 18 15:08:22 2021 atime=Thu Nov 18 05:27:15 2021 length=634400 window=hideshowminimized" "Amsiman.x64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "lm.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "bdzshl.x86.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ark.x86.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RegPackage.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RegDll.x64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "Bandizip.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=0 Archive ctime=Thu Nov 18 15:08:22 2021 mtime=Thu Nov 18 15:08:22 2021 atime=Thu Nov 18 04:20:45 2021 length=3213808 window=hideshowminimized" "ark.x86.lgpl.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "webview.x86.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "bdzshl.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "ark.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "bz.exe" has type "PE32+ executable (console) x86-64 for MS Windows" "Updater.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "ark.x64.lgpl.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"2e:T70a,"BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\SysWOW64\tzres.dll" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bandizip" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bandizip\Bandizip.lnk" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bandizip\Uninstall.lnk" "BANDIZIP-SETUP-STD-X64.exe" touched file "C:\Windows\AppPatch\sysmain.sdb"2f:T1645,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "ggI`8!`.cc" Heuristic match: "l~UvZQ{.kW" Pattern match: "langs.inst/Arabic.lang" Pattern match: "langs.inst/Armenian.lang" Pattern match: "langs.inst/Belarusian.lang" Pattern match: "langs.inst/Bulgarian.langmR" Pattern match: "langs.inst/Catalan.lang" Pattern match: "langs.inst/Croatian.langM" Pattern match: "langs.inst/Czech.lang" Pattern match: "langs.inst/Danish.lang" Pattern match: "langs.inst/Dutch.lang" Pattern match: "langs.inst/English.lang" Pattern match: "langs.inst/Farsi.lang" Pattern match: "langs.inst/Finnish.lang" Pattern match: "langs.inst/French.lang" Pattern match: "langs.inst/German.lang" Pattern match: "langs.inst/Greek.lang" Pattern match: "langs.inst/Hebrew.lang" Pattern match: "langs.inst/Hindi.lang=" Pattern match: "langs.inst/Hungarian.lang" Pattern match: "langs.inst/Indonesian.lang" Pattern match: "langs.inst/Italian.lang" Pattern match: "langs.inst/Italian2.lang" Pattern match: "langs.inst/Japanese.lang" Pattern match: "langs.inst/Kazakh.lang" Pattern match: "langs.inst/Korean.lang" Pattern match: "langs.inst/Kurdish.langM" Pattern match: "langs.inst/Lithuanian.lang" Pattern match: "langs.inst/Norwegian.lang" Pattern match: "langs.inst/Polish.lang" Pattern match: "langs.inst/Portuguese.lang}P" Pattern match: "langs.inst/PortugueseBR.lang" Pattern match: "langs.inst/Romanian.lang" Pattern match: "langs.inst/Russian.lang" Pattern match: "langs.inst/Serbian.languR" Pattern match: "langs.inst/SimpChinese.lang" Pattern match: "langs.inst/Sinhala.lang%" Pattern match: "langs.inst/Slovak.lang" Pattern match: "langs.inst/Slovenian.lang" Pattern match: "langs.inst/Spanish.lang" Pattern match: "langs.inst/Swedish.langM" Pattern match: "langs.inst/Tagalog.lang" Pattern match: "langs.inst/Thai.lang5" Pattern match: "langs.inst/TradChinese.lang" Pattern match: "langs.inst/Turkish.lang" Pattern match: "langs.inst/Ukrainian.lang" Pattern match: "langs.inst/Uyghur.lang" Pattern match: "langs.inst/UyghurLatin.lang" Pattern match: "langs.inst/Uzbek.lang" Pattern match: "langs.inst/Vietnamese.langm" Pattern match: "langs.inst/Bulgarian.lang" Pattern match: "langs.inst/Croatian.lang" Pattern match: "langs.inst/Hindi.lang" Pattern match: "langs.inst/Kurdish.lang" Pattern match: "langs.inst/Portuguese.lang" Pattern match: "langs.inst/Serbian.lang" Pattern match: "langs.inst/Sinhala.lang" Pattern match: "langs.inst/Swedish.lang" Pattern match: "langs.inst/Thai.lang" Pattern match: "langs.inst/Vietnamese.lang" Pattern match: "http://sv.symcb.com/sv.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://sectigo.com/CPS0D" Pattern match: "crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" Pattern match: "crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "https://www.bandisoft.com" Pattern match: "http://s.symcd.com06" Pattern match: "http://s.symcb.com/universal-root.crl0" Pattern match: "https://d.symcb.com/rpa0@" Pattern match: "http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com0" Pattern match: "http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0" Pattern match: "https://log.bandi.so/dump/upload.php" Pattern match: "https://log.bandi.so/error/app.php?name=%s&buildDate=%s&version=%s&log=%s" Pattern match: "log.bandi.so/error/app.php?name=%s&buildDate=%s&version=%s&log=%s" Heuristic match: "ocsp.sectigo.com" Heuristic match: "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDzHc2p4PYe%2BXbRnPTZ8TTX HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com" Heuristic match: "ana.bandi.so" Heuristic match: "log.bandi.so" Heuristic match: "ver.bandi.so" Pattern match: "www.bandisoft.com" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Pattern match: "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsE" Pattern match: "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23" Pattern match: "http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDzHc2p4PYe%2BXbR" Pattern match: "https://go.bandi.so/apptranslation" Heuristic match: "Bandisoft.com" Pattern match: "https://www.bandisoft.com/bandizip/help/" Pattern match: "https://www.bandisoft.com/bandizip/" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" Pattern match: "https://www.bandisoft.com/honeyview/dl.php?bandizip1" Heuristic match: "Bandizip.bz" Heuristic match: "Bandizip.br" Heuristic match: "Bandizip.bh" Heuristic match: "noname.br" Pattern match: "https://code.bandisoft.com/" Pattern match: "https://log.bandi.so/dump/report.php?name=%s&buildDate=%s&version=%s&os=%s¶m=%s&type=crash" Pattern match: "log.bandi.so/dump/upload.php"30:T57d,"RegDll.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "bzshell.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "Arkview.x64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "Uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "Amsiman.x64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "lm.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "bdzshl.x86.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ark.x86.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RegPackage.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RegDll.x64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "ark.x86.lgpl.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "webview.x86.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "bdzshl.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "ark.x64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "bz.exe" has type "PE32+ executable (console) x86-64 for MS Windows" "Updater.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "ark.x64.lgpl.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "web32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"31:T8c4,"RegDll.x86.exe" (Access type: "CREATE"; Path: "HKCU\*\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX") "RegDll.x86.exe" (Access type: "SETVAL"; Path: "HKCU\*\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"; Key: "(DEFAULT)"; Value: "{5B69A6B4-393B-459C-8EBB-214237A9E7AC}"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKCU\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"), "RegDll.x86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"; Key: "(DEFAULT)"; Value: "{5B69A6B4-393B-459C-8EBB-214237A9E7AC}"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX\"), "RegDll.x86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"; Key: "(DEFAULT)"; Value: "{5B69A6B4-393B-459C-8EBB-214237A9E7AC}"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX\"), "RegDll.x86.exe" (Access type: "SETVAL"; Path: "HKCU\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"; Key: "(DEFAULT)"; Value: "{5B69A6B4-393B-459C-8EBB-214237A9E7AC}"), "RegDll.x86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\DRAGDROPHANDLERS\AABDZCTX"; Key: "(DEFAULT)"; Value: "{5B69A6B4-393B-459C-8EBB-214237A9E7AC}"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\DRAGDROPHANDLERS\AABDZCTX\"), "RegDll.x86.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\BACKGROUND\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"; Key: "(DEFAULT)"; Value: "{5B69A6B4-393B-459C-8EBB-214237A9E7AC}"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\BACKGROUND\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX\"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKCU\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"), "RegDll.x86.exe" (Access type: "SETVAL"; Path: "HKCU\DIRECTORY\BACKGROUND\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"; Key: "(DEFAULT)"; Value: "{5B69A6B4-393B-459C-8EBB-214237A9E7AC}"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKCU\DIRECTORY\BACKGROUND\SHELLEX\CONTEXTMENUHANDLERS\AABDZCTX"), "RegDll.x86.exe" (Access type: "CREATE"; Path: "HKCU\DRIVE\SHELLEX\CONTEXTMENUHANDLERS")32:T784,"BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Ark32lgpl.dll" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Ark64lgpl.dll" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\ArkLicense.txt" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Bandizip32.exe" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Bandizip64.exe" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\RegDll32.exe" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\RegDll64.exe" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\resource.h" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\skin.data" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\skina.data" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\skin.zip" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\skina.zip" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\bz.exe" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\unace32.exe" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\unacev2.dll" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Aiview32.exe" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Ark32.dll" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Ark32lgplv2.dll" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Ark64.dll" with delete access "BANDIZIP-SETUP-STD-X64.exe" opened "C:\Program Files\Bandizip\Ark64lgplv2.dll" with delete access33:T8f4,"BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS")34:T8b8,"BANDIZIP-SETUP-STD-X64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Bandizip.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "Bandizip.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "Bandizip.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "Bandizip.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Bandizip.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "updater.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "updater.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "updater.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "updater.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "updater.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")35:T4be,"RegDll.x86.exe" claimed CRC 203032 while the actual is CRC 6568291 "bzshell.x64.dll" claimed CRC 412800 while the actual is CRC 203032 "Arkview.x64.exe" claimed CRC 2676301 while the actual is CRC 412800 "Uninstall.exe" claimed CRC 659152 while the actual is CRC 2676301 "Amsiman.x64.exe" claimed CRC 281837 while the actual is CRC 659152 "lm.x64.dll" claimed CRC 479576 while the actual is CRC 281837 "bdzshl.x86.dll" claimed CRC 475900 while the actual is CRC 479576 "ark.x86.dll" claimed CRC 2233529 while the actual is CRC 475900 "RegPackage.x86.exe" claimed CRC 204725 while the actual is CRC 2233529 "RegDll.x64.exe" claimed CRC 227521 while the actual is CRC 204725 "ark.x86.lgpl.dll" claimed CRC 579449 while the actual is CRC 227521 "webview.x86.dll" claimed CRC 207568 while the actual is CRC 579449 "bdzshl.x64.dll" claimed CRC 549673 while the actual is CRC 207568 "ark.x64.dll" claimed CRC 2540050 while the actual is CRC 549673 "bz.exe" claimed CRC 559142 while the actual is CRC 2540050 "Updater.exe" claimed CRC 954834 while the actual is CRC 559142 "ark.x64.lgpl.dll" claimed CRC 633654 while the actual is CRC 954834 "web32.exe" claimed CRC 280494 while the actual is CRC 63365436:T5a4,RegCreateKeyExW RegDeleteValueW RegCloseKey OpenProcessToken RegOpenKeyExW RegEnumKeyExW RegEnumKeyW RegDeleteKeyW GetFileAttributesW FindResourceExW CopyFileW GetModuleFileNameW IsDebuggerPresent GetModuleFileNameA UnhandledExceptionFilter LoadLibraryExW CreateThread GetSystemDirectoryW ExitThread TerminateProcess CreateToolhelp32Snapshot LoadLibraryW GetTickCount LoadLibraryA GetStartupInfoA GetFileSize GetStartupInfoW CreateDirectoryW DeleteFileW GetTempFileNameW WriteFile GetFileSizeEx FindNextFileW FindFirstFileW GetProcAddress CreateFileW CreateFileA GetSystemInfo FindResourceW Process32NextW LockResource GetCommandLineW Process32FirstW GetModuleHandleA GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos FindWindowW HttpQueryInfoW InternetQueryDataAvailable InternetQueryOptionW InternetWriteFile InternetReadFile HttpSendRequestExW InternetCloseHandle InternetConnectA HttpSendRequestW InternetCrackUrlA InternetOpenW CreateProcessAsUserW OutputDebugStringW GetModuleHandleExW OpenProcess FindFirstFileExW GetCommandLineA CreateFileMappingW GetTickCount64 MapViewOfFile GetWindowThreadProcessId LoadLibraryExA SleepConditionVariableCS OpenFileMappingW DeviceIoControl GetComputerNameW GetDriveTypeW GetVersionExW SleepConditionVariableSRW GetFileAttributesExW VirtualProtect FindWindowExW37:T64a,"BANDIZIP-SETUP-STD-X64.exe" wrote bytes "a0129573" to virtual address "0x7635E324" (part of module "WININET.DLL") "BANDIZIP-SETUP-STD-X64.exe" wrote bytes "7d07887781ed8677ae868577c6e08477effd87772d16867760148877478d8577a8e284776089857700000000ad3711778b2d1177b641117700000000" to virtual address "0x73A61000" (part of module "WSHTCPIP.DLL") "BANDIZIP-SETUP-STD-X64.exe" wrote bytes "0efc877781ed8677ae868577c6e08477effd87772d168677c0fc8377da8f8e7760148877478d8577a8e284776089857700000000ad3711778b2d1177b641117700000000" to virtual address "0x73A71000" (part of module "WSHIP6.DLL") "BANDIZIP-SETUP-STD-X64.exe" wrote bytes "a0129573" to virtual address "0x73604028" (part of module "WEBIO.DLL") "BANDIZIP-SETUP-STD-X64.exe" wrote bytes "71115c007a3b5b00ab8b02007f950200fc8c0200729602006cc805001ecd58007d265800" to virtual address "0x772E07E4" (part of module "USER32.DLL") "BANDIZIP-SETUP-STD-X64.exe" wrote bytes "c0df84771cf98377ccf883770d64857700000000c011cc7600000000fc3ecc7600000000e013cc76000000009457a77625e08477c6e0847700000000bc6aa67600000000cf31cc76000000009319a776000000002c32cc7600000000" to virtual address "0x76BA1000" (part of module "NSI.DLL") "RegDll.x86.exe" wrote bytes "71115c007a3b5b00ab8b02007f950200fc8c0200729602006cc805001ecd58007d265800" to virtual address "0x772E07E4" (part of module "USER32.DLL") "RegDll.x86.exe" wrote bytes "c0df84771cf98377ccf883770d64857700000000c011cc7600000000fc3ecc7600000000e013cc76000000009457a77625e08477c6e0847700000000bc6aa67600000000cf31cc76000000009319a776000000002c32cc7600000000" to virtual address "0x76BA1000" (part of module "NSI.DLL")38:T5dc,"BANDIZIP-SETUP-STD-X64.exe" wrote 32 bytes to a remote process "C:\Program Files\Bandizip\Bandizip.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 52 bytes to a remote process "C:\Program Files\Bandizip\Bandizip.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 4 bytes to a remote process "C:\Program Files\Bandizip\Bandizip.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 8 bytes to a remote process "C:\Program Files\Bandizip\Bandizip.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 52 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x86.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 4 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x86.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 8 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x86.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 32 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x86.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 32 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x64.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 52 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x64.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 4 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x64.exe" (Handle: 1536) "BANDIZIP-SETUP-STD-X64.exe" wrote 8 bytes to a remote process "C:\Program Files\Bandizip\data\RegDll.x64.exe" (Handle: 1536)39:T51e,Spawned process "BANDIZIP-SETUP-STD-X64.exe" (UID: 00000000-00004080) Spawned process "Bandizip.exe" with commandline "/regmandatoryadmin" (UID: 00000000-00003568) Spawned process "RegDll.x86.exe" with commandline "/regieemulation Bandizip.exe" (UID: 00000000-00004016) Spawned process "RegDll.x86.exe" with commandline "/regieemulation Updater.exe" (UID: 00000000-00002652) Spawned process "RegDll.x86.exe" with commandline "/regieemulation web32.exe" (UID: 00000000-00003720) Spawned process "RegDll.x86.exe" with commandline "/calldll "%PROGRAMFILES%\Bandizip\bdzshl.x86.dll" RegSvr" (UID: 00000000-00001396) Spawned process "RegDll.x64.exe" with commandline "/calldll "%PROGRAMFILES%\Bandizip\bdzshl.x64.dll" RegSvr" (UID: 00000000-00003084) Spawned process "RegDll.x64.exe" with commandline "/addpath "%PROGRAMFILES%\Bandizip\"" (UID: 00000000-00002064) Spawned process "RegDll.x64.exe" with commandline "/removepath "%PROGRAMFILES%\Bandizip\7z"" (UID: 00000000-00003336) Spawned process "Bandizip.exe" with commandline "/setdefaultprogram" (UID: 00000000-00001128) Spawned process "Bandizip.exe" with commandline "/setupiffirst" (UID: 00000000-00002228) Spawned process "updater.exe" with commandline "/nosleep" (UID: 00000000-00001756) Spawned process "Bandizip.exe" (UID: 00000000-00002172)3a:Tee5,Assembly shows XOR instruction xor eax esp in Stream UID: 35794-2498-0040F54E Assembly shows XOR instruction xor ecx esp in Stream UID: 35794-2498-0040F54E Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2386-00457719 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2386-00457719 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2370-0040490F Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2370-0040490F Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-3064-0040752E Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2497-0040EF2B Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2497-0040EF2B Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2863-004557EC Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2863-004557EC Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-80-0045C3EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-80-0045C3EE Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-3045-0040739E Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-3045-0040739E Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2857-0045550E Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2857-0045550E Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2267-00406864 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2267-00406864 Assembly shows XOR instruction xor eax esp in Stream UID: 35794-2622-00424E94 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-3104-0040D0E4 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2399-0040E8E3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2399-0040E8E3 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2561-0041AD97 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2561-0041AD97 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2257-00404CF5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2257-00404CF5 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2398-00403F73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2398-00403F73 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2876-00458962 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-3040-00405910 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-3124-0040EF99 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2593-00421D5D Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2593-00421D5D Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2400-004042A7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2400-004042A7 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2854-004543D5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2854-004543D5 Assembly shows XOR instruction xor ecx dword ptr fs:[eax] in Stream UID: 35794-4388-00422646 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 35794-4388-00422646 Assembly shows XOR instruction xor cl byte ptr [eax] in Stream UID: 35794-4388-00422646 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 35794-4388-00422646 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 35794-4388-00422646 Assembly shows XOR instruction xor eax esp in Stream UID: 35794-2282-00407256 Assembly shows XOR instruction xor ecx esp in Stream UID: 35794-2282-00407256 Assembly shows XOR instruction xor eax ebp in Stream UID: 35794-2577-0041CF8A Assembly shows XOR instruction xor ecx ebp in Stream UID: 35794-2577-0041CF8A3b:Ta16,"BANDIZIP-SETUP-STD-X64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000844) "BANDIZIP-SETUP-STD-X64.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000844) "BANDIZIP-SETUP-STD-X64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000844) "BANDIZIP-SETUP-STD-X64.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000844)3c:T4de,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "FindWindow@s" (Indicator: "FindWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "FindWindow@s" (Indicator: "FindWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")3d:T11b40,Observed string: ""WalletECNewCtaDescriptionCashback": "ativar o programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupes automaticamente", "WalletECNewCtaDescriptionFillAddress": "preencha automaticamente as suas informaes de envio", "WalletECNewCtaDescriptionFillDetail": "preencha as suas informaes de envio e fatura "WalletECNewCtaDescriptionFillPayment": "preencher as suas informaes de fatura "WalletECNewCtaDescriptionGiftCard": "utilizar o carto de oferta", "WalletECNewCtaDescriptionTakeToBNPL": "encaminh-lo para $1", "WalletECNewUXErrorMessageForAutofill": "O preenchimento automtico no conseguiu preencher todos os seus detalhes. Introduza-os manualmente para concluir a transao.", "WalletECNewUXErrorMessageForCashback": "No foi possvel aplicar o reembolso sua compra neste momento. Tente novamente mais tarde.", "WalletECNewUXErrorMessageForCoupon": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "WalletECNewUXErrorMessageForGiftCard": "No conseguimos aplicar o seu carto de oferta a esta compra. $1", "WalletECNewUXErrorMessageForGiftCardLink": "Ver o estado do carto de oferta", "WalletECNewUXForNoSuccessMessage": "Pedimos desculpa mas no conseguimos ajudar neste momento", "WalletECNewUXForNoWorkingCoupon": "No encontrmos cupes vlidos", "WalletECNewUXMultiErrorMessageForAutofill": "preenchimento automtico", "WalletECNewUXMultiErrorMessageForCashback": "reembolso", "WalletECNewUXMultiErrorMessageForCoupon": "cupes", "WalletECNewUXMultiErrorMessageForiftCard": "carto de oferta", "WalletECNewUXPartialSuccessMessageForAutofill": "Alguns dos seus detalhes foram preenchidos. Introduza as informaes restantes para concluir a sua compra", "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "J poupou $1 com o melhor cupo e carto de oferta", "WalletECNewUXSuccessMessageForAutofill": "Os detalhes da finalizao da compra foram preenchidos", "WalletECNewUXSuccessMessageForCashback": "Receber $1 de reembolso $2", "WalletECNewUXSuccessMessageForCoupon": "J poupou $1 com o melhor cup "WalletECNewUXSuccessMessageForGiftCard": "J poupou $1 com o carto de oferta" "WalletECSimplifyAutofillSubTitle": "Ativar para utilizar a concluspida" "WalletECSimplifyAutofillTitle": "Detalhes do preenchimento automtico da finalizao da compra" "WalletECUXSimplifyCtaDescriptionSaving": "aplicar poupan "walletBNPLSmallCardBottomMessagePayInFour": "O $1 tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardBottomMessageZip": "O Zip tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardFooterMessage": "A Microsoft no lhe cobra nem paga por estes fornecedores.", "walletBNPLSmallCardTitle": "A compra ser dividida em quatro prestaes", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "A compra pode ser dividida em 4 prestaes", "walletChangeYourSettings": "alterar as definies", "walletDrawerFormPageMicroFeedbackPrompt": "Est contente com a Carteira?", "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplique automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardAutofillFailureTitle": "No foi possvel aplicar automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardRedeemFailureTitle": "No foi possvel resgatar os seus pontos do Rewards como carto de oferta. Pode continuar com a encomenda ou tentar a transao novamente mais tarde.", "walletDrawerGiftCardRedeemMultipleFailureTitle": "Resgate os seus pontos do Rewards como carto de oferta.", "walletECAllFailureMessageBottom": "No se preocupe ainda pode continuar a sua transao.", "walletECAllFailureTitle": "As seguintes funcionalidades no esto disponveis neste momento:", "walletECApplyCashBackTitle": "Reembolso", "walletECApplyCashCackTitle": "Receber $1 em reembolso.", "walletECApplySavingTitle": "Poupar $1 e receber $2 em reembolso.", "walletECAutoApplyApplyingBestCouponsNew": "Aplicando o melhor cupo que encontrmos...", "walletECAutoApplyFailureTitle": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "walletECAutoApplyFeature": "Cupes de teste", "walletECAutoApplyTryingCoupons": "A tentar $1...", "walletECAutofillErrorMessage": "Detalhes da Preenchimento Automtico", "walletECAutofillPaymentOnlySingleErrorMessage": "O preenchimento automtico no conseguiu concluir todos os seus detalhes. Introduza-os manualmente para continuar a sua transao.", "walletECAutofillPaymentOnlySuccessMessage": "Preenchemos automaticamente os seus dados de pagamento para uma finalizapida da compra.", "walletECAvailableRewardsPoints": "$1 pontos disponveis", "walletECCancelCouponButton": "Ignorar cupes", "walletECCancelCouponFooter": "45% dos utilizadores pouparam com cupes", "walletECCancelCouponStatus": "A aplicao de cupes cancelada", "walletECCashBackAndCouponTitle": "Reembolsos e cupes", "walletECCashBackDisplayValue": "At $1", "walletECCashBackEnableErrorMessage": "No foi possvel aplicar o cashback sua compra neste momento. Tente novamente mais tarde.", "walletECCashBackEnableSubErrorMessage": "Ativar cashback", "walletECCashBackInfo": "Receber atualizaes por e-mail e monitorizar os detalhes dos reembolsos em $1.", "walletECCashBackOptionText": "Obter reembolso", "walletECCashBackUpto": "At $1", "walletECCashbackActivateFailedLabel": "No foi possvel ativar o reembolso desta compra. Tente novamente mais tarde.", "walletECCashbackActivateLabel": "Ativar reembolso", "walletECCashbackEnrollDisclaimer": "Ter sesso iniciada no Microsoft Edge que ir fazer uma cpia de segurana dos seus dados de navegao e permitir-lhe ver os seus favoritos palavras-passe histrico e muito mais em todos os seus dispositivos. Tambm ir aderir e receber e-mails sobre o $1 que incluem ofertas sobre produtos de parceiros. $2 | $3", "walletECCashbackLinkLabel": "Ver detalhes da oferta no valor de $1", "walletECCashbackPrivacyLinkLabel": "Privacidade e Cookies", "walletECCashbackSigninLabel": "Aderir agora e ative o reembolso", "walletECCashbackStatus": "Reembolso ativado", "walletECCashbackTermsLinkLabel": "Termos", "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar poupanas e continuar", "walletECContinueSavingsAndFillDetailsLabel": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes automaticamente e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsLabelBNPL": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes e preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Ao continuar ativaremos o programa de reembolsos preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsButtonLabel": "Aplicar poupanas", "walletECContinueSavingsLabel": "Ao continuar iremos ativar o programa de reembolso e aplicar cupes automaticamente.", "walletECContinueSavingsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos.", "walletECCouponAverageSaving": "Em mdia poupou $1", "walletECCouponOptionText": "Utilizar cup "walletECCouponsCookieDisclaimer": "Permito a colocao de $1 no meu dispositivo para ajudar a faturao com o fornecedor do cupo tal como por $2" "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declarao de Privacidade da Microsoft" "walletECEnjoyMessage": "Desfrute do resto do seu percurso de compras." "walletECFillDetailsButtonLabelUXSimplify": "Preencher detalhes" "walletECFreBannerContent": "Encontre as melhores ofertas com cupes e reembolsos, tudo antes de pagar." "walletECFreBannerTitle": "Poupe dinheiro e tempo com a Carteira no Microsoft Edge" "walletECGetCashbackLabel": "Pode obter um reembolso de at $1 em $2." "walletECGiftCardTitle": "Carto de oferta" "walletECManagePersonalInfo": "Gerir informaes pessoais" "walletECMaskedCardDetailFetching": "Introduza o seu CVC para continuar" "walletECMaskedFetchErrorMessage": "Tente novamente e introduza o seu CVC quando lhe for solicitado. Em alternativa, selecione outro mtodo de pagamento para continuar." "walletECNewCtaDescriptionTemplateFive": "Ao continuar, iremos $1, $2, $3, $4 e $5." "walletECNewCtaDescriptionTemplateFour": "Ao continuar, iremos $1, $2, $3 e $4." "walletECNewCtaDescriptionTemplateOne": "Ao continuar, iremos $1." "walletECNewCtaDescriptionTemplateThree": "Ao continuar, iremos $1, $2 e $3." "walletECNewCtaDescriptionTemplateTwo": "Ao continuar, iremos $1 e $2." "walletECNewShippingAddressTitle": "Detalhes do envio" "walletECNewUXErrorMessageTemplateFive": "Os $1, $2, $3, $4 e $5 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateFour": "Os $1, $2, $3 e $4 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateThree": "Os $1, $2 e $3 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateTwo": "Os $1 e $2 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNoSavedAddress": "Sem Endereo Guardado" "walletECNoSavedName": "Nenhum Nome Guardado" "walletECRebatesCouponsSelectorDescription": "Aplicmos as melhores poupanas para si e descobrimos que s pode utilizar uma nesta compra. Selecione uma das opes abaixo para continuar." "walletECRebatesCouponsSelectorTitle": "Selecione um para continuar" "walletECReturnToCheckoutButtonAria": "Fechar o painel e regressar gina de finalizao da compra" "walletECRewardsDonotRedeemOptionPoints": "No resgatar pontos de recompensas" "walletECRewardsNoGiftCardSelected": "Nenhum carto de oferta selecionado" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 pontos" "walletECRewardsRedeemOptionPoints": "$1 pontos" "walletECRewardsRedeemOptionTitle": "Resgatar carto de oferta de $1" "walletECRewardsTitle": "Carto de oferta do Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar poupanas e preencher detalhes" "walletECSavingsDisableMessage": "$1 para ativar o reembolso e aplicar cupes automaticamente. Isto pode poupar-lhe tempo e dinheiro quando fizer compras no Edge." "walletECShoppingInfo": "Est a utilizar cupes e reembolsos de compras da Microsoft." "walletECShoppingInfoForCoupon": "e cupes" "walletECShoppingInfoNew": "Est a utilizar o reembolso de $1 para compras da Microsoft." "walletECSkipCouponProgressStatus": "A ignorar cupes..." "walletECThirdPartyCookies": "cookies de terceiros" "walletECTokenizationCardDetailFetching": "Estamos a estabelecer uma ligao com o seu banco para gerar os detalhes do carto para esta transao. Isto pode demorar alguns segundos." "walletECTokenizationFetchErrorMessage": "N possvel gerar os detalhes do carto virtual. Tente novamente ou escolha outro carto." "walletECUXAffirmDescription": "Dividir pagamentos ao longo de 8 semanas" "walletECUXAffirmDescriptionFinanced": "Compre agora, pague ao longo do tempo com o Affirm." "walletECUXBNPLDropdownTitle": "Pagar ao longo do tempo" "walletECUXCardKlarnaDescription": "Sem taxas de juros, podero aplicar-se taxas de atraso" "walletECUXKlarnaDescription": "Compre agora. Pague ao longo do tempo com a Klarna." "walletECUXManagePaymentButtonTitle": "Gerir mtodos de pagamento" "walletECUXNewAddressDropdownLabel": "Selecionar endereo para envio" "walletECUXNewOnlyCardDropdownTitle": "Pagar com cart "walletECUXNewPaymentDropdownLabel": "Selecionar mtodo de pagamento", "walletECUXNewPaymentDropdownTitle": "Pagar com carto ou pagar ao longo do tempo", "walletECUXSBillingTheSameWithShipAddress": "O endereo de fatura o mesmo que o endereo de envio", "walletECUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletECUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "walletECUXSmallCardAffirmDescription": "Sem taxas de atraso sem juros", "walletECUXSmallCardZipDescription": "Sem impacto na classificao de crdito podero aplicar-se taxas de atraso", "walletECUXZipDescription": "Dividir pagamentos ao longo de 6 semanas", "walletECUXsimplifyBGAANegativeContent": "A Carteira testou todos os cupes mas no encontrou nenhum desconto", "walletECUXsimplifyBGAANegativeTitle": "Tem o melhor pre "walletECUXsimplifyBGAAPostiveCouponContent": "A Carteira testou todos os cupes disponveis" "walletECUXsimplifyBGAAPostiveTitle": "Est a poupar $1" "walletECUXsimplifyCashbackEnrollText": "Obtenha at $1 com o $2" "walletECUXsimplifyCashbackValue": "At $1" "walletECUXsimplifyMutipleCoupon": "$1 cupes" "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar poupan "walletECUXsimplifyShoppingToggleOffCashback": "Ativar o Microsoft Cashback" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Ativar o Microsoft Cashback e aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para poupar tempo e dinheiro quando faz compras online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Ativar as compras no Microsoft Edge" "walletECUXsimplifyStandardCouponContent": "Poupandia: $1 em $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "A Carteira encontrar a melhor oferta para si" "walletECUXsimplifyStandardCouponTitle": "$1 ser testado" "walletSelectString": "$1 ou $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""WalletECNewCtaDescriptionCashback": "activar el programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupones automticamente", "WalletECNewCtaDescriptionFillAddress": "autorrellenar la informacin de env "WalletECNewCtaDescriptionFillDetail": "rellene la informacin de envo y facturaci "WalletECNewCtaDescriptionFillPayment": "rellene la informacin de facturaci "WalletECNewCtaDescriptionGiftCard": "canjear la tarjeta de regalo" "WalletECNewCtaDescriptionTakeToBNPL": "llevarle a $1" "WalletECNewUXErrorMessageForAutofill": "El autorrellenado no pudo completar todos los detalles. Solo tiene que escribirlos manualmente para completar la compra." "WalletECNewUXErrorMessageForCashback": "No se ha podido aplicar la devolucin de dinero a la compra en este momento. Intntelo de nuevo ms tarde." "WalletECNewUXErrorMessageForCoupon": "La prueba de cupones no est disponible en este momento, pero todava puede probar los cupones manualmente." "WalletECNewUXErrorMessageForGiftCard": "No pudimos aplicar tu tarjeta regalo a esta compra. $1" "WalletECNewUXErrorMessageForGiftCardLink": "Ver el estado de la tarjeta regalo" "WalletECNewUXForNoSuccessMessage": "Lo sentimos, no podemos ayudarle en este momento" "WalletECNewUXForNoWorkingCoupon": "No encontramos ningn cupn de trabajo" "WalletECNewUXMultiErrorMessageForAutofill": "Autorrellenar" "WalletECNewUXMultiErrorMessageForCashback": "efectivo devuelto" "WalletECNewUXMultiErrorMessageForCoupon": "cupones" "WalletECNewUXMultiErrorMessageForiftCard": "Tarjeta de regalo" "WalletECNewUXPartialSuccessMessageForAutofill": "Se han rellenado algunos de los detalles. Introducir la informacin restante para completar la compra" "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "Ya ha guardado $1 con el mejor cupn y la tarjeta regalo" "WalletECNewUXSuccessMessageForAutofill": "Se han rellenado los detalles de la finalizacin de la compra" "WalletECNewUXSuccessMessageForCashback": "Obtendr hasta $1 en efectivo de devolucin de $2" "WalletECNewUXSuccessMessageForCoupon": "Ya ha guardado $1 con el mejor cup "WalletECNewUXSuccessMessageForGiftCard": "Ya ha guardado $1 con la tarjeta regalo", "WalletECSimplifyAutofillSubTitle": "Activar para habilitar autorrellenar", "WalletECSimplifyAutofillTitle": "Autorellenar detalles de finalizacin de la compra", "WalletECUXSimplifyCtaDescriptionSaving": "aplicar descuento", "walletBNPLSmallCardBottomMessagePayInFour": "$1 tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardBottomMessageZip": "Zip tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardFooterMessage": "Microsoft no le cobra ni recibe pagos de estos proveedores.", "walletBNPLSmallCardTitle": "La compra se dividir en 4 plazos", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "La compra se puede dividir en 4 entregas.", "walletChangeYourSettings": "cambiar la configuraci "walletDrawerFormPageMicroFeedbackPrompt": "s satisfecho con Cartera?" "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplica automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y Escrbelo manualmente para usarlo." "walletDrawerGiftCardAutofillFailureTitle": "No pudimos aplicar automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y escrbelo manualmente para usarlo." "walletDrawerGiftCardRedeemFailureTitle": "No pudimos canjear tus puntos de Rewards como tarjeta regalo. Puedes continuar con el pedido o volver a intentar la transaccis tarde." "walletDrawerGiftCardRedeemMultipleFailureTitle": "Canjea tus puntos de Rewards como tarjeta regalo." "walletECAllFailureMessageBottom": "No te preocupes, todava puedes continuar con la transaccin." "walletECAllFailureTitle": "Las siguientes caractersticas no estn disponibles en este momento:" "walletECApplyCashBackTitle": "Dinero devuelto" "walletECApplyCashCackTitle": "Obtendr hasta $1 en efectivo devuelto." "walletECApplySavingTitle": "Ahorrar $1 y obtendr hasta $2 en efectivo." "walletECAutoApplyApplyingBestCouponsNew": "Aplicando el mejor cupn que encontramos..." "walletECAutoApplyFailureTitle": "Las pruebas de cupones no estn disponibles en este momento, pero todava puede probar los cupones manualmente." "walletECAutoApplyFeature": "Cupones de prueba" "walletECAutoApplyTryingCoupons": "Intentando $1..." "walletECAutofillErrorMessage": "Detalles de Autorrellenar" "walletECAutofillPaymentOnlySingleErrorMessage": "Autorrellenar no pudo completar todos los detalles. Introdcelos manualmente para continuar con la transaccin." "walletECAutofillPaymentOnlySuccessMessage": "Hemos rellenado automticamente sus datos de pago para finalizar la compra rpidamente." "walletECAvailableRewardsPoints": "$1 puntos disponibles" "walletECCancelCouponButton": "Omitir cupones" "walletECCancelCouponFooter": "Un 45% de los usuarios ahorraron con cupones" "walletECCancelCouponStatus": "Cancelar cupones que se estn aplicando" "walletECCashBackAndCouponTitle": "Efectivo devuelto y cupones" "walletECCashBackDisplayValue": "Hasta $1" "walletECCashBackEnableErrorMessage": "No se pudo aplicar el reembolso a la compra en este momento. Intntalo de nuevo ms tarde." "walletECCashBackEnableSubErrorMessage": "Activar reembolso" "walletECCashBackInfo": "Recibir actualizaciones por correo electrnico y har un seguimiento del efectivo devuelto por $1." "walletECCashBackOptionText": "Obtener una devolucin de dinero" "walletECCashBackUpto": "Hasta $1" "walletECCashbackActivateFailedLabel": "No pudimos activar la devolucin de efectivo para esta compra. Intntalo de nuevo ms tarde." "walletECCashbackActivateLabel": "Activar reembolso" "walletECCashbackEnrollDisclaimer": "Iniciars sesin en Microsoft Edge, que realizar una copia de seguridad de sus datos de navegacin y te permitir ver tus favoritos, contraseas, historial y ms en todos sus dispositivos. Tambin te unirs y recibirs correos electrnicos de alrededor de $1, que incluyen ofertas sobre productos de socios. $2 | $3" "walletECCashbackLinkLabel": "Ver detalles de la oferta en $1" "walletECCashbackPrivacyLinkLabel": "Privacidad y cookies" "walletECCashbackSigninLabel": "nete ahora y activa la devolucin de dinero" "walletECCashbackStatus": "Reembolso activado" "walletECCashbackTermsLinkLabel": "Trminos" "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar descuento y continuar" "walletECContinueSavingsAndFillDetailsLabel": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones automticamente y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsLabelBNPL": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Al continuar, activaremos el programa de reembolsos y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Al continuar, activaremos el programa de reembolsos y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsButtonLabel": "Aplicar descuento" "walletECContinueSavingsLabel": "Al continuar, activaremos el programa de reembolsos y aplicaremos cupones automticamente." "walletECContinueSavingsNoCouponLabel": "Si contina, activaremos el programa de reembolsos." "walletECCouponAverageSaving": "De media, se ha ahorrado $1" "walletECCouponOptionText": "Usar cup "walletECCouponsCookieDisclaimer": "Permito colocar $1 en mi dispositivo para ayudar a facturar con el proveedor de cupones segn $2", "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declaracin de privacidad de Microsoft", "walletECEnjoyMessage": "Disfrute del resto de su recorrido de compra.", "walletECFillDetailsButtonLabelUXSimplify": "Rellenar detalles", "walletECFreBannerContent": "Encuentre las mejores ofertas con cupones y reembolsos todo antes de pagar.", "walletECFreBannerTitle": "Ahorre dinero y tiempo con Wallet en Microsoft Edge", "walletECGetCashbackLabel": "Puede conseguir hasta $1 de reembolso en $2.", "walletECGiftCardTitle": "Tarjeta regalo", "walletECManagePersonalInfo": "Administrar la informacin personal", "walletECMaskedCardDetailFetching": "Escriba su CVC para continuar", "walletECMaskedFetchErrorMessage": "Intntelo de nuevo y escriba su CVC cuando se le solicite. O bien seleccione otro mtodo de pago para continuar.", "walletECNewCtaDescriptionTemplateFive": "Si contina se le pedir $1 $2 $3 $4 y $5.", "walletECNewCtaDescriptionTemplateFour": "Si contina se le pedir $1 $2 $3 y $4.", "walletECNewCtaDescriptionTemplateOne": "Si contina se le pedir $1.", "walletECNewCtaDescriptionTemplateThree": "Si contina se le pedir $1 $2 y $3.", "walletECNewCtaDescriptionTemplateTwo": "Si contina se le pedir $1 y $2.", "walletECNewShippingAddressTitle": "Detalles del env "walletECNewUXErrorMessageTemplateFive": "Los $1, $2, $3, $4 y $5 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateFour": "Los $1, $2, $3 y $4 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateThree": "Los $1, $2 y $3 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateTwo": "Los $1 y $2 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNoSavedAddress": "No hay direccin guardada" "walletECNoSavedName": "No hay nombre guardado" "walletECRebatesCouponsSelectorDescription": "Le hemos aplicado los mejores descuentos y hemos encontrado que solo puede utilizar uno para esta compra. Seleccione una de las opciones siguientes para continuar." "walletECRebatesCouponsSelectorTitle": "Elija uno para continuar" "walletECReturnToCheckoutButtonAria": "Cerrar el panel y volver a la pgina de finalizacin de la compra" "walletECRewardsDonotRedeemOptionPoints": "No canjear puntos de recompensa" "walletECRewardsNoGiftCardSelected": "No hay ninguna tarjeta regalo seleccionada" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 puntos" "walletECRewardsRedeemOptionPoints": "$1 puntos" "walletECRewardsRedeemOptionTitle": "Canjear tarjeta regalo de $1" "walletECRewardsTitle": "tarjeta regalo Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar los descuentos y rellenar los detalles" "walletECSavingsDisableMessage": "$1 para activar el reembolso y aplicar cupones automticamente. Esto puede ahorrarle tiempo y dinero cuando compre en Edge." "walletECShoppingInfo": "Est usando el efectivo devuelto y cupones de compra de Microsoft." "walletECShoppingInfoForCoupon": "y cupones" "walletECShoppingInfoNew": "Est usando la devolucin de dinero de Microsoft$1." "walletECSkipCouponProgressStatus": "Omitiendo cupones "walletECThirdPartyCookies": "Cookies de terceros", "walletECTokenizationCardDetailFetching": "Estamos conectando con su banco para generar los detalles de la tarjeta para esta transaccin. Esto puede llevar unos segundos.", "walletECTokenizationFetchErrorMessage": "No se pueden generar los detalles de la tarjeta virtual. Vuelva a intentarlo o elija otra tarjeta.", "walletECUXAffirmDescription": "Dividir pagos en 8 semanas", "walletECUXAffirmDescriptionFinanced": "Compre ahora. Pague con el tiempo con Affirm.", "walletECUXBNPLDropdownTitle": "Pagar a lo largo del tiempo", "walletECUXCardKlarnaDescription": "Sin cuotas de inters pueden aplicarse recargo por demora", "walletECUXKlarnaDescription": "Compre ahora. Pague con el tiempo con Klarna.", "walletECUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletECUXNewAddressDropdownLabel": "Seleccionar direccin de env "walletECUXNewOnlyCardDropdownTitle": "Pagar con tarjeta" "walletECUXNewPaymentDropdownLabel": "Seleccionar mtodo de pago" "walletECUXNewPaymentDropdownTitle": "Pagar con tarjeta o pagar a lo largo del tiempo" "walletECUXSBillingTheSameWithShipAddress": "La direccin de facturacin es la misma que la direccin de env "walletECUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletECUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "walletECUXSmallCardAffirmDescription": "Sin recargo por demora sin intereses", "walletECUXSmallCardZipDescription": "Sin impacto en la puntuacin de crdito pueden aplicarse recargo por demora", "walletECUXZipDescription": "Dividir pagos en 6 semanas", "walletECUXsimplifyBGAANegativeContent": "Cartera prob todos los cupones pero no encontr ningn ahorro", "walletECUXsimplifyBGAANegativeTitle": "Tiene el mejor precio", "walletECUXsimplifyBGAAPostiveCouponContent": "Cartera ha probado todos los cupones disponibles", "walletECUXsimplifyBGAAPostiveTitle": "Ests ahorrando $1", "walletECUXsimplifyCashbackEnrollText": "Obtener hasta $1 con $2", "walletECUXsimplifyCashbackValue": "Hasta $1", "walletECUXsimplifyMutipleCoupon": "$1 cupones", "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar descuento" "walletECUXsimplifyShoppingToggleOffCashback": "Activar Reembolso de Microsoft" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Activar MicrosoftCashback y aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para ahorrar tiempo y dinero al comprar online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Activar las compras en MicrosoftEdge" "walletECUXsimplifyStandardCouponContent": "Ahorro medio: $1 en $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "Cartera encontrar la mejor oferta para ti" "walletECUXsimplifyStandardCouponTitle": "Se probar $1" "walletSelectString": "$1 o $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declarao de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Utilizao do Microsoft Edge", "affirmDescriptionText": "Compre agora pague de forma faseada com o Affirm. $1", "affirmDisclaimerLinkText": "Contacte a Affirm", "affirmDisclaimerText": "O Carto Affirm um carto virtual de utilizao limitada financiado pelo Cross River Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ou pela Affirm Loan Services LLC dependendo dos termos do seu contrato de emprstimo. emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A. Inc. O Carto Affirm emitido pela Marqeta. Se tiver alguma questo $1.", "affirmEstimatedFeesText": "No aplicadas taxas por atrasos", "affirmLogoDesc": "Compre agora pague de forma faseada com a Affirm", "affirmPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Affirm de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Affirm podem aplicar-se os termos de pagamento com essa aprovao.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicie sesso na sua aplicao de banca online para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para o seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "O seu banco est a enviar-lhe um cdigo de verificao para o seu endereo de e-mail $1.", "challengeDescriptionOnlineBanking": "Introduza abaixo o cdigo que recebeu do seu banco.", "challengeDescriptionOutboundCall": "O seu banco ir ligar para o seu nmero de telemvel $1 com um cdigo de verificao.", "challengeDescriptionSMS": "O seu banco est a enviar-lhe um cdigo de verificao para o nmero de telemvel $1.", "close": "Fechar", "commonSubtitle": "Veja se elegvel para pagamentos faseados", "dismiss": "Dispensar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outro", "feedbackOptionTookTooMuchTime": "Demorou demasiado tempo", "klarnaDescriptionText": "Faa as suas compras agora. Pague ao longo do tempo com a Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Klarna Visa emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A Inc. O Carto Klarna tem tecnologia da Marqeta. Apoio a Clientes: $1", "klarnaEstimatedFeesText": "Podem aplicar-se taxas do servio Klarna de atraso", "klarnaFeeTermLinkText": "Servio \"Pague Depois\" da Klarna em $1", "klarnaLogoDesc": "Poupe dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Klarna de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Klarna podem aplicar-se os termos de pagamento com essa aprovao.", "learnMore": "Saber mais", "manageYourPaymentMethodsLinkText": "Gerir os seus mtodos de pagamento", "msPayAddCardAgreement": "Ao continuar concorda com $1 $2 e $3 relativamente forma como os seus dados so tratados.", "nextButtonAriaLabel": "Ir para a pgina seguinte", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos do Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Inscrever-se", "tokenizationEnrollConfirmDialogTitle": "Pague em segurana com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configure um carto virtual e ganhe 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou pedir o cdigo de segurana do carto para verificar se se trata de si.", "tokenizationEnrollConfirmModalDescription": "Um carto virtual oculta os detalhes do seu carto a comerciantes quando fizer compras online. Se algum deles tiver uma falha de segurana de dados os seus detalhes permanecero protegidos. $1", "tokenizationTerms": "Ao continuar concorda com os $1.", "tokenizeCardBack": "Voltar", "tokenizeCardChallengeMethodAPPToAPP": "Aplicao de servio bancrio mvel", "tokenizeCardChallengeMethodCustomerService": "Suporte ao cliente do banco", "tokenizeCardChallengeMethodEmail": "E-mail", "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria", "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensagem de texto", "tokenizeCardCvvInvalidError": "Verifique o seu cdigo de segurana e tente novamente.", "tokenizeCardEnterCode": "Introduzir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos efetuar a verifica "tokenizeCardEnterCvvStepDescription": "O seu banco exige que verifique o cdigo de segurana CVV associado ao seu carto $1 que termina em $2." "tokenizeCardErrorStepTitle": "Ocorreu um erro" "tokenizeCardFetchCodeError": "O emissor do seu carto teve um problema ao enviar o cdigo. Pea outro cdigo ou utilize um mtodo de verificao diferente." "tokenizeCardFetchCodeErrorCustomerService": "O emissor do seu carto teve um problema ao gerar o cdigo. Experimente um mtodo de verificao diferente ou tente novamente mais tarde." "tokenizeCardGeneralError": "O emissor do seu carto est a ter problemas neste momento. Tente novamente mais tarde." "tokenizeCardLoadingTitle": "A contactar o seu banco "tokenizeCardNext": "Seguinte", "tokenizeCardResendCode": "Reenviar o cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos efetuar a verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tentar novamente" "tokenizeCardValidationError": "O emissor do seu carto consegue efetuar a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "A verificar" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "No conseguimos preencher automaticamente as informaes do seu carto a partir do $1. Insira manualmente as informaes do seu carto $1 durante a compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto e do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha o seu endereo de faturao." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de expira "walletDrawerLinkErrorMessage": "No conseguimos associar a sua conta Microsoft a $1. Tente novamente mais tarde.", "walletDrawerNameAndAddressLabel": "O seu nome e endereo para fatura "walletDrawerPayWithVirtualCard": "Pague com o seu carto $1 $2" "walletDrawerSystemErrorHeader": "Ups" "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado pelo seu feedback. Ir ajudar-nos a melhorar a Carteira." "walletMicrofeedbackPrompt": "Est contente com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerir mtodos de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "zipDescriptionText": "Compre agora pague durante seis semanas com o Zip. $1", "zipEstimatedFeesText": "Podem aplicar-se taxas de atraso", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip compre agora pague depois", "zipPolicy": "Ao continuar concorda com os nossos $1 e reconhece que o seu valor total de compra ser partilhado com a Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Poltica de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Uso do Microsoft Edge", "affirmDescriptionText": "Compre agora pague ao longo do tempo com Affirm. $1", "affirmDisclaimerLinkText": "Contactar a Affirm", "affirmDisclaimerText": "O Carto Afirmativo um carto virtual de uso limitado e financiamento pelo Cross River Bank membro da FDIC ou Affirm Loan Services empresa de responsabilidade limitada dependendo dos termos do seu contrato de emprstimo e emitido por Mila Bank membro da FDIC de acordo com a licena da Visa U.S.A. Inc. O Carto da Affirm emitido pela Marqeta. $1 se voc tiver alguma dvida.", "affirmEstimatedFeesText": "No se aplicam tarifas atrasadas", "affirmLogoDesc": "Compre agora pague a longo prazo com a Affirm", "affirmPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Affirm de acordo com $2. Se voc tiver sido aprovado recentemente pela Affirm para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Entre em seu aplicativo online do banco para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "Seu banco est lhe enviando um cdigo de verificao para seu endereo de email $1.", "challengeDescriptionOnlineBanking": "Insira abaixo o cdigo que voc recebeu de seu banco.", "challengeDescriptionOutboundCall": "Seu banco ligar para seu nmero de celular $1 com um cdigo de verificao.", "challengeDescriptionSMS": "Seu banco est lhe enviando um cdigo de verificao para seu nmero do telefone celular $1.", "close": "Fechar", "commonSubtitle": "Confira se est qualificado para pagamento a longo prazo", "dismiss": "Ignorar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outros", "feedbackOptionTookTooMuchTime": "Demorou muito tempo", "klarnaDescriptionText": "Compre agora. Pague depois com o Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Visa Klarna emitido pelo Sutton Bank membro da FDIC de acordo com uma licena da Visa U.S.A Inc. O Carto Klarna da plataforma Marqeta. Servio de Atendimento ao Cliente $1", "klarnaEstimatedFeesText": "Servio Klarna e taxas atrasadas podem ser aplicadas", "klarnaFeeTermLinkText": "Pagar mais tarde em $1 do Klarna", "klarnaLogoDesc": "Economize dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Klarna de acordo com $2. Se voc tiver sido aprovado recentemente pela Klarna para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "learnMore": "Saiba mais", "manageYourPaymentMethodsLinkText": "Gerenciar suas formas de pagamento", "msPayAddCardAgreement": "Ao continuar voc concorda com os $1 $2 e $3 sobre como seus dados so tratados.", "nextButtonAriaLabel": "Ir para a prxima pgina", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos e Condies de Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Registrar", "tokenizationEnrollConfirmDialogTitle": "Pague de forma segura com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar um carto virtual e ganhar 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou solicitar o cdigo de segurana do carto para verificar se voc "tokenizationEnrollConfirmModalDescription": "Um carto virtual esconde os detalhes do seu carto dos comerciantes quando voc faz compras online. Se algum deles sofrer uma violao de dados, seus dados permanecero protegidos. $1" "tokenizationTerms": "Ao continuar, voc concorda com $1." "tokenizeCardBack": "Voltar" "tokenizeCardChallengeMethodAPPToAPP": "Aplicativo de dispositivo mvel do banco" "tokenizeCardChallengeMethodCustomerService": "Servio de atendimento ao cliente do banco" "tokenizeCardChallengeMethodEmail": "Email" "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria" "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica" "tokenizeCardChallengeMethodSMS": "Mensagem de texto" "tokenizeCardCvvInvalidError": "Verifique seu cdigo de segurana e tente novamente." "tokenizeCardEnterCode": "Inserir cdigo" "tokenizeCardEnterCodeStepTitle": "Vamos fazer sua verifica "tokenizeCardEnterCvvStepDescription": "Seu banco exige que voc verifique o cdigo de segurana CVV associado ao seu $1 que termina em $2.", "tokenizeCardErrorStepTitle": "Algo deu errado", "tokenizeCardFetchCodeError": "O emissor do carto teve um problema ao enviar o cdigo. Solicite outro cdigo ou use um mtodo de verificao diferente.", "tokenizeCardFetchCodeErrorCustomerService": "O emissor do carto teve um problema ao gerar o cdigo. Tente um mtodo de verificao diferente ou tente novamente mais tarde.", "tokenizeCardGeneralError": "O emissor de seu carto est tendo problemas no momento. Tente novamente mais tarde.", "tokenizeCardLoadingTitle": "Contatando seu banco...", "tokenizeCardNext": "Avanar", "tokenizeCardResendCode": "Reenviar cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos fazer sua verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tente novamente" "tokenizeCardValidationError": "O emissor de seu carto pode fazer a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "Verificando" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "N possvel preencher automaticamente as informaes do carto a partir de $1. Insira manualmente as informaes do carto de $1 durante a finalizao da compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique no carto e nos detalhes do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha seu endereo de cobrana residencial." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de validade" "walletDrawerLinkErrorMessage": "N possvel vincular sua conta Microsoft a $1. Tente novamente mais tarde." "walletDrawerNameAndAddressLabel": "Seu nome e endereo para cobran "walletDrawerPayWithVirtualCard": "Pague com seu carto $1 $2", "walletDrawerSystemErrorHeader": "Ah n "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado por seus comentrios. Isso nos ajudar a melhorar a velocidade da Carteira." "walletMicrofeedbackPrompt": "Satisfeito com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerenciar formas de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta carto virtual", "walletUXSTokenCardLogoContent": "Nmero do carto virtual $1 ativado para proteger suas informaes de pagamento", "zipDescriptionText": "Compre agora pague em 6 semanas com Zip. $1", "zipEstimatedFeesText": "Taxas atrasadas podem ser aplicadas", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip comprar agora pagar depois", "zipPolicy": "Ao continuar voc concorda com nossos $1 e reconhece que o valor total da compra ser compartilhado com o Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declaracin de privacidad de Microsoft", "aboutTermsOfUseLinkText": "Trminos de uso de Microsoft Edge", "affirmDescriptionText": "Compra ahora y paga despus con Affirm. $1", "affirmDisclaimerLinkText": "Ponerme en contacto con Affirm", "affirmDisclaimerText": "La tarjeta Affirm es una tarjeta virtual de uso limitado con fondos de Cross River Bank FDIC o Affirm Loan Services LLC en funcin de los trminos del contrato de prstamo y emitida por Sutton Bank banco miembro de FDIC en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Affirm cuenta con tecnologa de Marqeta. $1 si tienes alguna pregunta.", "affirmEstimatedFeesText": "No se aplican cargos con retraso", "affirmLogoDesc": "Compra ahora y paga despus con Affirm", "affirmPolicy": "Al continuar acepta $1 y reconoce que el importe total de la compra junto con el lugar en el que compra se compartirn con La autorizacin de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Parte de la Funcin pueden aplicarse los trminos de pago con esa aprobacin.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicia sesin en tu aplicacin de banca en lnea para recibir un cdigo de verificacin.", "challengeDescriptionCustomerService": "Llama a tu banco al $1 para recibir un cdigo de verificacin.", "challengeDescriptionEmail": "Tu banco te est enviando un cdigo de verificacin a tu direccin de correo electrnico $1.", "challengeDescriptionOnlineBanking": "Introduce a continuacin el cdigo que recibiste de tu banco.", "challengeDescriptionOutboundCall": "Tu banco llamar a tu nmero de telfono mvil $1 con un cdigo de verificacin.", "challengeDescriptionSMS": "Tu banco te est enviando un cdigo de verificacin a tu nmero de telfono mvil $1.", "close": "Cerrar", "commonSubtitle": "Comprueba si cumples los requisitos para pagar despu "dismiss": "Descartar" "feedbackOptionAutofillDontWork": "Error al autorrellenar" "feedbackOptionOthers": "Otro" "feedbackOptionTookTooMuchTime": "Se tard demasiado tiempo" "klarnaDescriptionText": "Compra ahora. Paga despus con Klarna. $1" "klarnaDisclaimerText": "La tarjeta Klarna Visa Commercial Card es emitida por Sutton Bank, banco miembro de la Corporacin Federal de Seguro de Depsitos (FDIC), en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Klarna cuenta con tecnologa de Marqeta. Atencin al cliente $1" "klarnaEstimatedFeesText": "Pueden aplicarse cargos por servicio y demora de Klarna" "klarnaFeeTermLinkText": "\"Paga despus\" de Klarna en $1" "klarnaLogoDesc": "Ahorra dinero con Klarna." "klarnaPolicy": "Al continuar, acepta $1 y reconoce que el importe total de la compra junto con el lugar donde compre se compartir con Klarna, de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Klarna, pueden aplicarse los trminos de pago con esa aprobacin." "learnMore": "Obtener ms informaci "manageYourPaymentMethodsLinkText": "Administrar los mtodos de pago", "msPayAddCardAgreement": "Al continuar aceptas $1 $2 y $3 relativos a cmo se administran sus datos.", "nextButtonAriaLabel": "Ir a la pgina siguiente", "paginationButtonAriaLabel": "Ir a la pgina $1", "paymentServiceTermsLinkText": "Trminos del servicio de pago", "previousButtonAriaLabel": "Ir a la pgina anterior", "textOfChangeButton": "Cambiar", "textOfCreateButton": "Crear", "tokenizationEnroll": "Inscribirse", "tokenizationEnrollConfirmDialogTitle": "Paga de forma segura con una tarjeta virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar una tarjeta virtual y ganar 20 puntos de Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "El emisor de la tarjeta puede enviar un cdigo de verificacin o solicitar el cdigo de seguridad de la tarjeta para comprobar que eres t "tokenizationEnrollConfirmModalDescription": "Una tarjeta virtual oculta los detalles de la tarjeta a los comerciantes cuando compras en lnea. Si alguno de ellos experimenta una vulneracin de datos, tus detalles permanecern protegidos. $1" "tokenizationTerms": "Al continuar, aceptas el $1." "tokenizeCardBack": "Atr "tokenizeCardChallengeMethodAPPToAPP": "Aplicacin de banca mvil", "tokenizeCardChallengeMethodCustomerService": "Servicio de atencin al cliente del banco", "tokenizeCardChallengeMethodEmail": "Correo electrnico", "tokenizeCardChallengeMethodOnlineBanking": "Cuenta bancaria", "tokenizeCardChallengeMethodOutboundCall": "Llamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensaje de texto", "tokenizeCardCvvInvalidError": "Comprueba el cdigo de seguridad e intntalo de nuevo.", "tokenizeCardEnterCode": "Introducir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos a realizar la comprobaci "tokenizeCardEnterCvvStepDescription": "Tu banco requiere que compruebes el cdigo de seguridad CVV asociado a tu $1 que termina en $2." "tokenizeCardErrorStepTitle": "Hubo un problema" "tokenizeCardFetchCodeError": "El emisor de la tarjeta tuvo un problema para enviar el cdigo. Solicite otro cdigo o use otro mtodo de verificacin." "tokenizeCardFetchCodeErrorCustomerService": "El emisor de la tarjeta tuvo un problema al generar el cdigo. Pruebe con otro mtodo de verificacin o intntelo de nuevo ms tarde." "tokenizeCardGeneralError": "El emisor de la tarjeta tiene problemas en este momento. Vuelve a intentarlo ms tarde." "tokenizeCardLoadingTitle": "Contactando con tu banco..." "tokenizeCardNext": "Siguiente" "tokenizeCardResendCode": "Reenviar cdigo" "tokenizeCardSelectMethodDescription": "Elige uno de los mtodos de comprobacin siguientes:" "tokenizeCardSelectMethodStepTitle": "Vamos a realizar la comprobaci "tokenizeCardSendingCode": "Cdigo enviado", "tokenizeCardTryAgain": "Volver a intentarlo", "tokenizeCardValidationError": "El emisor de la tarjeta no pudo comprobarlo. Intntalo de nuevo en breve.", "tokenizeCardVerify": "Comprobar", "tokenizeCardVerifyWithAnotherMethod": "Comprobar con otro mtodo", "tokenizeCardVerifying": "Verificando", "walletCommonAccountCount": "$1 cuenta", "walletDrawerAutoFillErrorMessage": "No podemos rellenar automticamente la informacin de tu tarjeta desde $1. Escribe manualmente esta informacin de $1 durante la finalizacin de la compra.", "walletDrawerAutoFillMessage": "Hemos rellenado automticamente la informacin de la tarjeta desde $1.", "walletDrawerAutoFillMessageWithBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en la tarjeta y los detalles de direccin siguientes para copiar.", "walletDrawerAutoFillMessageWithoutBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en los detalles de la tarjeta a continuacin para copiar. Para completar esta compra rellene la direccin de facturacin de su hogar.", "walletDrawerCvcLabel": "CVC", "walletDrawerExpirationLabel": "Expiraci "walletDrawerLabelCopyCardNumber": "Copiar nmero de la tarjeta" "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nombre y direcci "walletDrawerLabelShowCardNumber": "Mostrar nmero de tarjeta", "walletDrawerLabelShowCvc": "Mostrar CVC", "walletDrawerLabelShowExpirationDate": "Copiar fecha de expiraci "walletDrawerLinkErrorMessage": "No podemos vincular tu cuenta Microsoft a $1. Vuelve a intentarlo ms tarde." "walletDrawerNameAndAddressLabel": "Tu nombre y direccin de facturaci "walletDrawerPayWithVirtualCard": "Pagar con tu tarjeta $1 $2", "walletDrawerSystemErrorHeader": "Vaya!", "walletDrawerVirtualCardNumberLabel": "Nmero de tarjeta virtual", "walletFeedbackThankYouText": "Gracias por los comentarios. Nos ayudar a mejorar Cartera.", "walletMicrofeedbackPrompt": "s satisfecho con Cartera?", "walletSeeDetailsAriaLabel": "ver detalles", "walletUXAddPaymentButtonTitle": "Agregar nueva tarjeta", "walletUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "zipDescriptionText": "Compra ahora paga en 6 semanas con Zip. $1", "zipEstimatedFeesText": "Pueden aplicarse cargos con retraso", "zipFeeTermLinkText": "Trminos del servicio de Zip", "zipLogoDesc": "Zip compra ahora paga despu "zipPolicy": "Al continuar, aceptas nuestros $1 y reconoces que el importe total de la compra se compartir con Zip, de acuerdo con $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Ativar carto virtual", "featurePromotionActionLinkText": "Experimentar agora", "learnMoreLinkTextShort": "Saber mais", "membershipsDescription": "Mantenha tudo organizado e sob controlo.", "membershipsPromotionTitle": "Faa a gesto das suas associaes na Carteira", "msWalletNotificationCardExpired": "O seu carto expirou", "msWalletNotificationCardExpiring": "O seu carto expira em breve", "msWalletNotificationCardTokenizationEligibleDescription": "Os cartes virtuais so credenciais de pagamento de utilizanica que so geradas aleatoriamente sempre que faz uma compra online. Isto ajuda a garantir que o seu $1 est protegido.", "msWalletNotificationCardTokenizationEligibleHeader": "Proteja os detalhes do seu cart "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure um carto virtual para tornar as compras online mais seguras e convenientes." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure um carto virtual para tornar as compras online mais seguras e ganhar 20 pontos do Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar para $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteja as suas compras com cartes virtuais" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explore a Web3 de forma segura com esta carteira sem depositrio" "msWalletNotificationCryptowalletSignupTitle": "Configurar a sua Carteira Criptogrfica" "msWalletNotificationDismissLabel": "Dispensar" "msWalletNotificationDismissPermanently": "Dispensar permanentemente" "msWalletNotificationDismissText": "No ver esta notificao novamente" "msWalletNotificationDonationSummaryLinkText": "Conferir" "msWalletNotificationDonationSummaryTitle": "Veja todo o seu resumo de donativos e n "msWalletNotificationFixLeakage": "Ver detalhes", "msWalletNotificationHotelReservationBody": "A sua data de reserva de $1 de $2 a $3 est a aproximar-se.", "msWalletNotificationHotelReservationTitle": "Alojamento futuro", "msWalletNotificationHotelReservationViewDetails": "Ver detalhes", "msWalletNotificationLeakageBody": "$1 das suas $2 palavras-passe foram divulgadas.", "msWalletNotificationLeakageTitle": "Divulgao de palavra-passe", "msWalletNotificationOrderStatusTitle": "Estado da encomenda atualizado", "msWalletNotificationPOMessage": "A sua oferta selecionada de $1 do Microsoft Cashback expira dentro de $2", "msWalletNotificationRebatesCashoutAction": "Transferir para Paypal", "msWalletNotificationRebatesCashoutAmountDescription": "Parabns tem $1 de reembolso. Levante com o PayPal.", "msWalletNotificationRebatesCashoutDescription": "Saiba mais sobre o programa de reembolso e o levantamento com o PayPal.", "msWalletNotificationRebatesCashoutTitle": "Est na hora de receber o seu reembolso!", "msWalletNotificationRoamCardAction": "Guardar o cart "msWalletNotificationRoamCardActionV2": "Guardar carto na conta Microsoft" "msWalletNotificationRoamCardHeader": "Guardar o carto na conta Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pague mais rapidamente e a partir de diferentes dispositivos em compras futuras" "msWalletNotificationRoamCardHeaderV3": "Pague mais rapidamente a partir de qualquer dispositivo" "msWalletNotificationSnoozeLabel": "Suspender" "msWalletNotificationSnoozeText": "Notificao suspensa durante sete dias" "msWalletNotificationSnoozeText1": "Notificao suspensa durante $1 dias" "msWalletNotificationTrackOrderLink": "Monitorizar encomenda" "msWalletNotificationTrackOrderSubTitle": "A carteira ajuda a monitorizar a sua encomenda quando compra em determinados sites." "msWalletNotificationTrackOrderTitle": "Monitorizar a sua encomenda" "msWalletNotificationUpdateButton": "Atualizar agora" "msWalletNotificationUpdateButton1": "Atualizar ou remover cart "msWalletNotificationUpdateButton2": "Corrigir", "msWalletNotificationUpdateCardFailText": "A atualizao falhou. Tente novamente em $1", "msWalletNotificationUpdateExpText": "Edite as informaes do seu carto para continuar a utilizar o seu carto que termina em $1.", "msWalletNotificationUpdateExpTextV2MissingIssuer": "Atualize o seu carto com terminao em $1 para continuar a utiliz-lo.", "msWalletNotificationUpdatedCardText": "Carto atualizado com xito!", "msWalletNotificationViewDetailLink": "Ver detalhes", "passwordsDescription": "Desfrute da nova experincia de gesto na Carteira.", "passwordsPromotionTitle": "Gerir as suas palavras-passe na Carteira", "personalizedOffersCashBackDescription": "Ganhe $1 de reembolso com a $2.", "personalizedOffersNoThanksText": "No obrigado", "personalizedOffersOfferExpiresInText": "A oferta expira dentro de", "personalizedOffersViewOfferText": "Ver oferta", "rewardsPromotionActionLinkText": "Adicionar nova associa "rewardsPromotionDescription": "Ganhe at 20 pontos Rewards ao adicionar novas associa carteira" "rewardsPromotionTitle": "Adicione associaes para obter Microsoft Rewards" "walletTitle": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Activar tarjeta virtual", "featurePromotionActionLinkText": "Probar ahora", "learnMoreLinkTextShort": "Obtener ms informaci "membershipsDescription": "Mantngase organizado y en control." "membershipsPromotionTitle": "Administra tus suscripciones en Cartera" "msWalletNotificationCardExpired": "Su tarjeta ha caducado" "msWalletNotificationCardExpiring": "Su tarjeta expirar pronto" "msWalletNotificationCardTokenizationEligibleDescription": "Las tarjetas virtuales son credenciales de pago de un solo uso que se generan aleatoriamente cada vez que se realiza una compra en lnea. Esto ayuda a garantizar que su tarjeta $1 est protegida." "msWalletNotificationCardTokenizationEligibleHeader": "Proteja los datos de sus tarjetas" "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure una tarjeta virtual para que las compras en lnea sean ms seguras y mmodas." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure una tarjeta virtual para que sus compras en lnea sean ms seguras y gane 20 puntos de Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar por $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteger las compras con tarjetas virtuales" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explorar Web3 de forma segura con esta cartera que no es custodio" "msWalletNotificationCryptowalletSignupTitle": "Configure su Cartera criptogrfica" "msWalletNotificationDismissLabel": "Descartar" "msWalletNotificationDismissPermanently": "Descartar permanentemente" "msWalletNotificationDismissText": "No volvers a ver esta notificaci "msWalletNotificationDonationSummaryLinkText": "Comprubelo", "msWalletNotificationDonationSummaryTitle": "Ver todo el resumen de la entrega y mucho m "msWalletNotificationFixLeakage": "Ver detalles" "msWalletNotificationHotelReservationBody": "Tu fecha de reserva de $1 del $2 al $3 estxima." "msWalletNotificationHotelReservationTitle": "Prximo alojamiento" "msWalletNotificationHotelReservationViewDetails": "Ver detalles" "msWalletNotificationLeakageBody": "Se han filtrado $1 de sus $2 contraseas." "msWalletNotificationLeakageTitle": "Filtracin de contraseas" "msWalletNotificationOrderStatusTitle": "Estado del pedido actualizado" "msWalletNotificationPOMessage": "Tu oferta seleccionada de Microsoft Cashback de $1 expira en $2" "msWalletNotificationRebatesCashoutAction": "Transferir a PayPal" "msWalletNotificationRebatesCashoutAmountDescription": "Enhorabuena, tienes $1 en efectivo. Reembolso con PayPal." "msWalletNotificationRebatesCashoutDescription": "Ms informacin sobre el programa de devolucin de efectivo y el reembolso con PayPal." "msWalletNotificationRebatesCashoutTitle": "Es hora de cobrar!" "msWalletNotificationRoamCardAction": "Guardar la tarjeta" "msWalletNotificationRoamCardActionV2": "Guardar tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeader": "Guardar la tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pagar mpido y desde diferentes dispositivos en futuras compras" "msWalletNotificationRoamCardHeaderV3": "Pagar mpido desde cualquier dispositivo" "msWalletNotificationSnoozeLabel": "Posponer" "msWalletNotificationSnoozeText": "Notificacin pospuesta durante 7 das" "msWalletNotificationSnoozeText1": "Notificacin pospuesta durante $1 das" "msWalletNotificationTrackOrderLink": "Seguimiento de pedidos" "msWalletNotificationTrackOrderSubTitle": "La Cartera se ayuda a realizar un seguimiento de su pedido cuando compra en determinados sitios." "msWalletNotificationTrackOrderTitle": "Realizar un seguimiento del pedido" "msWalletNotificationUpdateButton": "Actualizar ahora" "msWalletNotificationUpdateButton1": "Actualizar o quitar tarjeta" "msWalletNotificationUpdateButton2": "Corregir" "msWalletNotificationUpdateCardFailText": "Error al actualizar. Intntalo de nuevo en $1" "msWalletNotificationUpdateExpText": "Edita la informacin de la tarjeta para seguir usando la tarjeta que termina en $1." "msWalletNotificationUpdateExpTextV2MissingIssuer": "Actualice la tarjeta que termina en $1 para seguir usndola." "msWalletNotificationUpdatedCardText": "La tarjeta se actualiz correctamente" "msWalletNotificationViewDetailLink": "Ver detalles" "passwordsDescription": "Probar la nueva experiencia de administracin en Cartera." "passwordsPromotionTitle": "Administrar las contraseas en Cartera" "personalizedOffersCashBackDescription": "Recupera $1 en efectivo con $2." "personalizedOffersNoThanksText": "No, gracias" "personalizedOffersOfferExpiresInText": "La oferta caduca en" "personalizedOffersViewOfferText": "Ver la oferta" "rewardsPromotionActionLinkText": "Agregar nueva suscripci "rewardsPromotionDescription": "Gane hasta 20 puntos de recompensa agregando nuevas suscripciones a la cartera", "rewardsPromotionTitle": "Agrega suscripciones para ganar Microsoft Rewards", "walletTitle": "Cartera"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e futuras", "address": "Endereos", "all": "Tudo", "bookingId": "ID da Reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Cartas", "cashback": "Reembolso", "checkIn": "Check-in", "checkOut": "Check-out", "digitalIdMembershipAddMembership": "Adicionar nova", "digitalIdMembershipEmptySubtitle": "Armazenamos a sua associao para ajudar a preencher rapidamente as informaes quando reserva bilhetes de voo e fornecemos capacidades diversas para que consiga maximizar as suas poupanas em conformidade.", "digitalIdMembershipEmptyTitle": "Ainda no existe nenhuma associa "done": "Concludo" "earn": "Ganhe" "edit": "Editar" "in1Day": "Dentro de 1 dia" "inUse": "Em utiliza "inXDays": "Dentro de $1 dias", "join": "Participar", "manage": "Gerir", "membership": "ASSOCIA "membershipAdded": "New membership added" "membershipCardHolderFirstName": "Nome prprio" "membershipCardHolderLastName": "Apelido" "membershipCardHolderMiddleName": "Nome do meio" "membershipCardHolderName": "TITULAR DO CART "membershipCopied": "Membership number copied", "membershipFormAddButtonLabel": "Adicionar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Guardar", "membershipInvalid": "Required field(s) missing", "membershipNumber": "N. DE ASSOCIA "membershipRemoveTitle": "Are you sure to remove?" "membershipRemoved": "Membership removed" "membershipType": "Tipo de associa "membershipUpdated": "Membership updated", "memberships": "Associaes", "open": "Abrir", "openTicketUrlMessage": "Abra a pgina \"$1\" para gerir as suas reservas.", "openUrlTitle": "Abrir o \"$1\"", "passwordLeakActionMessage": "As palavras-passe de $1 apareceram em fugas", "passwordLeakActionMessageSingular": "Uma palavra-passe apareceu em fugas de informa "passwordSectionTitle": "$1 palavras-passe divulgadas" "passwordSectionTitleSingular": "1 palavra-passe divulgada" "passwordSectionViewMore": "Ver mais $1 palavras-passe divulgadas" "passwordSectionViewMoreSingular": "Ver mais 1 palavra-passe divulgada" "passwords": "Palavras-passe" "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Mtodos de pagamento", "providedBy": "Fornecido por $1", "remove": "Remover", "removeTicketMessage": "Remover este passe da Carteira", "rewards": "Recompensas", "tickets": "Pedidos", "ticketsEmptySubTitle": "Podemos sincronizar os seus bilhetes do Bing Travel e do Outlook para a Carteira agora.", "ticketsEmptyTitle": "Ainda no existem pedidos", "ticketsViewExpired": "Ver $1 passes expirados", "ticketsViewExpiredSingular": "Ver 1 passe expirado", "today": "Hoje", "tomorrow": "Amanh "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalles", "actionsAndUpcomingTitle": "Acciones y prximos", "address": "Direcciones", "all": "Todos", "bookingId": "Id. de reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Tarjetas", "cashback": "Reembolso", "checkIn": "Registro", "checkOut": "Salida", "digitalIdMembershipAddMembership": "Agregar nueva", "digitalIdMembershipEmptySubtitle": "Almacenamos tu suscripcin para ayudarte a rellenar rpidamente la informacin cuando reserves vuelos y proporcionamos diversas funcionalidades para maximizar tus ahorros consecuentemente.", "digitalIdMembershipEmptyTitle": "An no hay ninguna suscripci "done": "Listo" "earn": "Ganar" "edit": "Editar" "in1Day": "En 1 d "inUse": "En uso", "inXDays": "En $1 das", "join": "Unirse", "manage": "Administrar", "membership": "MEMBRES "membershipAdded": "New membership added" "membershipCardHolderFirstName": "Nombre" "membershipCardHolderLastName": "Apellidos" "membershipCardHolderMiddleName": "Segundo nombre" "membershipCardHolderName": "TITULAR" "membershipCopied": "Membership number copied" "membershipFormAddButtonLabel": "Agregar" "membershipFormNumber": "Nmero" "membershipFormOptionalField": "(Opcional)" "membershipFormSaveButtonLabel": "Guardar" "membershipInvalid": "Required field(s) missing" "membershipNumber": "NO DE PERTENENCIA." "membershipRemoveTitle": "Are you sure to remove?" "membershipRemoved": "Membership removed" "membershipType": "Tipo de suscripci "membershipUpdated": "Membership updated", "memberships": "Suscripciones", "open": "Abrir", "openTicketUrlMessage": "Abra la pgina \"$1\" para administrar sus reservas.", "openUrlTitle": "Abrir \"$1\"", "passwordLeakActionMessage": "Han aparecido $1 contraseas en filtraciones", "passwordLeakActionMessageSingular": "Ha aparecido 1 contrasea en filtraciones", "passwordSectionTitle": "$1 Contraseas filtradas por", "passwordSectionTitleSingular": "1 contrasea filtrada", "passwordSectionViewMore": "Ver $1 ms contraseas filtradas", "passwordSectionViewMoreSingular": "Ver 1 contrases filtradas", "passwords": "Contraseas", "paymentSectionAddNew": "Agregar una nueva tarjeta", "paymentSectionTitle": "Mtodos de pago", "providedBy": "Proporcionado por $1", "remove": "Quitar", "removeTicketMessage": "Quitar este pase de Cartera", "rewards": "Recompensas", "tickets": "Entradas", "ticketsEmptySubTitle": "Ahora podemos sincronizar sus vales de Bing Travel y Outlook con Cartera.", "ticketsEmptyTitle": "An no hay ningn vale", "ticketsViewExpired": "Ver $1 pases expirados", "ticketsViewExpiredSingular": "Ver 1 pase expirado", "today": "Hoy", "tomorrow": "Maana", "wallet": "Cartera"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e prximos passos", "address": "Endereos", "all": "Tudo", "bookingId": "ID da Reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Cartes", "cashback": "Cashback", "checkIn": "Fazer check-in", "checkOut": "Check-out", "digitalIdMembershipAddMembership": "Adicionar novo", "digitalIdMembershipEmptySubtitle": "Armazenamos sua associao para ajudar voc a preencher rapidamente as informaes ao reservar passagens areas e fornecer diversos recursos para maximizar suas economias adequadamente.", "digitalIdMembershipEmptyTitle": "Ainda n nenhuma associa "done": "Concludo" "earn": "Ganhe" "edit": "Editar" "in1Day": "Em 1 dia" "inUse": "Em uso" "inXDays": "Em $1 dias" "join": "Ingressar" "manage": "Gerenciar" "membership": "ASSOCIA "membershipAdded": "New membership added", "membershipCardHolderFirstName": "Nome", "membershipCardHolderLastName": "Sobrenome", "membershipCardHolderMiddleName": "Sobrenome", "membershipCardHolderName": "TITULAR", "membershipCopied": "Membership number copied", "membershipFormAddButtonLabel": "Adicionar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Salvar", "membershipInvalid": "Required field(s) missing", "membershipNumber": "N. DE ASSOCIAO.", "membershipRemoveTitle": "Are you sure to remove?", "membershipRemoved": "Membership removed", "membershipType": "Tipo de associa "membershipUpdated": "Membership updated" "memberships": "Associaes" "open": "Abrir" "openTicketUrlMessage": "Abra a pgina \"$1\" para gerenciar suas reservas." "openUrlTitle": "Abra o \"$1\"" "passwordLeakActionMessage": "Senhas de $1 apareceram em vazamentos" "passwordLeakActionMessageSingular": "A senha de $1 apareceu em vazamentos" "passwordSectionTitle": "$1 senhas vazadas" "passwordSectionTitleSingular": "1 senha vazada" "passwordSectionViewMore": "Exibir mais $1 senhas vazadas" "passwordSectionViewMoreSingular": "Exibir mais 1 senha vazada" "passwords": "Senhas" "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Formas de pagamento", "providedBy": "Fornecido por $1", "remove": "Remover", "removeTicketMessage": "Remover este passe da Carteira", "rewards": "Rewards", "tickets": "Tquetes", "ticketsEmptySubTitle": "Podemos sincronizar seus tquetes do Bing Travel e do Outlook para a Carteira agora.", "ticketsEmptyTitle": "Ainda n nenhum tquete", "ticketsViewExpired": "Exibir $1 passes expirados", "ticketsViewExpiredSingular": "Exibir 1 passagem expirada", "today": "Hoje", "tomorrow": "Amanh "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json3e:Tea11,Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "EncodePointer"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DecodePointer"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FlsFree"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FlsSetValue"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FlsGetValue"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FlsAlloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetProcessWindowStation"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetLastActivePopup"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetActiveWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "MessageBoxA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsWow64Process2"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RtlGetVersion"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetGetConnectedState"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CheckTokenMembership"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "WaitForSingleObject"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetExitCodeThread"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CloseHandle"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "Sleep"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetTickCount"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TerminateThread"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SizeofResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LockResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LoadResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FindResourceW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FindResourceExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ExitProcess"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "lstrlenW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LoadLibraryW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FreeLibrary"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateDirectoryW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GlobalFree"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetModuleFileNameW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetFileAttributesW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetLastError"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "lstrcpyW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetModuleHandleW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetProcAddress"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetCurrentProcess"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateProcessW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetExitCodeProcess"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FindFirstFileW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DeleteFileW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetFileAttributesW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FindNextFileW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FindClose"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RemoveDirectoryW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetTempPathW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetTempFileNameW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetFileSize"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateFileW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetFileSizeEx"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "Process32FirstW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "Process32NextW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LoadLibraryExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InterlockedIncrement"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InterlockedDecrement"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "lstrcmpiW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LeaveCriticalSection"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RaiseException"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "EnterCriticalSection"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "MultiByteToWideChar"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InitializeCriticalSection"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DeleteCriticalSection"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetErrorMode"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FlushInstructionCache"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "MulDiv"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CopyFileW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetCurrentThreadId"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetLastError"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateMutexW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "MoveFileW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetVersion"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetCurrentThread"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GlobalAlloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateThread"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetCurrentProcessId"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "WideCharToMultiByte"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InterlockedExchange"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "lstrlenA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetSystemInfo"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ReadFile"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetFilePointer"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetFilePointerEx"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetFileTime"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "WriteFile"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "PeekMessageW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TranslateMessage"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DispatchMessageW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "MessageBoxW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsCharAlphaW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SystemParametersInfoW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetSystemMetrics"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CopyRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "OffsetRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetWindowRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "EqualRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "MoveWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetParent"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetFocus"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CharNextW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LoadAcceleratorsW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetClientRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "MapWindowPoints"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DefWindowProcW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "PostQuitMessage"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LoadIconW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetWindowTextW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetWindowPos"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "EnableMenuItem"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetSystemMenu"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "KillTimer"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LoadCursorW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateWindowExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ShowWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetKeyState"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreatePopupMenu"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "AppendMenuW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetCursorPos"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetTimer"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IntersectRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsRectEmpty"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ReleaseDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetSysColor"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetCursor"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DestroyWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "BeginPaint"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsWindowVisible"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "EnableWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetScrollPos"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ScreenToClient"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetScrollRange"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetScrollInfo"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetWindowDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "PtInRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InvalidateRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InflateRect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ClientToScreen"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetWindowPlacement"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetDesktopWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegisterClassW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetWindowRgn"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "UpdateWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetCapture"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ReleaseCapture"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsWindowEnabled"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetFocus"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetWindowTextW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DeleteObject"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetObjectW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateCompatibleDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SelectObject"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "DeleteDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "BitBlt"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetStockObject"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateSolidBrush"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetDeviceCaps"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegOpenKeyExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegQueryValueExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegCloseKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegEnumKeyW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegDeleteKeyW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegEnumKeyExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegSetValueExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegCreateKeyExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RegDeleteValueW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "OpenThreadToken"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "OpenProcessToken"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetTokenInformation"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "EqualSid"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FreeSid"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ShellExecuteW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SHGetFolderPathW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ShellExecuteExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CoCreateInstance"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CoTaskMemFree"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CoTaskMemRealloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CoInitialize"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CoUninitialize"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "PathIsDirectoryW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "PathCanonicalizeW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetCloseHandle"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetCrackUrlA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetOpenW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetSetOptionW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetConnectA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HttpAddRequestHeadersW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HttpQueryInfoW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetErrorDlg"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HttpSendRequestW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HttpSendRequestExW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetWriteFile"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HttpEndRequestW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HttpOpenRequestA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetQueryOptionW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InternetReadFile"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HeapDestroy"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HeapAlloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HeapFree"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HeapReAlloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HeapSize"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetProcessHeap"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LoadLibraryA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "VirtualFree"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "VirtualAlloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "ExitThread"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TerminateProcess"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsDebuggerPresent"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetStartupInfoW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TlsGetValue"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TlsAlloc"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TlsSetValue"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "TlsFree"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "HeapCreate"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetCPInfo"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetACP"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetOEMCP"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsValidCodePage"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LCMapStringW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetStdHandle"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetModuleFileNameA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetTimeFormatA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetDateFormatA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetLocaleInfoA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "IsValidLocale"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetStringTypeA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetStringTypeW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetHandleCount"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetFileType"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetStartupInfoA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "RtlUnwind"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetCommandLineW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "LCMapStringA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetConsoleCP"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetConsoleMode"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CompareStringW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetLocaleInfoW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetModuleHandleA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "SetStdHandle"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "FlushFileBuffers"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "WriteConsoleA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "WriteConsoleW"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CreateFileA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "CompareStringA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "UnregisterClassA"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetGetConnectedState"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "EqualRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LoadAcceleratorsW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "PathIsDirectoryW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "PathCanonicalizeW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestExW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HttpEndRequestW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")3f:T405,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "ShellExecute@s" (Indicator: "ShellExecute"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "@@rShellExecute('%s')failed" (Indicator: "ShellExecute"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "ShellExecute@s" (Indicator: "ShellExecute"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "@@rShellExecute('%s')failed" (Indicator: "ShellExecute"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")40:T49b,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "LockResource" (Indicator: "LockResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")41:T450,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetCommandLine@v" (Indicator: "GetCommandLine"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetCommandLine() =='%s'" (Indicator: "GetCommandLine"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetCommandLine@i" (Indicator: "GetCommandLine"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetCommandLine@v" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "GetCommandLine() =='%s'" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetCommandLine@i" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")42:T5aa,"Software\Microsoft\Windows\CurrentVersion" in Source: BANDIZIP-SETUP-STD-X64 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000844.00000000.68574.0046C000.00000002.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Cryptography\Providers\Microsoft SSL Protocol Provider" in Source: 00000000-00000844.00000000.68574.02A00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000844.00000000.68574.02A40000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000844.00000000.68574.02A40000.00000004.mdmp "- \f1 Major upgrade is a service that improves the current program by replacing it with a new version of the program having major changes. The first digit of the software\rquote\f0 s version number is changed after a major upgrade is applied. (For example, a software version of V1.0 may change to V2.0 by a major upgrade.)\par" in Source: 00000000-00000844.00000000.68574.04978000.00000004.mdmp "- \f1 Minor upgrade is a service that improves the current program by replacing it with a new version of the program having minor changes. The digits of the software\rquote\f0 s version number other than the first digit are changed after a minor upgrade is applied. (For example, V4.1 may change to V4.2 by a minor upgrade.)\par" in Source: 00000000-00000844.00000000.68574.04978000.00000004.mdmp43:T576,Launches browser "msedge.exe" (UID: 00000000-00001028) Launches browser "msedge.exe" (UID: 00000000-00004100) Launches browser "msedge.exe" (UID: 00000000-00003912) Launches browser "msedge.exe" (UID: 00000000-00000100) Launches browser "msedge.exe" (UID: 00000000-00006744) Launches browser "msedge.exe" (UID: 00000000-00007692) Launches browser "msedge.exe" (UID: 00000000-00002384) Launches browser "msedge.exe" (UID: 00000000-00007688) Launches browser "msedge.exe" (UID: 00000000-00000196) Launches browser "msedge.exe" (UID: 00000000-00005900) Launches browser "msedge.exe" (UID: 00000000-00003668) Launches browser "msedge.exe" (UID: 00000000-00007716) Launches browser "msedge.exe" (UID: 00000000-00006812) Launches browser "msedge.exe" (UID: 00000000-00007172) Launches browser "msedge.exe" (UID: 00000000-00002568) Launches browser "msedge.exe" (UID: 00000000-00006956) Launches browser "msedge.exe" (UID: 00000000-00001116) Launches browser "msedge.exe" (UID: 00000000-00001864) Launches browser "msedge.exe" (UID: 00000000-00003524) Launches browser "msedge.exe" (UID: 00000000-00004360) Launches browser "msedge.exe" (UID: 00000000-00005128) Launches browser "msedge.exe" (UID: 00000000-00000368) Launches browser "msedge.exe" (UID: 00000000-00002644) Launches browser "msedge.exe" (UID: 00000000-00006116) Launches browser "msedge.exe" (UID: 00000000-00000380)44:T11d2,"4a7175ef-4de6-40bc-bf2d-4ef26c092798.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 270772" - Location: [%TEMP%\4a7175ef-4de6-40bc-bf2d-4ef26c092798.tmp] "05d65312-5211-4ff8-80dd-f728d470c8ce.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 10147" - Location: [%TEMP%\05d65312-5211-4ff8-80dd-f728d470c8ce.tmp] "a0516d5c-1a5a-41b2-83dc-668493ba25b9.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\a0516d5c-1a5a-41b2-83dc-668493ba25b9.tmp] "9cbc8eb4-35bd-4f6d-9b99-cf0d568bf15e.tmp" has type "JSON data" "c139b493-6763-43c2-9fe4-e679a50bba8a.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\c139b493-6763-43c2-9fe4-e679a50bba8a.tmp] "44eb5065-ab1c-43e1-bf1f-2d91268fffb9.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\44eb5065-ab1c-43e1-bf1f-2d91268fffb9.tmp] "e155c9e0-0821-4a29-96b8-83ed544c5df6.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e155c9e0-0821-4a29-96b8-83ed544c5df6.tmp] "b057b7b8-a64c-4f1b-a414-12885ff53606.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b057b7b8-a64c-4f1b-a414-12885ff53606.tmp] "85c8ea19-fed9-4818-986e-780fd4adffba.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\85c8ea19-fed9-4818-986e-780fd4adffba.tmp] "5b896241-2d5e-4685-85d7-b18cc348bec0.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5b896241-2d5e-4685-85d7-b18cc348bec0.tmp] "c6cc1078-4fe3-4fe2-a0da-1698afc3b2f1.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\c6cc1078-4fe3-4fe2-a0da-1698afc3b2f1.tmp] "0069a993-e67b-4d85-b101-594779cba439.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\0069a993-e67b-4d85-b101-594779cba439.tmp] "7b740f5e-25a7-4435-ae17-609507834c73.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\7b740f5e-25a7-4435-ae17-609507834c73.tmp] "92e394fa-1307-4649-a2b2-b67b215ac54e.tmp" has type "ASCII text with very long lines with no line terminators" "3f1b6618-1811-4815-8078-f4d2948d776d.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3f1b6618-1811-4815-8078-f4d2948d776d.tmp] "4becda91-2c57-4ba4-8ffc-7a9c3eb8c071.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4becda91-2c57-4ba4-8ffc-7a9c3eb8c071.tmp] "1f2e2b72-09ba-43ae-8563-f9d2dcd613fc.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\1f2e2b72-09ba-43ae-8563-f9d2dcd613fc.tmp] "6000421a-5941-40d4-9537-755216518506.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6000421a-5941-40d4-9537-755216518506.tmp] "8b608253-ed5d-44d7-a215-5e7b17bb4505.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\8b608253-ed5d-44d7-a215-5e7b17bb4505.tmp] "b1bbe51d-d419-4994-a129-c3fbab6f1e25.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\b1bbe51d-d419-4994-a129-c3fbab6f1e25.tmp] "2146243a-c463-4507-b65d-c9ada07b9677.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260" - Location: [%TEMP%\2146243a-c463-4507-b65d-c9ada07b9677.tmp] "93c2d563-57b1-43a7-826e-83fdb73ffcdb.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\93c2d563-57b1-43a7-826e-83fdb73ffcdb.tmp] "0d966881-f1fb-4f35-bc44-27f55500e4a1.tmp" has type "very short file (no magic)" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\0d966881-f1fb-4f35-bc44-27f55500e4a1.tmp]45:T9c9,"BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKCU\ZONEMAP\RANGES\"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "")46:Tc2c,"BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIGRATEPROXY"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOCONFIGURL"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTODETECT"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DIALUPAUTODETECT"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "AUTOPROXYAUTOLOGONIFCHALLENGED"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WINHTTPLOWERCASEHOST"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: "FLAGS"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: "FLAGS"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: "FLAGS"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "FLAGS"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4"; Key: "FLAGS"; Value: "")47:T6b1,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")48:T8c7,Observed string: ""curlbible.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlcandi.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldaze.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldefinition.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlflip.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfriendcollective.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfrodisiac.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlkalon.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlmix.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curls.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsandpotions.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsdynasty.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsmith.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsnolye.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsofcolor.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsponge.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curltastic.co"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyair.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlycupcakes.ca"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlboutique.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlzcandy.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyheaven.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlykisses.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshayco.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshiny.com"," (Indicator: ""curl") in Source: wallet-stable.json49:T52b,file/memory contains long string with (Indicator: "githubusercontent.com"; File: "History") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "000003.log") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "8b608253-ed5d-44d7-a215-5e7b17bb4505.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "8b608253-ed5d-44d7-a215-5e7b17bb4505.tmp") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "b1bbe51d-d419-4994-a129-c3fbab6f1e25.tmp") file/memory contains long string with (Indicator: ".googleapis.com"; File: "b1bbe51d-d419-4994-a129-c3fbab6f1e25.tmp") file/memory contains long string with (Indicator: "drive.google.com"; File: "Content") file/memory contains long string with (Indicator: "docs.google.com"; File: "Content") file/memory contains long string with (Indicator: "script.google.com"; File: "Content") Found string "fonts.googleapis.com" (Indicator: ".googleapis.com"; File: "PCAP") file/memory contains long string with (Indicator: ".googleapis.com"; File: "wallet-stable.json") Found string ""maps.googleapis.com"," (Indicator: ".googleapis.com"; File: "wallet-stable.json") file/memory contains long string with (Indicator: ".googleapis.com"; File: "wallet-pre-stable.json")4a:T6e2,Observed email domain:""colourpop.com"," [Source: wallet-stable.json] Observed email domain:""aepop.net"," [Source: wallet-stable.json] Observed email domain:""artpop.com"," [Source: wallet-stable.json] Observed email domain:""avenuepop.com"," [Source: wallet-stable.json] Observed email domain:""bassettbmx.com"," [Source: wallet-stable.json] Observed email domain:""canvasmx.com"," [Source: wallet-stable.json] Observed email domain:""drinkolipop.com"," [Source: wallet-stable.json] Observed email domain:""fashionfunpop.com"," [Source: wallet-stable.json] Observed email domain:""fastandloosebmx.com"," [Source: wallet-stable.json] Observed email domain:""flitebmx.com"," [Source: wallet-stable.json] Observed email domain:""fofopop.com"," [Source: wallet-stable.json] Observed email domain:""gellipop.com"," [Source: wallet-stable.json] Observed email domain:""gforcemx.com"," [Source: wallet-stable.json] Observed email domain:""happipop.com"," [Source: wallet-stable.json] Observed email domain:""hauzofpop.com"," [Source: wallet-stable.json] Observed email domain:""hiccapop.com"," [Source: wallet-stable.json] Observed email domain:""hijabipop.com"," [Source: wallet-stable.json] Observed email domain:""jellypop.la"," [Source: wallet-stable.json] Observed email domain:""kinkbmx.com"," [Source: wallet-stable.json] Observed email domain:""kloudkpop.com"," [Source: wallet-stable.json] Observed email domain:""knitpop.com"," [Source: wallet-stable.json] Observed email domain:""kpop.exchange"," [Source: wallet-stable.json] Observed email domain:""laperlamx.com"," [Source: wallet-stable.json] Observed email domain:""lovepop.com"," [Source: wallet-stable.json] Observed email domain:""lullipop.com"," [Source: wallet-stable.json]4b:T4676,Found URL "https://log.bandi.so/dump/upload.phpxrecvmsftedit.dllriched32.dllriched20.dll\\?\c:\program" - Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found URL "https://log.bandi.so/error/app.php?name=%s&builddate=%s&version=%s&log=%sadvapi32.dllhkey_local_machinehkey_current_userhkey_classes_roothklmhkcuhkcr" - Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-x64.exenedritecture=x86processor_archoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://ver.bandi.so/bandizip.std/versioninfo.inihttps://ver.bandi.so/bandizip.std/versioninfo.iniautomatically" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-stdhklm/software/microsoft/windows/currentversion/app" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-stdinstallation" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://www.bandisoft.com/bandizip/help/how-to-register/z.exefilename" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://www.bandisoft.com/bandizip/https://www.bandisoft.com/bandizip/:\windows\system32\windows.globalization.dllhklm/software/bandizip/programfolderhttp://www.bandisoft.com/bandizip/old/eport:\windows\system32\ondemandconnroutehelper.dlltem32\windows.glem32\ondemandcoachecalrpcskin/icon40.pngshadowwindowclass:\/" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://www.bandisoft.com/bandizip/help/" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://ver.bandi.so/ver.bandi.so!%,>ahqwloxp" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-x64.exeurl1" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-all.exeurl1" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-x64.exemicrosoft" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-x64.exeoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-all.exe:\;c:\windows\system32;c:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\program" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-all.exesafd" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://crc32" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://libexif.x86.dlllocalversionlibmf.x86.dllmessagebox@silibraw.x86.dlllibbpg.x86.dllserverversiononcheckversion6351aecaoncheckversion@nd" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-all.exemicrosoft" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-x64.exebrainpoolp384t1ecdhcryptoidinfoeccparametersbrainpoolp384t1ecdsacryptoidinfoeccparametersbrainpoolp512t1ecdsacryptoidinfoeccparametersbrainpoolp512r1ecdsacryptoidinfoeccparametersbrainpoolp512r1ecdhcryptoidinfoeccparametersbrainpoolp512t1ecdhcryptoidinfoeccparametersbrainpoolp160r1ecdsacryptoidinfoeccparametersbrainpoolp160t1ecdhcryptoidinfoeccparametersbrainpoolp224r1ecdhcryptoidinfoeccparametersbrainpoolp160t1ecdsacryptoidinfoeccparametersbrainpoolp192t1ecdhcryptoidinfoeccparametersbrainpoolp224t1ecdsacryptoidinfoeccparametersbrainpoolp256r1ecdsacryptoidinfoeccparametersbrainpoolp256t1ecdsacryptoidinfoeccparametersbrainpoolp160r1ecdhcryptoidinfoeccparametersbrainpoolp224t1ecdhcryptoidinfoeccparametersbrainpoolp320t1ecdsacryptoidinfoeccparametersbrainpoolp192r1ecdsacryptoidinfoeccparametersbrainpoolp320r1ecdhcryptoidinfoeccparametersbrainpoolp256r1ecdhcryptoidinfoeccparametersbrainpoolp320r1ecdsacryptoidinfoeccparametersbrainpoolp320t1ecdhcryptoidinfoeccparametersbrainpoolp384r1ecdsacryptoidinfoeccparametersbrainpoolp384r1ecdhcryptoidinfoeccparametersbrainpoolp256t1ecdhcryptoidinfoeccparametersbrainpoolp192r1ecdhcryptoidinfoeccparametersbrainpoolp224r1ecdsacryptoidinfoeccparametersbrainpoolp192t1ecdsacryptoidinfoeccparametersisallowedcert_autoupdate_1??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649entrust.neticrosoft" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://ver.bandi.so/bandizip.std/versioninfo.inig" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://ver.bandi.so/bandizip.std/versioninfo.inis'prp@'prd00000000000000000000000000000000000000000000000000000000000000000000000000oduc" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-x64.exeurl2" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bandizip-setup-std-all.exeurl2" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.cfzip.std/bandizip-setup-std-x64.exeurl2" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bw.com/bandizip.std/bandizip-setup-std-x64.exel3" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/band/bandizip-setup-std-all.exeurl2" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://soft.com/bandizip.std/bandizip-setup-std-all.exeurl3" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.com/bandizip.std/bantup-std-all.exeurl2" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://dl.bandisoft.izip.std/bandizip-setup-std-all.exeurl2" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcn.+k9iqmgvw,czcfw4=0" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0.crlqhttpqfileqptvwqhttps2.23.42.7.0qldap2.5.29.162.5.29.10pkcspagwx" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.60.3.1geotrust" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://crlft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/mca2011_2011-03-29.crt0iusai:" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/c" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.1.3.132.0.10ecdp+a6" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pro;ccerlisca2011_2011-03-29.crl0]q0o0m/www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.t<" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2_'0" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://www.microsoft." - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp") Found URL "http://microsoft.co[" - Source: "00000000-00000844.00000000.68574.07CE0000.00000004.mdmp")4c:T456,"BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "50398643" "cx": "16" "cy": "16"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "755042682" "cx": "17" "cy": "246"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "184616774" "cx": "17" "cy": "246"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "755042682" "cx": "17" "cy": "212"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100731144" "cx": "496" "cy": "22"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "184616774" "cx": "17" "cy": "212"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100731144" "cx": "17" "cy": "212"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100731144" "cx": "75" "cy": "23"} "BANDIZIP-SETUP-STD-X64.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "184616774" "cx": "75" "cy": "23"}4d:T900,Found string "SymGetModuleBase64" (Indicator: "base64"; File: "BANDIZIP-SETUP-STD-X64") file/memory contains long string with (Indicator: "base64"; File: "wallet-icon.svg") file/memory contains long string with (Indicator: "aes"; File: "4a7175ef-4de6-40bc-bf2d-4ef26c092798.tmp") file/memory contains long string with (Indicator: "aes"; File: "f_0004c9") file/memory contains long string with (Indicator: "base64"; File: "Web Data") file/memory contains long string with (Indicator: "aes"; File: "wallet-tokenization-config.json") file/memory contains long string with (Indicator: "aes"; File: "urlref_httpswww.bandisoft.combandizip") file/memory contains long string with (Indicator: "aes256"; File: "urlref_httpswww.bandisoft.combandizip") file/memory contains long string with (Indicator: "aes"; File: "strings.json") file/memory contains long string with (Indicator: "aes"; File: "driver-signature.txt") file/memory contains long string with (Indicator: "aes"; File: "8b608253-ed5d-44d7-a215-5e7b17bb4505.tmp") file/memory contains long string with (Indicator: "aes"; File: "b1bbe51d-d419-4994-a129-c3fbab6f1e25.tmp") Found string ""403designs.com"," (Indicator: "3des"; File: "wallet-stable.json") Found string ""8bitaesthetics.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""acceleratedaesthetics.shop"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesajewelry.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesbowco.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aeshaafricanbaskets.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aeshascloset.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesop.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesoprock.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestacia.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestelance.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestherapy.co"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestheticafcandles.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestheticautosolutions.com"," (Indicator: "aes"; File: "wallet-stable.json")4e:T58c,Found reference to API "GetDC" (Indicator: "GetDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")4f:T7f4,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")50:T499,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")51:T5ac,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")52:T42c,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")53:T977,file/memory contains long string with (Indicator: "password"; File: "shimmer.js") Found string ""MEANINGFUL_NAME": { "en": [ { "positive_pattern": "^(((field|input)(_|-)?\\d+)|.*captcha.*|(security|access).*code|one.*time.*password)$|(_|-|^)+otp+(_|-)?" } ]" (Indicator: "password"; File: "regex_patterns.json") Found string ""victoriassecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""airmidbeautysecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""amirasecretscosmedic.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""aphroditessecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""beautysecretscosmetics.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""beautysecretsusa.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""bellessecrets.org"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""bestkeptsecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""chicsecretsjewelry.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""cinemasecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""daintysecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""danassecretcloset.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""dbeautysecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""desirablesecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""dirtysecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""eastafricansecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""fantasyandsecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""godivassecretwigs.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""herhiddensecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""herlittlesecretcollection.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""honeysnailsecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""humboldtssecretsupplies.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""kinkysecretsbeauty.com"," (Indicator: "secret"; File: "wallet-stable.json")54:Tec8,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "DeleteFile@s" (Indicator: "DeleteFile"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RemoveDirectory@s" (Indicator: "RemoveDirectory"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "DeleteFile@s" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "RemoveDirectory@s" (Indicator: "RemoveDirectory"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "DeleteFile(instDirPath + "Ark32lgpl.dll");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "Ark64lgpl.dll");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "ArkLicense.txt");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "Bandizip32.exe");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "Bandizip64.exe");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "RegDll32.exe");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "RegDll64.exe");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "resource.h");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "skin.data");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "skina.data");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "skin.zip");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "skina.zip");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "bz.exe");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "unace32.exe");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "unacev2.dll");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "Aiview32.exe");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "DeleteFile(instDirPath + "Ark32.dll");" (Indicator: "DeleteFile"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp")55:T6b5,Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegDeleteKey@s" (Indicator: "RegDeleteKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegDeleteKey64@s" (Indicator: "RegDeleteKey"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "RegDeleteKey@s" (Indicator: "RegDeleteKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "RegDeleteKey64@s" (Indicator: "RegDeleteKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "RegDeleteKey64("HKLM/Software/Microsoft/Windows/CurrentVersion/App Paths/bz.exe/");" (Indicator: "RegDeleteKey"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp") Found reference to API "RegDeleteKey64("HKCU/Software/Microsoft/Windows/CurrentVersion/App Paths/bz.exe/");" (Indicator: "RegDeleteKey"; Source: "00000000-00000844.00000000.68574.04978000.00000004.mdmp")56:T4cd,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "BANDIZIP-SETUP-STD-X64") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000844.00000000.68574.0046C000.00000002.mdmp")57:T813,"BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "BANDIZIP-SETUP-STD-X64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "")58:T75b,""4amscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""6whiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""99centsubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""allieandmickey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""alteregoscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""annabelbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""aspirefashionscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""augustbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""bananasmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""baseballmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautiiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautyandwhiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bellagracehealthscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""belleandbubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""beyondblessedscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""blingbykey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""boosted-luckey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bowlingmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""burgeonbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""busybeescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cabbagekey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""coatsandscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""codenxtscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cognitiontsscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""concreterosescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com")59:Teef,Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00001028] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00001028] Dropped file: "000009.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00001028] Dropped file: "f_0004ca" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ca]- [targetUID: 00000000-00000100] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00001028] Dropped file: "f_0004cd" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cd]- [targetUID: 00000000-00000100] Dropped file: "000014.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00001028] Dropped file: "f_0004c9" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00000100] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00001028] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00001028] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00001028] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00001028] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00001028] Dropped file: "index" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00001028] Dropped file: "History" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00001028] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00001028] Dropped file: "Web Data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00001028] Dropped file: "f_0004cb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cb]- [targetUID: 00000000-00000100] Dropped file: "Visited Links" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00001028] Dropped file: "a0516d5c-1a5a-41b2-83dc-668493ba25b9.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\a0516d5c-1a5a-41b2-83dc-668493ba25b9.tmp]- [targetUID: 00000000-00001028] Dropped file: "Tabs_13340317717854153" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13340317717854153]- [targetUID: 00000000-00001028] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00000100] Dropped file: "Session_13340317717340928" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Session_13340317717340928]- [targetUID: 00000000-00001028] Dropped file: "Diagnostic Data-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Diagnostic Data-wal]- [targetUID: 00000000-00001028] Dropped file: "c139b493-6763-43c2-9fe4-e679a50bba8a.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\c139b493-6763-43c2-9fe4-e679a50bba8a.tmp]- [targetUID: 00000000-00001028]5a:T1a3f,"2023/09/27-12:48:34.759 b20 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-0000012023/09/27-12:48:34.760 b20 Recovering log #92023/09/27-12:48:34.767 b20 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000009.log 2023/09/27-12:48:40.977 b20 Level-0 table #13: started2023/09/27-12:48:41.001 b20 Level-0 table #13: 854998 bytes OK2023/09/27-12:48:41.006 b20 Delete type=0 #92023/09/27-12:48:41.006 b20 Compacting 4@0 + 0@1 files2023/09/27-12:48:41.040 b20 Generated table #14@0: 3 keys, 456576 bytes2023/09/27-12:48:41.040 b20 Compacted 4@0 + 0@1 files => 456576 bytes2023/09/27-12:48:41.041 b20 compacted to: files[ 0 1 0 0 0 0 0 ]2023/09/27-12:48:41.043 b20 Delete type=2 #32023/09/27-12:48:41.043 b20 Delete type=2 #72023/09/27-12:48:41.043 b20 Delete type=2 #102023/09/27-12:48:41.043 b20 Delete type=2 #13" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:36.437 1dd0 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-0000012023/09/27-12:48:36.438 1dd0 Recovering log #32023/09/27-12:48:36.439 1dd0 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:53.354 1334 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-0000012023/09/27-12:48:53.355 1334 Recovering log #32023/09/27-12:48:53.356 1334 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:38.682 17f0 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-0000012023/09/27-12:48:38.683 17f0 Recovering log #32023/09/27-12:48:38.683 17f0 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:34.758 12bc Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-0000012023/09/27-12:48:34.760 12bc Recovering log #32023/09/27-12:48:34.760 12bc Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:35.346 17f0 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-0000012023/09/27-12:48:35.347 17f0 Recovering log #32023/09/27-12:48:35.347 17f0 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:35.337 10f0 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications/MANIFEST-0000012023/09/27-12:48:35.342 10f0 Recovering log #32023/09/27-12:48:35.343 10f0 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:35.340 450 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-0000012023/09/27-12:48:35.340 450 Recovering log #32023/09/27-12:48:35.341 450 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:36.433 1334 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-0000012023/09/27-12:48:36.437 1334 Recovering log #42023/09/27-12:48:36.439 1334 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000004.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:41.115 1724 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-0000012023/09/27-12:48:41.121 1724 Recovering log #32023/09/27-12:48:41.845 1724 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:34.830 b20 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-0000012023/09/27-12:48:34.830 b20 Recovering log #32023/09/27-12:48:34.830 b20 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:34.873 b48 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-0000012023/09/27-12:48:34.873 b48 Recovering log #32023/09/27-12:48:34.874 b48 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:36.433 1f90 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-0000012023/09/27-12:48:36.436 1f90 Recovering log #42023/09/27-12:48:36.439 1f90 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000004.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:35.350 17f0 Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-0000012023/09/27-12:48:35.350 17f0 Recovering log #32023/09/27-12:48:35.352 17f0 Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2023/09/27-12:48:35.637 f6c Reusing MANIFEST C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-0000012023/09/27-12:48:35.638 f6c Recovering log #32023/09/27-12:48:35.638 f6c Reusing old log C:\Users\Me1uZMj\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAcAAAAAAAAAAAAAAAAAAAf/+HAAAAAAAAAAAAAAAAB4///4dwAAAAAAAAAAAAB4iI////+HcAAAAAAAAAAHiIiP//////hwAAAAAAAAiIiIj/iIiIeP/4cAAAAAeIiIiI+IiIiAAI//+HAACIiIiIiP+IiIgAB////3AH+IiIiIj///h3AAf///9wB4iIiIiI////cAAH////cAeIiIiIiP////cABnj//3AHiIiIiIj////4cAAHj/9wB4iIiIiIiP///4d3iIj/cAeIiIiIdkZo///4j/iIj3AHiIiIh2ZmaIiP////iP9wB4iIiGZmZoiHZnj/////cAeIiHZmZmiIh2ZmZ4///3AHiIZmZmaP//iIiGZmiP9wB/hmZmZo/////4ZmZmZ/cAeHZmZmj/////9mZmZmdwAAB2ZmZmZmj//2ZmZmZmAAAARmZmZmZo//dmZmZmZgAAAGZmZmZmaP+GZmZmZmYAAAAGZmZmZm/4ZmZmZmZgAAAABmZmZmaPhmZmZmZmYAAAAABmZmZm+GZmZmZmZgAAAAAABmZmZ4ZmZmZmZmYAAAAAAAZmZmZmZmZmZmZgAAAAAAAABmZmZmZmZmZmAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAAAGZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAD/wf///4A///8AB//8AAD/+AAAH+AAAAPAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAfgAAAH4AAAB/AAAA/wAAAP+AAAH/wAAB/8AAA//wAAf/+AAf//4AP//////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790469684995,"unified_at":"2026-09-27T00:41:24.995Z","metadata":{"hashes":{"sha256":"647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5","sha1":"c555f6e2af42445b2be3713fa767aee0510590c0","md5":"4eff842484a54224f397ba2e413d6847","sha512":"9b28969be11f7a5e005d5b0829c5c8a5d3547ba9ee7baf833113c63136fd87f4c15587e47b3349d4c45c0e090cfd4d612ced8969fe63a75c11ff06b5b77807e1","ssdeep":"196608:MDkBCdl0ZIg3H7g7xnq64TVSxLQ7GN+/7lGSDwRBXR:M4M7g8FnwSdQ71JEBB","ssdeep_chunks":["196608:MDkBCdl","196608:DkBCdl0","196608:kBCdl0Z","196608:BCdl0ZI","196608:Cdl0ZIg","196608:dl0ZIg3","196608:l0ZIg3H","196608:0ZIg3H7","196608:ZIg3H7g","196608:Ig3H7g7","196608:g3H7g7x","196608:3H7g7xn","196608:H7g7xnq","196608:7g7xnq6","196608:g7xnq64","196608:7xnq64T","196608:xnq64TV","196608:nq64TVS","196608:q64TVSx","196608:64TVSxL","196608:4TVSxLQ","196608:TVSxLQ7","196608:VSxLQ7G","196608:SxLQ7GN","196608:xLQ7GN+","196608:LQ7GN+/","196608:Q7GN+/7","196608:7GN+/7l","196608:GN+/7lG","196608:N+/7lGS","196608:+/7lGSD","196608:/7lGSDw","196608:7lGSDwR","196608:lGSDwRB","196608:GSDwRBX","196608:SDwRBXR","393216:MDkBCdl","393216:DkBCdl0","393216:kBCdl0Z","393216:BCdl0ZI","393216:Cdl0ZIg","393216:dl0ZIg3","393216:l0ZIg3H","393216:0ZIg3H7","393216:ZIg3H7g","393216:Ig3H7g7","393216:g3H7g7x","393216:3H7g7xn","393216:H7g7xnq","393216:7g7xnq6","393216:g7xnq64","393216:7xnq64T","393216:xnq64TV","393216:nq64TVS","393216:q64TVSx","393216:64TVSxL","393216:4TVSxLQ","393216:TVSxLQ7","393216:VSxLQ7G","393216:SxLQ7GN","393216:xLQ7GN+","393216:LQ7GN+/","393216:Q7GN+/7","393216:7GN+/7l","393216:GN+/7lG","393216:N+/7lGS","393216:+/7lGSD","393216:/7lGSDw","393216:7lGSDwR","393216:lGSDwRB","393216:GSDwRBX","393216:SDwRBXR","196608:M4M7g8F","196608:4M7g8Fn","196608:M7g8Fnw","196608:7g8FnwS","196608:g8FnwSd","196608:8FnwSdQ","196608:FnwSdQ7","196608:nwSdQ71","196608:wSdQ71J","196608:SdQ71JE","196608:dQ71JEB","196608:Q71JEBB"],"imphash":"0dbb0ba857c12a5b51ad7ac7e278a2eb"},"file_info":{"file_name":"BANDIZIP-SETUP-STD-X64.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6524904,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1637249054000,"last_seen":1695818735000,"last_multi_scan":1695818735000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","dyamar","floxif","neshta","evasive","banker","downloader","emotet","soft32downloader","windows-server-utility"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":189,"suspicious_count":40,"malicious_count":10,"total":239},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"malicious","value":"Modifies System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Checks for a resource fork (ADS) file"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"suspicious","value":"Contains ability to read monitor info"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Drops a license file"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates a writable file in a temporary directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Contains ability to download files from the internet"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Creates new processes"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"},{"type":"malicious","value":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 7215-2395-00403C07\n FindFirstFileExW@KERNEL32.dll at 27660-740-00409C01\n FindFirstFileExW@KERNEL32.dll at 32424-970-0040BA10\n FindFirstFileExW@KERNEL32.dll at 36914-467-000000014000BB2C\n FindFirstFileW@KERNEL32.dll at 40278-737-000000018000D1B0\n FindFirstFileW@KERNEL32.dll at 40278-1029-000000018000D10C\n FindFirstFileExW@KERNEL32.dll at 40278-1693-0000000180039644\n FindFirstFileW@KERNEL32.dll at 53615-1849-10017F60\n FindFirstFileW@KERNEL32.dll at 53615-1850-1001801E\n FindFirstFileExW@KERNEL32.dll at 61263-918-0000000140011D14","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.dll at 37801-6333-1000EBF0\n GetDriveTypeW@KERNEL32.dll at 37801-6339-10022C80\n GetDriveTypeW@KERNEL32.dll at 37801-6877-1015A398\n GetDriveTypeW@KERNEL32.dll at 37801-6890-1016727D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 7215-2387-00449EB8\n FileTimeToSystemTime@KERNEL32.dll at 37801-5138-100F8C40\n GetSystemTimeAsFileTime@KERNEL32.dll at 37801-6091-1016A9A7\n GetTimeZoneInformation@KERNEL32.dll at 37801-6491-10001C40\n FileTimeToSystemTime@KERNEL32.dll at 37801-6845-1005E970\n FileTimeToLocalFileTime@KERNEL32.dll at 37801-6860-10001D20\n FileTimeToSystemTime@KERNEL32.dll at 37801-6894-10159FAA\n GetSystemTimeAsFileTime@KERNEL32.dll at 40278-760-0000000180031B48\n GetTimeZoneInformation@KERNEL32.dll at 40278-2204-0000000180038A60\n GetSystemTimeAsFileTime@KERNEL32.dll at 46700-2060-1000D5B0\n GetSystemTimeAsFileTime@KERNEL32.dll at 53615-1920-100271A2\n GetTimeZoneInformation@KERNEL32.dll at 53615-2151-10038C47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 7215-2387-00449EB8\n GetSystemTimeAsFileTime@KERNEL32.dll at 37801-6091-1016A9A7\n GetSystemTimeAsFileTime@KERNEL32.dll at 40278-760-0000000180031B48\n GetSystemTimeAsFileTime@KERNEL32.dll at 46700-2060-1000D5B0\n GetSystemTimeAsFileTime@KERNEL32.dll at 53615-1920-100271A2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 37801-6491-10001C40\n GetTimeZoneInformation@KERNEL32.dll at 40278-2204-0000000180038A60\n GetTimeZoneInformation@KERNEL32.dll at 53615-2151-10038C47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 7215-2399-0040E8E3\n GetVersionExW@KERNEL32.dll at 46700-1676-1002E6E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.dll at 53615-1952-10037905\n EnumSystemLocalesW@KERNEL32.dll at 53615-1959-100372C8\n GetUserDefaultLCID@KERNEL32.dll at 53615-1987-1003F31F\n EnumSystemLocalesW@KERNEL32.dll at 53615-1988-1003EC60\n EnumSystemLocalesW@KERNEL32.dll at 53615-1989-1003ED46\n EnumSystemLocalesW@KERNEL32.dll at 53615-1992-1003ECAB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Bandizip.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"RegDll.x86.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"RegDll.x64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Bandizip.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"updater.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetSystemTimeAsFileTime@KERNEL32.dll directly followed by \"cmp ecx, eax\" and \"jnl 0000000180031BA0h\" at 40278-760-0000000180031B48\n Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0000000180038BA8h\" at 40278-2204-0000000180038A60\n Found API call GetSystemTimeAsFileTime@KERNEL32.dll directly followed by \"cmp ecx, 0483F078h\" and \"jnle 100271EDh\" at 53615-1920-100271A2\n Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 10038D71h\" at 53615-2151-10038C47","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 27660-1204-0040AC3E\n GetProcessHeap@KERNEL32.dll at 32424-1487-0040CA34\n GetProcessHeap@KERNEL32.dll at 36914-349-0000000140001D54\n GetProcessHeap@KERNEL32.dll at 40278-422-00000001800014F0\n GetProcessHeap@KERNEL32.dll at 46700-3252-1005B9F5\n GetProcessHeap@KERNEL32.dll at 53615-3262-1003AF9C\n GetProcessHeap@KERNEL32.dll at 61263-775-0000000140001978\n GetProcessHeap@KERNEL32.dll at 61263-783-0000000140006CEC\n GetProcessHeap@KERNEL32.dll at 61263-794-0000000140006C1C\n GetProcessHeap@KERNEL32.dll at 61263-796-0000000140006B9C\n GetProcessHeap@KERNEL32.dll at 65045-1649-00000001401BF270","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"%PROGRAMFILES%\\Bandizip\\Bandizip.exe\" at 00000000-00004080-00000046-29104255\n \"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"C:\\\" at 00000000-00004080-00000046-30154341\n \"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"%PROGRAMFILES%\\Bandizip\\Uninstall.exe\" at 00000000-00004080-00000046-30155968\n \"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"C:\\\" at 00000000-00004080-00000046-30253092\n \"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"%PROGRAMFILES%\\Bandizip\\Bandizip.exe\" at 00000000-00004080-00000046-30254823\n \"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"C:\\\" at 00000000-00004080-00000046-15083192209288190","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"C:\\\" at 00000000-00004080-00000046-30154341\n \"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"C:\\\" at 00000000-00004080-00000046-30253092\n \"BANDIZIP-SETUP-STD-X64.exe\" queries volume information of \"C:\\\" at 00000000-00004080-00000046-15083192209288190","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BANDIZIP-SETUP-STD-X64.EXE\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BANDIZIP-SETUP-STD-X64.EXE\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BZ.EXE\\\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BZ.EXE\\\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BANDIZIP.EXE\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BZ.EXE\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\BANDIZIP\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/64 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.sectigo.com\"\n \"ana.bandi.so\"\n \"log.bandi.so\"\n \"ver.bandi.so\"\n \"www.bandisoft.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.78.169.250:443\"\n \"142.250.69.200:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\devel\\inst\\bin.2008\\xstub.pdb\"\n \"C:\\devel\\tools\\RegDll2\\bin\\RegDll.x86.pdb\"\n \"C:\\devel\\tools\\RegPackage\\bin\\RegPackage.x86.pdb\"\n \"C:\\devel\\tools\\RegDll2\\bin\\RegDll.x64.pdb\"\n \"C:\\devel\\ark7\\bin.win32\\bzshell.x64.pdb\"\n \"C:\\devel\\ark7\\bin.win32\\ark.x86.lgpl.pdb\"\n \"C:\\devel\\ark7\\bin.win32\\bdzshl.x86.pdb\"\n \"C:\\devel\\ark7\\bin.win32\\Amsiman.x64.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"BANDIZIP-SETUP-STD-X64.exe\" created file \"%TEMP%\\Cab2D9A.tmp\"\n \"BANDIZIP-SETUP-STD-X64.exe\" created file \"%TEMP%\\Tar2D9B.tmp\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Bandizip\"\n \"Bandizip\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$28","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDzHc2p4PYe%2BXbRnPTZ8TTX HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$29","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Bandizip.exe\" (UID: 00000000-00003568) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Bandizip.exe\" (UID: 00000000-00003568) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"updater.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"BANDIZIP-SETUP-STD-X64.exe\" searching for class \"#32770\"\n \"BANDIZIP-SETUP-STD-X64.exe\" searching for class \"BandizipClass\"\n \"BANDIZIP-SETUP-STD-X64.exe\" searching for class \"BandizipUpdaterClass\"\n \"BANDIZIP-SETUP-STD-X64.exe\" searching for class \"ArkviewClass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2a","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2b","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2c","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"BANDIZIP-SETUP-STD-X64.exe\" connecting to \"\\ThemeApiPort\"\n \"Bandizip.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2d","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2e","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2f","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"updater.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"Bandizip.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"BANDIZIP-SETUP-STD-X64.exe\" opened \"\\Device\\KsecDD\"\n \"Bandizip.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"RegDll.x86.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Uninstall.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"bdzshl.x86.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"ark.x86.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"RegPackage.x86.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"ark.x86.lgpl.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"webview.x86.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"web32.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.00446975295","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"updater.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 7215-3045-0040739E\n FindResourceExW@KERNEL32.dll at 36914-403-00000001400013E4\n FindResourceW@KERNEL32.dll at 36914-404-0000000140001818\n LoadResource@KERNEL32.dll at 36914-406-0000000140001A90\n FindResourceW@KERNEL32.dll at 40278-519-0000000180002250\n LoadResource@KERNEL32.dll at 40278-521-0000000180001140\n FindResourceExW@KERNEL32.dll at 40278-522-00000001800011D0\n LoadResource@KERNEL32.dll at 53615-1862-1001AF9F\n FindResourceExW@KERNEL32.dll at 61263-676-0000000140001CA8\n FindResourceW@KERNEL32.dll at 61263-677-0000000140001B54\n LoadResource@KERNEL32.dll at 61263-682-0000000140001AB8\n LoadResource@KERNEL32.dll at 61263-820-00000001400050AC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"Bandizip.exe\" read file \"%PROGRAMFILES%\\Bandizip\\VersionNo.ini\"\n \"Bandizip.exe\" read file \"%PROGRAMFILES%\\Bandizip\\config.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$30","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$31","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"7.22.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 52.78.169.250 on port 443 is sent without HTTP header\n TCP traffic to 142.250.69.200 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 53615-1608-1000E091","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"Bandizip.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"updater.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 7215-2260-00446C16\n CreateToolhelp32Snapshot@KERNEL32.dll at 7215-2257-00404CF5\n CreateToolhelp32Snapshot@KERNEL32.dll at 36914-361-00000001400032C8\n CreateToolhelp32Snapshot@KERNEL32.dll at 36914-389-0000000140003118","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyState@USER32.dll at 7215-2707-0042CAB5\n GetKeyState@USER32.dll at 40278-1104-0000000180017EC0\n GetKeyState@USER32.dll at 40278-1185-0000000180018D29\n GetKeyState@USER32.dll at 53615-1800-10015CB9\n GetKeyState@USER32.dll at 53615-2447-100131C6\n GetKeyState@USER32.dll at 53615-2475-10015602","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$32","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"Bandizip.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"updater.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"Bandizip.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"Bandizip.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$35","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"lm.x64.dll\" has an entrypoint in section \".xyz1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$36","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$37","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Bandizip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Bandizip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"RegDll.x86.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"RegDll.x86.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"RegDll.x86.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5.bin\" (Offset: 449188)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 37801-6905-100583C0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/65 Antivirus vendors marked dropped file \"bdzshl.x86.dll\" as malicious (classified as \"Unsafe.AI_Score_99%\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$38","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\"; Key: \"2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\"; Key: \"BLOB\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\D1EB23A46D17D68FD92564C2F1F1601764D8E349\"; Key: \"BLOB\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\"; Key: \"D1EB23A46D17D68FD92564C2F1F1601764D8E349\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"Bandizip.exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$39","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SetTimer@ii\" (Indicator: \"SetTimer\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SetTimer@ii\" (Indicator: \"SetTimer\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"shopping.js\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"shopping.js\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"shopping.js\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"shopping.js\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"auto_open_controller.js\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"auto_open_controller.js\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HMAC\"; File: \"History\")\n file/memory contains long string with (Indicator: \"HMAC\"; File: \"000003.log\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"strings.json\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000844.00000000.68574.02A40000.00000004.mdmp, 00000000-00000844.00000000.68574.07CE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000844.00000000.68574.00400000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"msedge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\LOG\" to \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\LOG.old\"\n \"msedge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\9cbc8eb4-35bd-4f6d-9b99-cf0d568bf15e.tmp\" to \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\HubApps\"\n \"msedge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\LOG\" to \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\LOG.old\"\n \"msedge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\BrowserMetrics-spare.pma.tmp\" to \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics-spare.pma\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"BANDIZIP-SETUP-STD-X64\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"BANDIZIP-SETUP-STD-X64\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000844.00000000.68574.02A40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.966447308513693","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains reference to cryptographic keys","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"GetWindowTextW\" with parameter \"&Yes\" - (UID: 00000000-00000844)\n \"BANDIZIP-SETUP-STD-X64.exe\" called \"GetWindowTextW\" with parameter \"&No\" - (UID: 00000000-00000844)\n \"BANDIZIP-SETUP-STD-X64.exe\" called \"GetWindowTextW\" with parameter \"A new version is currently available. Would you like to download it now?\" - (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"GetActiveWindow\" (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00000844)\n \"BANDIZIP-SETUP-STD-X64.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00000844)\n \"BANDIZIP-SETUP-STD-X64.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 35794-2307-00421071\n GetTickCount@KERNEL32.dll at 35794-2312-004211D8\n GetTickCount@KERNEL32.dll at 35794-2336-00421152","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 35794-2387-00449EB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"strings.json\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.dll at 35794-2399-0040E8E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"\"; Value: \"\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"HTTPS\"; Value: \"\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"\"; Value: \"\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"HIDDEN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://www.bandisoft.com/bandizip/\" - (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SetTimer at 35794-2621-004227E0\n Sleep@KERNEL32.dll at 35794-2390-0040B3CC\n Sleep@KERNEL32.dll at 35794-2553-0041B296\n Sleep@KERNEL32.dll at 35794-2370-0040490F\n SetTimer at 35794-2291-00422004\n SetTimer at 35794-2613-00422348\n WaitForSingleObject@KERNEL32.dll at 35794-4395-0040EDA0\n Sleep@KERNEL32.dll at 35794-3003-004011CC\n Sleep@KERNEL32.dll at 35794-2391-0040B456\n SetTimer at 35794-2624-0041C966\n SetTimer at 35794-2622-00424E94\n Sleep@KERNEL32.dll at 35794-2554-0041B3D7\n WaitForSingleObject@KERNEL32.dll at 35794-2368-00401377\n Sleep@KERNEL32.dll at 35794-2420-0043821D\n Sleep@KERNEL32.dll at 35794-2499-0040F4C6\n SetTimer at 35794-2574-0041C744\n Sleep@KERNEL32.dll at 35794-2346-00409180\n SetTimer at 35794-2662-004222E2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: BANDIZIP-SETUP-STD-X64)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 35794-3386-00430089\n LoadLibraryExW@KERNEL32.dll at 35794-3045-0040739E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"DeleteOrMoveFile@s\" (Indicator: \"MoveFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"DeleteOrMoveFile@s\" (Indicator: \"MoveFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp, 00000000-00000844.00000000.68574.02A40000.00000004.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"ClassName:%s, GetLastError:%u\" (Indicator: \"GetLastError\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"e:%s, GetLastError:%u\" (Indicator: \"GetLastError\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"ClassName:%s, GetLastError:%u\" (Indicator: \"GetLastError\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"facebook.com\"; File: \"Social\")\n Found string \"zadn.vn/ansira.com/fcmatch.google.com/origo.hu/fcmatch.youtube.com/refersion.com/flocktory.com/vtex.com.br/rqtrk.eu/vocento.com/fingerprinter.msedgedemo.example/\" (Indicator: \"youtube\"; File: \"Fingerprinting\")\n Found string \"fcmatch.youtube.com/fcmatch.google.com/other-tracker.msedgedemo.example/\" (Indicator: \"youtube\"; File: \"Other\")\n Found string \"\"baysidebuddy.com\",\" (Indicator: \"ebuddy.com\"; File: \"wallet-stable.json\")\n Found string \"\"comeherebuddy.com\",\" (Indicator: \"ebuddy.com\"; File: \"wallet-stable.json\")\n Found string \"\"www.facebook.com\",\" (Indicator: \"facebook.com\"; File: \"wallet-stable.json\")\n Found string \"\"linkedin.com\",\" (Indicator: \"linkedin.com\"; File: \"wallet-stable.json\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$43","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"BANDIZIP-SETUP-STD-X64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 759F0000\n \"BANDIZIP-SETUP-STD-X64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 729F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"BANDIZIP-SETUP-STD-X64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77390000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"BANDIZIP-SETUP-STD-X64\" was detected as \"7-Zip\" and name: \"sfx\"\n \"BANDIZIP-SETUP-STD-X64\" was detected as \"Microsoft dotNet installer\" and name: \"Installer\"\n \"BANDIZIP-SETUP-STD-X64\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"BANDIZIP-SETUP-STD-X64\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"BANDIZIP-SETUP-STD-X64\" was detected as \"7-Zip\" and name: \"Archive\"\n \"BANDIZIP-SETUP-STD-X64\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"BANDIZIP-SETUP-STD-X64\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"BANDIZIP-SETUP-STD-X64\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"BANDIZIP-SETUP-STD-X64\" has an writable section named \".data\"\n \"BANDIZIP-SETUP-STD-X64\" has an writable section named \"ve_share\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"BANDIZIP-SETUP-STD-X64\" file has an entrypoint instructions - \"call\t0x45b9e4,jmp\t0x44bb6b,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tedx, dword ptr [esp + 0xc],mov\tecx, dword ptr [esp + 4],test\tedx, edx,je\t0x44bd75,xor\teax, eax,mov\tal, byte ptr [esp + 8],test\tal, al,jne\t0x44bd2c,cmp\tedx, 0x100,jb\t0x44bd2c,cmp\tdword ptr [0x488af0], 0,je\t0x44bd2c,jmp\t0x45bad1,push\tedi,mov\tedi, ecx,cmp\tedx, 4,jb\t0x44bd65,neg\tecx,and\tecx, 3,je\t0x44bd47,sub\tedx, ecx,mov\tbyte ptr [edi], al,add\tedi, 1,sub\tecx, 1,jne\t0x44bd3d,mov\tecx, eax,shl\teax, 8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cdn.jsdelivr.net\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"fundingchoicesmessages.google.com\"\n \"googleads.g.doubleclick.net\"\n \"lh3.googleusercontent.com\"\n \"pagead2.googlesyndication.com\"\n \"partner.googleadservices.com\"\n \"self.events.data.microsoft.com\"\n \"tpc.googlesyndication.com\"\n \"ver.bandi.so\"\n \"www.bandisoft.com\"\n \"www.google.com\"\n \"www.googleadservices.com\"\n \"www.googletagservices.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"shopping_fre.html\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"BANDIZIP-SETUP-STD-X64\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sslkey.txt\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\05d65312-5211-4ff8-80dd-f728d470c8ce.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a license file","description":"\"vendor.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00000844]\n \"wallet-drawer.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00000844]\n \"tokenized-card.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00000844]\n \"notification.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00000844]\n \"notification_fast.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00000844]","origin":"Binary File","mitre_attack_id":"T1083","relevance":1,"id":"binary-50","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$44","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"BANDIZIP-SETUP-STD-X64.exe\" reads file \"c:\\bandizip-setup-std-x64.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"BANDIZIP-SETUP-STD-X64.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"BANDIZIP-SETUP-STD-X64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\wininet.dll\"\n \"BANDIZIP-SETUP-STD-X64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"BANDIZIP-SETUP-STD-X64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"BANDIZIP-SETUP-STD-X64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\advapi32.dll\"\n \"BANDIZIP-SETUP-STD-X64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"BANDIZIP-SETUP-STD-X64.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"BANDIZIP-SETUP-STD-X64.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /bandizip.std/versioninfo.ini\" - (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"InternetReadFile\" with parameter 4096 (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"InternetOpenA with parameter Bandizip\" (UID: 00000000-00000844)\n \"BANDIZIP-SETUP-STD-X64.exe\" called \"InternetOpenW with parameter Bandizip\" (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$48","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"\"Content-Size: %uContent-Type: multipart/form-data; boundary=--==XHTTP_BOUNDARY_2848588jklJKL\"; File: \"BANDIZIP-SETUP-STD-X64\"), Found string \"Content-Size: %uContent-Type: multipart/form-data; boundary=--==XHTTP_BOUNDARY_2848588jklJKL\"; File: \"BANDIZIP-SETUP-STD-X64\"), Found string \"Content-Type: multipart/form-data; boundary=--==XHTTP_BOUNDARY_2848588jklJKL\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /bandizip.std/versioninfo.ini HTTP/1.1*\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000844.00000000.68574.02A40000.00000004.mdmp\")\n Found string \"Hostver.bandi.soGET /bandizip.std/versioninfo.ini HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000844.00000000.68574.02A40000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK',\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000844.00000000.68574.02A40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /bandizip.std/versioninfo.ini HTTP/1.1Accept: */*\n User-Agent: Bandizip\n Host: ver.bandi.so\n Connection: Keep-Alive\n Cache-Control: no-cache\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://log.bandi.so\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ver.bandi.so/bandizip.std/versioninfo.ini\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"52.78.169.250\" on port \"443\"\n HTTPS traffic to \"18.118.72.10\" on port \"443\"\n HTTPS traffic to \"151.101.1.229\" on port \"443\"\n HTTPS traffic to \"142.251.32.34\" on port \"443\"\n HTTPS traffic to \"142.251.46.194\" on port \"443\"\n HTTPS traffic to \"142.251.46.206\" on port \"443\"\n HTTPS traffic to \"142.250.189.163\" on port \"443\"\n HTTPS traffic to \"142.250.191.74\" on port \"443\"\n HTTPS traffic to \"142.250.189.193\" on port \"443\"\n HTTPS traffic to \"142.250.191.34\" on port \"443\"\n HTTPS traffic to \"142.251.32.33\" on port \"443\"\n HTTPS traffic to \"142.250.189.196\" on port \"443\"\n HTTPS traffic to \"142.250.188.3\" on port \"443\"\n HTTPS traffic to \"51.104.15.253\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"\"fingerhut.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json\n Observed string: \"\"fingerlakescoffee.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json\n Observed string: \"\"fingerprintsbylivescan.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$4c","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: BANDIZIP-SETUP-STD-X64)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$53","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000844.00000000.68574.00868000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000844.00000000.68574.02A40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: BANDIZIP-SETUP-STD-X64]\n Observed import api \"EqualSid\" which can \"Tests two security identifier (SID) values for equality\" [Source: BANDIZIP-SETUP-STD-X64]\n Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: BANDIZIP-SETUP-STD-X64]\n Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: BANDIZIP-SETUP-STD-X64]\n Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: BANDIZIP-SETUP-STD-X64]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00000844.00000000.68574.04860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"BANDIZIP-SETUP-STD-X64\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000844.00000000.68574.0046C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"$58","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$59","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"BANDIZIP-SETUP-STD-X64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"\\explorer.exe\" (Indicator: \"explorer.exe\"; File: \"BANDIZIP-SETUP-STD-X64\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMMANUFACTURER\")\n \"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMPRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to read monitor info","description":"GetMonitorInfoW@USER32.dll at 35794-2615-0041CFDF\n GetMonitorInfoW@USER32.dll at 35794-2740-004315EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-62","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 35794-2253-00403319\n GetModuleHandleW@KERNEL32.dll at 35794-3064-0040752E\n GetModuleHandleW@KERNEL32.dll at 35794-2399-0040E8E3\n GetModuleHandleW@KERNEL32.dll at 35794-2398-00403F73\n GetModuleHandleW@KERNEL32.dll at 35794-3040-00405910\n GetModuleHandleA@KERNEL32.dll at 35794-2889-0045F89F\n GetModuleHandleW@KERNEL32.dll at 35794-2400-004042A7\n GetModuleHandleW@KERNEL32.dll at 35794-2411-004416D9\n GetModuleHandleW@KERNEL32.dll at 35794-2268-004069E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextLengthW@USER32.dll at 35794-3391-00430020","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 35794-1-0044BCE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.dll at 35794-2548-0041AEEE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 151.101.1.229\"\n \"UDP connection to 142.251.32.34\"\n \"UDP connection to 142.251.46.194\"\n \"UDP connection to 142.251.46.206\"\n \"UDP connection to 142.250.189.193\"\n \"UDP connection to 142.250.189.196\"\n \"UDP connection to 142.250.191.34\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\"msedge.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: BANDIZIP-SETUP-STD-X64\n \"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00000844.00000000.68574.0046C000.00000002.mdmp\n 00000000-00000844.00000000.68574.031F0000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00000844.00000000.68574.031F0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 35794-2615-0041CFDF\n SystemParametersInfoW@USER32.dll at 35794-2740-004315EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00000844.00000000.68574.04860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 35794-3064-0040752E\n GetModuleFileNameW@KERNEL32.dll at 35794-3040-00405910","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"\"dailywire.com\",\" (Indicator: \"wire.com\"; File: \"wallet-stable.json\")\n \"\"hotwire.com\",\" (Indicator: \"wire.com\"; File: \"wallet-stable.json\")\n \"\"thefretwire.com\",\" (Indicator: \"wire.com\"; File: \"wallet-stable.json\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"2023/09/27-12:48:36.437 1dd0 Reusing MANIFEST C:\\Users\\Me1uZMj\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb/MANIFEST-0000012023/09/27-12:48:36.438 1dd0 Recovering log #32023/09/27-12:48:36.439 1dd0 Reusing old log C:\\Users\\Me1uZMj\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb/000003.log\" in Source: LOG\n \"2023/09/27-12:48:36.433 1334 Reusing MANIFEST C:\\Users\\Me1uZMj\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb/MANIFEST-0000012023/09/27-12:48:36.437 1334 Recovering log #42023/09/27-12:48:36.439 1334 Reusing old log C:\\Users\\Me1uZMj\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb/000004.log\" in Source: LOG","origin":"File/Memory","mitre_attack_id":"T1005","relevance":3,"id":"string-133","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.dll at 35794-2395-00403C07\n RemoveDirectoryW@KERNEL32.dll at 35794-2346-00409180","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://www.bandisoft.com/bandizip/\" - (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"BANDIZIP-SETUP-STD-X64.exe\" called \"ShellExecuteW\" with parameter https://www.bandisoft.com/bandizip/ (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"level":"malicious","category":"Network Related","name":"Detected many DNS responses with a low TTL","description":"\"cdn.jsdelivr.net\" with TTL 133\n \"fonts.googleapis.com\" with TTL 83\n \"fonts.gstatic.com\" with TTL 132\n \"fundingchoicesmessages.google.com\" with TTL 300\n \"googleads.g.doubleclick.net\" with TTL 212\n \"lh3.googleusercontent.com\" with TTL 118\n \"pagead2.googlesyndication.com\" with TTL 300\n \"partner.googleadservices.com\" with TTL 300\n \"self.events.data.microsoft.com\" with TTL 40\n \"tpc.googlesyndication.com\" with TTL 287\n \"www.google.com\" with TTL 255\n \"www.googleadservices.com\" with TTL 123\n \"www.googletagservices.com\" with TTL 205\n \"www.gstatic.com\" with TTL 4","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Modifies System Certificates Settings"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"Fingerprint","details_count":8,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}]},"activity":{"stats":{"process_count":33,"spawned_processes_count":33,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":204,"dropped_files_count":0,"extracted_files_count":48,"files_written_count":254,"files_deleted_count":0,"registry_keys_created_count":122,"registry_keys_modified_count":0,"registry_keys_deleted_count":9,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":131,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":15,"dns_resolutions_count":19,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["agent","dyamar","floxif","neshta","evasive","banker","downloader","emotet","soft32downloader","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"651423ee8b984fb55005b99b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["GBR","USA"],"submit_name":"BANDIZIP-SETUP-STD-X64.EXE","analysis_start_time":"2023-09-27T12:45:35+00:00","indicators_count":{"informative":177,"suspicious":51,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6196701dbb02577eff4a20b4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"BANDIZIP-SETUP-STD-X64.exe","analysis_start_time":"2021-11-18T16:02:23+00:00","indicators_count":{"informative":39,"suspicious":46,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"52.78.169.250","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.250.69.200","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"address":"18.118.72.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"151.101.1.229","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.251.32.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.251.46.194","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.251.46.206","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.250.189.163","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.250.191.74","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.250.189.193","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.250.191.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.251.32.33","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.250.189.196","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"142.250.188.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"address":"51.104.15.253","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}],"dns_resolutions":[{"domain":"ana.bandi.so","address":"52.78.169.250","ttl":18904,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"domain":"log.bandi.so","address":"52.78.169.250","ttl":21600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"domain":"ocsp.sectigo.com","address":"104.18.30.182","ttl":3471,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"domain":"ver.bandi.so","address":"52.78.169.250","ttl":21256,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"www.bandisoft.com","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"cdn.jsdelivr.net","address":"151.101.1.229","ttl":133,"country":"United States","registrar_name":"ENOM, INC.","registrar_name_servers":"DNS1.P03.NSONE.NET","registrar_creation_date":"2012-05-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"fonts.googleapis.com","address":"142.250.191.74","ttl":83,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"fonts.gstatic.com","address":"142.250.188.3","ttl":132,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"fundingchoicesmessages.google.com","address":"142.251.46.206","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"googleads.g.doubleclick.net","address":"142.251.46.194","ttl":212,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1996-01-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"lh3.googleusercontent.com","address":"142.251.32.33","ttl":118,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2008-11-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"pagead2.googlesyndication.com","address":"142.251.32.34","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2003-01-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"partner.googleadservices.com","address":"142.251.32.34","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2003-06-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"self.events.data.microsoft.com","address":"51.104.15.253","ttl":40,"country":"United Kingdom","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1991-05-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"tpc.googlesyndication.com","address":"142.250.189.193","ttl":287,"country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"www.google.com","address":"142.250.189.196","ttl":255,"country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"www.googleadservices.com","address":"142.250.191.34","ttl":123,"country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"www.googletagservices.com","address":"142.250.191.34","ttl":205,"country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"domain":"www.gstatic.com","address":"142.250.189.163","ttl":4,"country":"United States","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}],"http_requests":[{"host":"ocsp.sectigo.com","host_ip":"104.18.30.182:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDzHc2p4PYe%2BXbRnPTZ8TTX","method":"GET","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDzHc2p4PYe%2BXbRnPTZ8TTX HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}],"processes":[{"pid":844,"ppid":0,"name":"BANDIZIP-SETUP-STD-X64.exe","command_line":"","sha256":"647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5","normalized_path":"C:\\BANDIZIP-SETUP-STD-X64.exe","uid":"00000000-00000844","icon":"$5b"},{"pid":1028,"ppid":844,"name":"msedge.exe","command_line":"--single-argument https://www.bandisoft.com/bandizip/","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000844","uid":"00000000-00001028"},{"pid":4100,"ppid":1028,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd8,0x7ffea256b208,0x7ffea256b218,0x7ffea256b228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00004100"},{"pid":3912,"ppid":1028,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00003912"},{"pid":100,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00000100"},{"pid":6744,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00006744"},{"pid":7692,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1095064038 --mojo-platform-channel-handle=3124 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00007692"},{"pid":2384,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1095363471 --mojo-platform-channel-handle=3132 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00002384"},{"pid":7688,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3612 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00007688"},{"pid":196,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1095953236 --mojo-platform-channel-handle=3480 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00000196"},{"pid":5900,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1096281671 --mojo-platform-channel-handle=3656 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00005900"},{"pid":3668,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1096561496 --mojo-platform-channel-handle=3796 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00003668"},{"pid":7716,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1096890917 --mojo-platform-channel-handle=3804 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00007716"},{"pid":6812,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1097168477 --mojo-platform-channel-handle=3852 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00006812"},{"pid":7172,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1098853797 --mojo-platform-channel-handle=6108 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00007172"},{"pid":2568,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6100 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00002568"},{"pid":6956,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6412 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00006956"},{"pid":1116,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1102746315 --mojo-platform-channel-handle=6828 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00001116"},{"pid":1864,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1103817225 --mojo-platform-channel-handle=6552 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00001864"},{"pid":3524,"ppid":1028,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --time-ticks-at-unix-epoch=-1695843020771838 --launch-time-ticks=1104111978 --mojo-platform-channel-handle=7068 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00003524"},{"pid":4360,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00004360"},{"pid":5128,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00005128"},{"pid":368,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1164 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00000368"},{"pid":2644,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00002644"},{"pid":6116,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00006116"},{"pid":380,"ppid":1028,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4656 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00000380"},{"pid":2392,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3752 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00002392"},{"pid":7904,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00007904"},{"pid":4732,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3808 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00004732"},{"pid":3340,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00003340"},{"pid":4144,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3660 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00004144"},{"pid":4500,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8220 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00004500"},{"pid":6976,"ppid":1028,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3772 --field-trial-handle=1964,i,7173849120116418962,14556945498006889649,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001028","uid":"00000000-00006976"}],"all_imported_dlls":["wow64win.dll","urlmon.dll","FWPUCLNT.DLL","schannel.dll","cryptnet.dll","wininet.dll","api-ms-win-downlevel-user32-l1-1-0.dll","userenv.dll","msftedit.dll","credssp.dll","secur32.dll","setupapi.dll","linkinfo.dll","lpk.dll","api-ms-win-downlevel-version-l1-1-0.dll","comctl32.dll","rasadhlp.dll","cscapi.dll","advapi32.dll","oleaut32.dll","crypt32.dll","npmproxy.dll","cfgmgr32.dll","VxSSL64.dll","ntdll.dll","ole32.dll","uxtheme.dll","cryptsp.dll","Wldap32.dll","SensApi.dll","kernel32.dll","dhcpcsvc.dll","WSHTCPIP.DLL","slc.dll","gdi32.dll","bcrypt.dll","bcryptprimitives.dll","cabinet.dll","netutils.dll","dnsapi.dll","netprofm.dll","ntshrui.dll","msvcrt.dll","version.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sxs.dll","shell32.dll","wow64cpu.dll","user32.dll","msctf.dll","msasn1.dll","devrtl.dll","usp10.dll","profapi.dll","dwmapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","RpcRtRemote.dll","webio.dll","ncrypt.dll","devobj.dll","apphelp.dll","KernelBase.dll","normaliz.dll","nsi.dll","winhttp.dll","propsys.dll","sspicli.dll","rpcss.dll","shlwapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","tzres.dll","sechost.dll","rpcrt4.dll","nlaapi.dll","srvcli.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","clbcatq.dll","ieproxy.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wshqos.dll","comdlg32.dll","bdzshl.x64.dll","iertutil.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","winnsi.dll","wintrust.dll","gpapi.dll","bdzshl.x86.dll","rsaenh.dll","ntmarta.dll","actxprxy.dll","wow64.dll","cryptbase.dll","mswsock.dll","wship6.dll","IPHLPAPI.DLL","imm32.dll","dhcpcsvc6.dll","ieframe.dll","fltLib.dll","msIso.dll","microsoft_apis.dll","vk_swiftshader.dll","mlang.dll","srumapi.dll","libGLESv2.dll","d3d10warp.dll","winsta.dll","directmanipulation.dll","onramp.dll","tbs.dll","Windows.Networking.Connectivity.dll","msmpeg2vdec.dll","msvcp_win.dll","samcli.dll","ffmpeg.dll","fwbase.dll","rmclient.dll","mfplat.dll","d3dcompiler_47.dll","D3D12.dll","combase.dll","CoreUIComponents.dll","dmcmnutils.dll","vulkan-1.dll","ucrtbase.dll","wevtapi.dll","dxilconv.dll","Windows.Globalization.dll","Windows.System.Profile.RetailInfo.dll","mf.dll","OnDemandConnRouteHelper.dll","RTWorkQ.dll","twinapi.appcore.dll","DWrite.dll","dsreg.dll","msvcp110_win.dll","ResourcePolicyClient.dll","globinputhost.dll","mscms.dll","OneCoreCommonProxyStub.dll","msacm32.dll","telclient.dll","winmmbase.dll","KBDUS.DLL","dxva2.dll","DolbyDecMFT.dll","windows.storage.dll","SHCore.dll","mskeyprotect.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","libEGL.dll","WinTypes.dll","OneCoreUAPCommonProxyStub.dll","mfsensorgroup.dll","Windows.Web.dll","WofUtil.dll","sapi.dll","wlanapi.dll","mfperfhelper.dll","Windows.Shell.ServiceHostBuilder.dll","BCP47Langs.dll","CoreMessaging.dll","edputil.dll","ntasn1.dll","ncryptsslp.dll","winmm.dll","wldp.dll","netapi32.dll","powrprof.dll","imagehlp.dll","msedge.dll","Windows.UI.dll","dxgi.dll","Windows.Security.Authentication.OnlineId.dll","wkscli.dll","msedge_elf.dll","UIAutomationCore.dll","DataExchange.dll","msvproc.dll","dcomp.dll","MMDevAPI.dll","dpapi.dll","BitsProxy.dll","CompPkgSup.dll","wtsapi32.dll","gdi32full.dll","VxSSL32.dll","win32u.dll","dbghelp.dll","d3d11.dll","Windows.Media.dll","TextInputFramework.dll","oleacc.dll","oneds.dll","Windows.Security.Authentication.Web.Core.dll","atlthunk.dll","vaultcli.dll","PCPKsp.dll","msdmo.dll","twinapi.dll","kernel.appcore.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"bdzshl.x86.dll","sha256":"fa2438e45c2056575d3d8a7602331fbe0957a9f99f16cd48646beaa002df8445","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Arkview.x64.exe","sha256":"3633e1cf5c7257db310ab5b0cf5f59fc6850bfbad33b2f3a44d42bc1f2c933b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Uninstall.exe","sha256":"0bd5e1da8361523338f83fea285e16e62ec22e50d4d488f7316237eca87380c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Updater.exe","sha256":"511bf5f0f1db48e42ee313d458cb1848c33ecbde013744c398e7e04aa4fee0df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"ark.x64.dll","sha256":"30d9d61fd374151658c89593cd1c8764c4df61460c5bdff637641a63a964331b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"ark.x64.lgpl.dll","sha256":"51a174fca59494b39c6b2dd07e76cb6a10911fee785bf8bcbb4be9508414a36b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"ark.x86.dll","sha256":"cebaf263a95905773b7319277e09d746c6e800188ca990923c44a9ee583f4f81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"ark.x86.lgpl.dll","sha256":"8eb1180845ede9fb5df10ddf7f0de4f066ae4138412a06141e4be804cf386231","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"bdzshl.x64.dll","sha256":"0c23ed6ff02b68467043adf9fb1b173914fd986bc9c16a40dde44a4363eb88ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"bz.exe","sha256":"ef503795d1682e8f5d57372a4051f90138b56031189c557a26e453cf1f5a34e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"bzshell.x64.dll","sha256":"e3a18bf2ea63d02bf4ead830cb0907cb06a61dbddf8ee1e1637aec228a4097ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Amsiman.x64.exe","sha256":"84f3ac3fd0df34306639e41af4ddb2c9e4f7cf746de5da0bcdf287edd87521b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"RegDll.x64.exe","sha256":"304badc76d2983f736bf0417ae2a8e4d21108871e4e81b5182c8c22f7e366f4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"RegDll.x86.exe","sha256":"e71da0a4848d9f738997af95b1cb872e70a88aa8e210e9f8b4b9fdf57ee7a5d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"RegPackage.x86.exe","sha256":"7217b9d9570643c6607272d97a45130194f137f0558d9105e46bfcfbd51efe0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"lm.x64.dll","sha256":"edd60dfcaf56243e823d75aae4493885953eb4d080d55d1261a1ed07459b7e56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"web32.exe","sha256":"a861f3e2ee912cf0873184caf9d14944a7b549dc7fc477457c4de6f12956109b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"webview.x86.dll","sha256":"9376db87efcaf2568fbc6b04eab49b0f40b1296045f31e62c66e46e3f79d864c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"6b0ceccf0103afd89844761417c1d23acc41f8aebf3b7230765209b61eee5658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Uninstall.lnk","sha256":"f454c4dfd364b506495feae96f959121b32eb2452bc6496b2abdc880c77cb1ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"3ef991ac5d5e3b5888bd42414e48c2f9d91758acce50067a0c1834de3b6f7960","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"848460ED45F3AE6F6E6CD248AB519FED","sha256":"781e5d95a96b5f400e47fd3a0a9c4da8a89d00edb32cff590802b8a68bc87ce6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sha256":"a46b9482c9480009b50267671c3ac02ffcceb3a6bdf6ec36ac1e952ed3183aaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sha256":"723ccd9d6ad50fb0ae9a521af9a428a50027994c13aa3ba12d115e8b2608b1bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"ArkLicense.txt","sha256":"ffa5540e799b1bea63afb456a3cb410a69f83780f0d207f7d447c3af23a5e20a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"VersionNo.ini","sha256":"d78f3acff9a7e73cb60c8b5ad0453747e0149772564b58551afed28b5df47c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"bdzsfx.x86.sfx","sha256":"96bc39c5b4cbf4a308b9153bdcdac499280f7a21bf3d20e52b7aa335eb6c859f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Bandizip.lnk","sha256":"a70ae90903be77c05167b0802700b58148e67bd6d04e2988ad2587f5915dd9cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"44eb5065-ab1c-43e1-bf1f-2d91268fffb9.tmp","sha256":"3d542a3486eadad0350ff6bf8d88a584574cda2dc16e24d5e2da41d043b7e57b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"5b896241-2d5e-4685-85d7-b18cc348bec0.tmp","sha256":"d1c4a020f055a552d3142e98d39bbfa9f326e74eed07ea312c17209fc786659f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"85c8ea19-fed9-4818-986e-780fd4adffba.tmp","sha256":"49cce75f0a647131ed765009b1fc789118970e918fe9e437d75f50f8bf5198d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"a0516d5c-1a5a-41b2-83dc-668493ba25b9.tmp","sha256":"7ea7000896a64aae74d9989854b4700557e2f445934ddd8f814c3df20e8074ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"settings.dat","sha256":"cb7be7aac22e0315f628695d59d6952db1e648f99af5f58bd164300e0387a90f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"0069a993-e67b-4d85-b101-594779cba439.tmp","sha256":"728117509251e272814a51f5a14ecc2a576ce128b5da01487b032e8b7daae7a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"0d966881-f1fb-4f35-bc44-27f55500e4a1.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"1f2e2b72-09ba-43ae-8563-f9d2dcd613fc.tmp","sha256":"d4df3bf8ce30ff32206508d49b902fdc895a4eea9591a1de297c64ca5aef1458","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"3f1b6618-1811-4815-8078-f4d2948d776d.tmp","sha256":"4657cff5ec10fea330da2b63bf14ddbe302b82f6e5052d79f5b7e55e9c3e3ed0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"4becda91-2c57-4ba4-8ffc-7a9c3eb8c071.tmp","sha256":"4c1255e5ce360f08ba9450bd1b0b3cf16383b120821b8c52b177e9aa3d578a26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"6000421a-5941-40d4-9537-755216518506.tmp","sha256":"88382a4bf7870b4f30b72003d17385bcff2a068e84bd3ea2f7eb85a8d0759150","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"7b740f5e-25a7-4435-ae17-609507834c73.tmp","sha256":"cdea3c4ea4195431edd62a96a62ce8424dd22c6e316ed7ce4a382dd81aab6c58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"000003.log","sha256":"d87196f83d24e85edc0e3805499f20bafe292f0ba40f05e7abbcaff33dfa7ba0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"LOG","sha256":"c5b45eaffa33c6b42dc94fc3a3c520efc448039f354fa27f8b2a2337c484873e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"data_0","sha256":"8d76b13167484b62946ba7485cfac5c3d711c31b01a07985ccbf723bab627e06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"data_1","sha256":"bd5b3d6620a98fb7b03a996040eb9df76950ece0e3d72749fb0bc58ced39e8b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"f_0004c3","sha256":"a12104477882d4ac19cfa38b4251b6f24b9efbb57b302406783bbe72cb4903df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"f_0004c4","sha256":"57d38c96f11920852c6031f51167da27538100b4852509644b1f8ce6418e16e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"f_0004c5","sha256":"00c975587078f80c494054fbcc19763a9d7c935f3f6138d507b7326d55856262","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"name":"f_0004c6","sha256":"c017ef1558b9a23ede87f4fab44189b7df43e74860aaaaf420ce2731bf7bd18e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\VersionNo.ini","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\langs\\English.lang","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\data\\resource.data","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"C:\\BANDIZIP-SETUP-STD-X64.exe","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\848460ED45F3AE6F6E6CD248AB519FED","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\data","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\shellicons","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Bandizip","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Bandizip\\Bandizip.lnk","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Bandizip\\Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PUBLIC%\\Desktop\\Bandizip.lnk","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\config.ini","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"},{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_6F8900FF5837CB8DFA61275648785329","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\572BF21E454637C9F000BE1AF9B1E1A9","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_649D3C9717A1D0B02735FC14F09C533D","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3538626A1FCCCA43C7E18F220BDD9B02","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A845F2FF632BEE7B6A12DCFF8183300B","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\848460ED45F3AE6F6E6CD248AB519FED","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\icons","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\icons\\default","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%PROGRAMFILES%\\Bandizip\\langs","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Variations","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\lockfile","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Last Version","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\commerce_subscription_db\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\commerce_subscription_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\000009.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Top Sites","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\HubApps Icons","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\load_statistics.db-wal","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\load_statistics.db-shm","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension State\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension State\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sessions\\Session_13340317717340928","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\66bf9728-5c4c-4b98-8d36-9e4fbabb1d3d.tmp","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c3","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c4","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c5","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c6","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c7","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Web Data-journal","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c9","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004ca","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\000014.ldb","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AssistanceHome\\AssistanceHomeSQLite","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\345e6fe7-6524-4174-a5cf-9e3e6e20e090.tmp","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\heavy_ad_intervention_opt_out.db","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Shortcuts","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\WebAssistDatabase","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Last Browser","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\arbitration_service_config.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004cc","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004cd","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004ce","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_hint_cache_store\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_hint_cache_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_model_metadata_store\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_model_metadata_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004cf","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\85cb65a53044c4d4_0","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\087b56d29424d1a0_0","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\957be8e34ee1126d_0","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\d6958924975f9124_0","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\9cd9edfa63bc2bdb_0","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AutofillStrikeDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AutofillStrikeDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\BudgetDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\BudgetDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\d2badbc211a9a591_0","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Ad Blocking\\a0516d5c-1a5a-41b2-83dc-668493ba25b9.tmp","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Secure Preferences~RF10aec0.TMP","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\2836f90cbf4cedbd_0","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SegmentInfoDB\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SegmentInfoDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalDB\\LOG.old~RF10b3a2.TMP","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\d0885291-fa51-4642-a558-3f98cd7fb9d7.tmp","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalStorageConfigDB\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalStorageConfigDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\WebAssistDatabase-journal","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\DawnCache\\data_1","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\LOCK","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\2146243a-c463-4507-b65d-c9ada07b9677.tmp","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\000003.log","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOG","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1899489611\\crl-set","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1899489611\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1899489611\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1956245457\\edge_autofill_field_data.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1956245457\\edge_autofill_global_block_list.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1956245457\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1956245457\\regex_patterns.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1956245457\\v1FieldTypes.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_409558586\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_409558586\\recovery-component-inner.crx","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_800294376\\deny_domains.list","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_800294376\\deny_etld1_domains.list","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_800294376\\deny_full_domains.list","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_800294376\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_800294376\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_790097020\\data.txt","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_790097020\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_790097020\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_2031830980\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_2031830980\\nav_config.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\auto_open_controller.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\edge_checkout_page_validator.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\edge_confirmation_page_validator.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\edge_driver.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\edge_tracking_page_validator.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\product_page.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\shopping.html","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\shopping.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\shoppingfre.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\shopping_fre.html","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\shopping_iframe_driver.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_1349134552\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\manifest.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Advertising","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Analytics","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\CompatExceptions","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Content","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Cryptomining","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Entities","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Fingerprinting","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\LICENSE","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Other","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\Social","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Mu\\TransparentAdvertisers","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Advertising","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Analytics","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Content","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Cryptomining","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Entities","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Fingerprinting","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\LICENSE","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Other","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Social","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\Sigma\\Staging","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_548196106\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\app-setup.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\bnpl\\bnpl.bundle.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\bnpl\\bnpl.bundle.js.LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\bnpl\\bnpl.html","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\bnpl_driver.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\crypto.bundle.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\driver-signature.txt","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\edge_driver.js","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\hub-signature.txt","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\json\\i18n-ec\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"path":"%TEMP%\\1028_956207386\\json\\i18n-ec\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\BANDIZIP\\L\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\.ZIP\\SHELLNEW\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\.ICONPACK\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\.ZIP\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\.ZIP\\SHELLNEW\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ICONPACK\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ICONPACK\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ICONPACK\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ICONPACK\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ICONPACK\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\.ZIP\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIP\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIP\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIP\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIP\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\WOW6432NODE\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\WOW6432NODE\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\INPROCSERVER32\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\*\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DIRECTORY\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\*\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DIRECTORY\\SHELLEX\\DRAGDROPHANDLERS\\AABDZCTX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DIRECTORY\\SHELLEX\\DRAGDROPHANDLERS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DIRECTORY\\SHELLEX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DIRECTORY\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DIRECTORY\\SHELLEX\\DRAGDROPHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\\SHELLEX\\DRAGDROPHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\DIRECTORY\\BACKGROUND\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DIRECTORY\\BACKGROUND\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\SHELLEX\\CONTEXTMENUHANDLERS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\SHELLEX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\DRIVE\\SHELLEX\\CONTEXTMENUHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\SHELLEX\\DRAGDROPHANDLERS\\AABDZCTX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\SHELLEX\\DRAGDROPHANDLERS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\DRIVE\\SHELLEX\\DRAGDROPHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\DRIVE\\SHELLEX\\DRAGDROPHANDLERS\\AABDZCTX\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\\INPROCSERVER32\\\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIP\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIP\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIP\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIP\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIPX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIPX\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIPX\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIPX\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.ZIPX\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIPX\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIPX\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.RAR\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.RAR\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.ZIPX\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.RAR\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.RAR\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.RAR\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.RAR\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.RAR\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.RAR\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\BANDIZIP.7Z\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\BANDIZIP.7Z\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATEMEDIUM\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\LASTWASDEFAULT\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATEMEDIUM\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\FIRSTNOTDEFAULT\\S-1-5-21-735145574-3570218355-1207367261-1001\\S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\PREFERENCEMACS\\DEFAULT\\EXTENSIONS.SETTINGS\\EXTENSIONS.SETTINGS","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\PREFERENCEMACS\\DEFAULT\\PREFS.PREFERENCE_RESET_TIME\\PREFS.PREFERENCE_RESET_TIME","sources":[{"report_type":"sandbox","report_id":"651423ee8b984fb55005b99b"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Bandizip","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]},{"name":"Bandizip","sources":[{"report_type":"sandbox","report_id":"6196701dbb02577eff4a20b4"}]}]}},"report_ids":{"sandbox_job_ids":["6196701dbb02577eff4a20b4","651423ee8b984fb55005b99b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 647051600c12… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 647051600c12…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 647051600c12… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 647051600c12…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/647051600c12877af5d2957782c5679277508f4fc80e3d1c6ad1107a57d446f5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 647051600c12… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 647051600c12…. Threat score 100/100. 0/28 AV engines flagged this file. 10 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]