24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 7ab74f07884f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7ab74f07884f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5"],"about":{"@type":"SoftwareApplication","name":"7ab74.Trojan.exe","applicationCategory":["peexe","executable"],"identifier":"7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4d8,file/memory contains long string with (Indicator: "HMAC"; File: "History") file/memory contains long string with (Indicator: "HMAC"; File: "000003.log") file/memory contains long string with (Indicator: "Aes"; File: "strings.json") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to "CspParameters" (Indicator: "CspParameters"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp")26:T62a,Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-977-00414A57 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-977-00414A57 Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-976-004149E3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-976-004149E3 Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-974-0041494B Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-974-0041494B Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-921-00418709 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-921-00418709 Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-834-004127FA Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-834-004127FA Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-915-0040D432 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-915-0040D432 Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-298-00414057 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-298-00414057 Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-981-00414C29 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-981-00414C29 Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-116-00411ED9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-116-00411ED9 Assembly shows XOR instruction xor eax ebp in Stream UID: 55118-916-00415280 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55118-916-0041528027:T13de,"7ab74.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000009e29b67760cd420300000000280000002400000000004103e0f017010000000000000000000000000000000000000000d0071b0330000000000000000900000000001b0398e5f07334141701d5a8ef730000000088cb420310ae410309000000000000002000000000001b03d0011b03440b1b0300000000400b1b03c4f01701d8f0170150f5b57760cd420340f117018cf11701 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000004303c8ae410300000000000000001b0d506300000000000008000800000000001b03100c1b03600c1b03c8ae41031f00000098ef1701080000009e29b6772809430300000000380000003400000000004103e0ef17010000000007000000000000000000000000000000d0071b0340000000000000000800000000001b03000800000800170100a8ef730b00000000074303d8ae410308000000000000002000000000001b03d8011b03140c1b0300000000100c1b03c4ef1700d8ef170150f5b5772809430340f017018cf0170100004103a0ae410350f5b5772809430300001d73feffffff780c1b03c8ae4103000000000000000000001d73e0ef1701 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000001273187d127300000000d0a959770000527790115377b0404203507141036844430338d23105feffffffe0d43105506ab977eb5fb985fefffffff8d23105eaa9b577b04042030000000068444303a11400000a000b00b29712735c7612736876127368444303d8794303140000000000000000000000b040420320d33105cc2dba7768444303000000007444430300000000f8000b7300000000cc0d24385ce8b8776840b777b801000019000000110000001000000030b4410358d331058d9a4b74f0b04103b44643030000000078d3310504b04103b446430390d3310500000b73feffffff0400000020af4b74000000000000000000000b7380d33105 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000d8d231057cd23105226e47760000f604000000002d6e4776da4e5d0f2d000000ecb7f37400d3310500001b03e8d3450360424303170000008000000040d2310500001b03c4d2310570c848765eed217cfeffffff2d000000d0cc02752700000094d23105856a49761c234e76d4d23105f85f497608000000bb694876b2694876724e5d0f2d000000ecb7f37427000000d0cc0275a8d231052d000000d0cc027527000000d8d23105856a49761c234e7620d331057e8a0175ee8c0175738a0175a52159522d000000ecb7f37427000000d0cc027534c7f604c8c6f604a5215952e8d23105fc523f75d4d33105e0840175bd035522feffffff738a0175 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001744)28:T178b0,Observed string: ""WalletECNewCtaDescriptionCashback": "ativar o programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupes automaticamente", "WalletECNewCtaDescriptionFillAddress": "preencha automaticamente as suas informaes de envio", "WalletECNewCtaDescriptionFillDetail": "preencha as suas informaes de envio e fatura "WalletECNewCtaDescriptionFillPayment": "preencher as suas informaes de fatura "WalletECNewCtaDescriptionGiftCard": "utilizar o carto de oferta", "WalletECNewCtaDescriptionTakeToBNPL": "encaminh-lo para $1", "WalletECNewUXErrorMessageForAutofill": "O preenchimento automtico no conseguiu preencher todos os seus detalhes. Introduza-os manualmente para concluir a transao.", "WalletECNewUXErrorMessageForCashback": "No foi possvel aplicar o reembolso sua compra neste momento. Tente novamente mais tarde.", "WalletECNewUXErrorMessageForCoupon": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "WalletECNewUXErrorMessageForGiftCard": "No conseguimos aplicar o seu carto de oferta a esta compra. $1", "WalletECNewUXErrorMessageForGiftCardLink": "Ver o estado do carto de oferta", "WalletECNewUXForNoSuccessMessage": "Pedimos desculpa mas no conseguimos ajudar neste momento", "WalletECNewUXForNoWorkingCoupon": "No encontrmos cupes vlidos", "WalletECNewUXMultiErrorMessageForAutofill": "preenchimento automtico", "WalletECNewUXMultiErrorMessageForCashback": "reembolso", "WalletECNewUXMultiErrorMessageForCoupon": "cupes", "WalletECNewUXMultiErrorMessageForiftCard": "carto de oferta", "WalletECNewUXPartialSuccessMessageForAutofill": "Alguns dos seus detalhes foram preenchidos. Introduza as informaes restantes para concluir a sua compra", "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "J poupou $1 com o melhor cupo e carto de oferta", "WalletECNewUXSuccessMessageForAutofill": "Os detalhes da finalizao da compra foram preenchidos", "WalletECNewUXSuccessMessageForCashback": "Receber $1 de reembolso $2", "WalletECNewUXSuccessMessageForCoupon": "J poupou $1 com o melhor cup "WalletECNewUXSuccessMessageForGiftCard": "J poupou $1 com o carto de oferta" "WalletECSimplifyAutofillSubTitle": "Ativar para utilizar a concluspida" "WalletECSimplifyAutofillTitle": "Detalhes do preenchimento automtico da finalizao da compra" "WalletECUXSimplifyCtaDescriptionSaving": "aplicar poupan "walletBNPLSmallCardBottomMessagePayInFour": "O $1 tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardBottomMessageZip": "O Zip tambm oferece pagamentos mensais com juros.", "walletBNPLSmallCardFooterMessage": "A Microsoft no lhe cobra nem paga por estes fornecedores.", "walletBNPLSmallCardTitle": "A compra ser dividida em quatro prestaes", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "A compra pode ser dividida em 4 prestaes", "walletChangeYourSettings": "alterar as definies", "walletDrawerFormPageMicroFeedbackPrompt": "Est contente com a Carteira?", "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplique automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardAutofillFailureTitle": "No foi possvel aplicar automaticamente o seu carto de oferta a esta encomenda. Verifique o nmero do carto de oferta no seu e-mail e introduza-o manualmente para utiliz-lo.", "walletDrawerGiftCardRedeemFailureTitle": "No foi possvel resgatar os seus pontos do Rewards como carto de oferta. Pode continuar com a encomenda ou tentar a transao novamente mais tarde.", "walletDrawerGiftCardRedeemMultipleFailureTitle": "Resgate os seus pontos do Rewards como carto de oferta.", "walletECAllFailureMessageBottom": "No se preocupe ainda pode continuar a sua transao.", "walletECAllFailureTitle": "As seguintes funcionalidades no esto disponveis neste momento:", "walletECApplyCashBackTitle": "Reembolso", "walletECApplyCashCackTitle": "Receber $1 em reembolso.", "walletECApplySavingTitle": "Poupar $1 e receber $2 em reembolso.", "walletECAutoApplyApplyingBestCouponsNew": "Aplicando o melhor cupo que encontrmos...", "walletECAutoApplyFailureTitle": "Os testes de cupes no esto disponveis neste momento mas ainda pode testar cupes manualmente.", "walletECAutoApplyFeature": "Cupes de teste", "walletECAutoApplyTryingCoupons": "A tentar $1...", "walletECAutofillErrorMessage": "Detalhes da Preenchimento Automtico", "walletECAutofillPaymentOnlySingleErrorMessage": "O preenchimento automtico no conseguiu concluir todos os seus detalhes. Introduza-os manualmente para continuar a sua transao.", "walletECAutofillPaymentOnlySuccessMessage": "Preenchemos automaticamente os seus dados de pagamento para uma finalizapida da compra.", "walletECAvailableRewardsPoints": "$1 pontos disponveis", "walletECCancelCouponButton": "Ignorar cupes", "walletECCancelCouponFooter": "45% dos utilizadores pouparam com cupes", "walletECCancelCouponStatus": "A aplicao de cupes cancelada", "walletECCashBackAndCouponTitle": "Reembolsos e cupes", "walletECCashBackDisplayValue": "At $1", "walletECCashBackEnableErrorMessage": "No foi possvel aplicar o cashback sua compra neste momento. Tente novamente mais tarde.", "walletECCashBackEnableSubErrorMessage": "Ativar cashback", "walletECCashBackInfo": "Receber atualizaes por e-mail e monitorizar os detalhes dos reembolsos em $1.", "walletECCashBackOptionText": "Obter reembolso", "walletECCashBackUpto": "At $1", "walletECCashbackActivateFailedLabel": "No foi possvel ativar o reembolso desta compra. Tente novamente mais tarde.", "walletECCashbackActivateLabel": "Ativar reembolso", "walletECCashbackEnrollDisclaimer": "Ter sesso iniciada no Microsoft Edge que ir fazer uma cpia de segurana dos seus dados de navegao e permitir-lhe ver os seus favoritos palavras-passe histrico e muito mais em todos os seus dispositivos. Tambm ir aderir e receber e-mails sobre o $1 que incluem ofertas sobre produtos de parceiros. $2 | $3", "walletECCashbackLinkLabel": "Ver detalhes da oferta no valor de $1", "walletECCashbackPrivacyLinkLabel": "Privacidade e Cookies", "walletECCashbackSigninLabel": "Aderir agora e ative o reembolso", "walletECCashbackStatus": "Reembolso ativado", "walletECCashbackTermsLinkLabel": "Termos", "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar poupanas e continuar", "walletECContinueSavingsAndFillDetailsLabel": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes automaticamente e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsLabelBNPL": "Ao continuar ativaremos o programa de reembolsos aplicaremos cupes e preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos e preencheremos as suas informaes de envio e faturao.", "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Ao continuar ativaremos o programa de reembolsos preencheremos automaticamente o seu envio e o levaremos a $1.", "walletECContinueSavingsButtonLabel": "Aplicar poupanas", "walletECContinueSavingsLabel": "Ao continuar iremos ativar o programa de reembolso e aplicar cupes automaticamente.", "walletECContinueSavingsNoCouponLabel": "Ao continuar ativaremos o programa de reembolsos.", "walletECCouponAverageSaving": "Em mdia poupou $1", "walletECCouponOptionText": "Utilizar cup "walletECCouponsCookieDisclaimer": "Permito a colocao de $1 no meu dispositivo para ajudar a faturao com o fornecedor do cupo tal como por $2" "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declarao de Privacidade da Microsoft" "walletECEnjoyMessage": "Desfrute do resto do seu percurso de compras." "walletECFillDetailsButtonLabelUXSimplify": "Preencher detalhes" "walletECFreBannerContent": "Encontre as melhores ofertas com cupes e reembolsos, tudo antes de pagar." "walletECFreBannerTitle": "Poupe dinheiro e tempo com a Carteira no Microsoft Edge" "walletECGetCashbackLabel": "Pode obter um reembolso de at $1 em $2." "walletECGiftCardTitle": "Carto de oferta" "walletECManagePersonalInfo": "Gerir informaes pessoais" "walletECMaskedCardDetailFetching": "Introduza o seu CVC para continuar" "walletECMaskedFetchErrorMessage": "Tente novamente e introduza o seu CVC quando lhe for solicitado. Em alternativa, selecione outro mtodo de pagamento para continuar." "walletECNewCtaDescriptionTemplateFive": "Ao continuar, iremos $1, $2, $3, $4 e $5." "walletECNewCtaDescriptionTemplateFour": "Ao continuar, iremos $1, $2, $3 e $4." "walletECNewCtaDescriptionTemplateOne": "Ao continuar, iremos $1." "walletECNewCtaDescriptionTemplateThree": "Ao continuar, iremos $1, $2 e $3." "walletECNewCtaDescriptionTemplateTwo": "Ao continuar, iremos $1 e $2." "walletECNewShippingAddressTitle": "Detalhes do envio" "walletECNewUXErrorMessageTemplateFive": "Os $1, $2, $3, $4 e $5 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateFour": "Os $1, $2, $3 e $4 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateThree": "Os $1, $2 e $3 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNewUXErrorMessageTemplateTwo": "Os $1 e $2 no esto disponveis neste momento. No se preocupe, ainda pode concluir a transao." "walletECNoSavedAddress": "Sem Endereo Guardado" "walletECNoSavedName": "Nenhum Nome Guardado" "walletECRebatesCouponsSelectorDescription": "Aplicmos as melhores poupanas para si e descobrimos que s pode utilizar uma nesta compra. Selecione uma das opes abaixo para continuar." "walletECRebatesCouponsSelectorTitle": "Selecione um para continuar" "walletECReturnToCheckoutButtonAria": "Fechar o painel e regressar gina de finalizao da compra" "walletECRewardsDonotRedeemOptionPoints": "No resgatar pontos de recompensas" "walletECRewardsNoGiftCardSelected": "Nenhum carto de oferta selecionado" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 pontos" "walletECRewardsRedeemOptionPoints": "$1 pontos" "walletECRewardsRedeemOptionTitle": "Resgatar carto de oferta de $1" "walletECRewardsTitle": "Carto de oferta do Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar poupanas e preencher detalhes" "walletECSavingsDisableMessage": "$1 para ativar o reembolso e aplicar cupes automaticamente. Isto pode poupar-lhe tempo e dinheiro quando fizer compras no Edge." "walletECShoppingInfo": "Est a utilizar cupes e reembolsos de compras da Microsoft." "walletECShoppingInfoForCoupon": "e cupes" "walletECShoppingInfoNew": "Est a utilizar o reembolso de $1 para compras da Microsoft." "walletECSkipCouponProgressStatus": "A ignorar cupes..." "walletECThirdPartyCookies": "cookies de terceiros" "walletECTokenizationCardDetailFetching": "Estamos a estabelecer uma ligao com o seu banco para gerar os detalhes do carto para esta transao. Isto pode demorar alguns segundos." "walletECTokenizationFetchErrorMessage": "N possvel gerar os detalhes do carto virtual. Tente novamente ou escolha outro carto." "walletECUXAffirmDescription": "Dividir pagamentos ao longo de 8 semanas" "walletECUXAffirmDescriptionFinanced": "Compre agora, pague ao longo do tempo com o Affirm." "walletECUXBNPLDropdownTitle": "Pagar ao longo do tempo" "walletECUXCardKlarnaDescription": "Sem taxas de juros, podero aplicar-se taxas de atraso" "walletECUXKlarnaDescription": "Compre agora. Pague ao longo do tempo com a Klarna." "walletECUXManagePaymentButtonTitle": "Gerir mtodos de pagamento" "walletECUXNewAddressDropdownLabel": "Selecionar endereo para envio" "walletECUXNewOnlyCardDropdownTitle": "Pagar com cart "walletECUXNewPaymentDropdownLabel": "Selecionar mtodo de pagamento", "walletECUXNewPaymentDropdownTitle": "Pagar com carto ou pagar ao longo do tempo", "walletECUXSBillingTheSameWithShipAddress": "O endereo de fatura o mesmo que o endereo de envio", "walletECUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletECUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "walletECUXSmallCardAffirmDescription": "Sem taxas de atraso sem juros", "walletECUXSmallCardZipDescription": "Sem impacto na classificao de crdito podero aplicar-se taxas de atraso", "walletECUXZipDescription": "Dividir pagamentos ao longo de 6 semanas", "walletECUXsimplifyBGAANegativeContent": "A Carteira testou todos os cupes mas no encontrou nenhum desconto", "walletECUXsimplifyBGAANegativeTitle": "Tem o melhor pre "walletECUXsimplifyBGAAPostiveCouponContent": "A Carteira testou todos os cupes disponveis" "walletECUXsimplifyBGAAPostiveTitle": "Est a poupar $1" "walletECUXsimplifyCashbackEnrollText": "Obtenha at $1 com o $2" "walletECUXsimplifyCashbackValue": "At $1" "walletECUXsimplifyMutipleCoupon": "$1 cupes" "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar poupan "walletECUXsimplifyShoppingToggleOffCashback": "Ativar o Microsoft Cashback" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Ativar o Microsoft Cashback e aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para poupar tempo e dinheiro quando faz compras online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupes automaticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Ativar as compras no Microsoft Edge" "walletECUXsimplifyStandardCouponContent": "Poupandia: $1 em $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "A Carteira encontrar a melhor oferta para si" "walletECUXsimplifyStandardCouponTitle": "$1 ser testado" "walletSelectString": "$1 ou $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""WalletECNewCtaDescriptionCashback": "activar el programa de reembolso", "WalletECNewCtaDescriptionCoupon": "aplicar cupones automticamente", "WalletECNewCtaDescriptionFillAddress": "autorrellenar la informacin de env "WalletECNewCtaDescriptionFillDetail": "rellene la informacin de envo y facturaci "WalletECNewCtaDescriptionFillPayment": "rellene la informacin de facturaci "WalletECNewCtaDescriptionGiftCard": "canjear la tarjeta de regalo" "WalletECNewCtaDescriptionTakeToBNPL": "llevarle a $1" "WalletECNewUXErrorMessageForAutofill": "El autorrellenado no pudo completar todos los detalles. Solo tiene que escribirlos manualmente para completar la compra." "WalletECNewUXErrorMessageForCashback": "No se ha podido aplicar la devolucin de dinero a la compra en este momento. Intntelo de nuevo ms tarde." "WalletECNewUXErrorMessageForCoupon": "La prueba de cupones no est disponible en este momento, pero todava puede probar los cupones manualmente." "WalletECNewUXErrorMessageForGiftCard": "No pudimos aplicar tu tarjeta regalo a esta compra. $1" "WalletECNewUXErrorMessageForGiftCardLink": "Ver el estado de la tarjeta regalo" "WalletECNewUXForNoSuccessMessage": "Lo sentimos, no podemos ayudarle en este momento" "WalletECNewUXForNoWorkingCoupon": "No encontramos ningn cupn de trabajo" "WalletECNewUXMultiErrorMessageForAutofill": "Autorrellenar" "WalletECNewUXMultiErrorMessageForCashback": "efectivo devuelto" "WalletECNewUXMultiErrorMessageForCoupon": "cupones" "WalletECNewUXMultiErrorMessageForiftCard": "Tarjeta de regalo" "WalletECNewUXPartialSuccessMessageForAutofill": "Se han rellenado algunos de los detalles. Introducir la informacin restante para completar la compra" "WalletECNewUXSSuccessMessageForCouponAndGiftCard": "Ya ha guardado $1 con el mejor cupn y la tarjeta regalo" "WalletECNewUXSuccessMessageForAutofill": "Se han rellenado los detalles de la finalizacin de la compra" "WalletECNewUXSuccessMessageForCashback": "Obtendr hasta $1 en efectivo de devolucin de $2" "WalletECNewUXSuccessMessageForCoupon": "Ya ha guardado $1 con el mejor cup "WalletECNewUXSuccessMessageForGiftCard": "Ya ha guardado $1 con la tarjeta regalo", "WalletECSimplifyAutofillSubTitle": "Activar para habilitar autorrellenar", "WalletECSimplifyAutofillTitle": "Autorellenar detalles de finalizacin de la compra", "WalletECUXSimplifyCtaDescriptionSaving": "aplicar descuento", "walletBNPLSmallCardBottomMessagePayInFour": "$1 tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardBottomMessageZip": "Zip tambin ofrece pagos mensuales con intereses.", "walletBNPLSmallCardFooterMessage": "Microsoft no le cobra ni recibe pagos de estos proveedores.", "walletBNPLSmallCardTitle": "La compra se dividir en 4 plazos", "walletBNPLSmallCardTitleBothFinancedAndPayInFour": "La compra se puede dividir en 4 entregas.", "walletChangeYourSettings": "cambiar la configuraci "walletDrawerFormPageMicroFeedbackPrompt": "s satisfecho con Cartera?" "walletDrawerGiftCardAuofillMultipleFailureTitle": "Aplica automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y Escrbelo manualmente para usarlo." "walletDrawerGiftCardAutofillFailureTitle": "No pudimos aplicar automticamente tu tarjeta regalo a este pedido. Comprueba el nmero de la tarjeta regalo en tu correo electrnico y escrbelo manualmente para usarlo." "walletDrawerGiftCardRedeemFailureTitle": "No pudimos canjear tus puntos de Rewards como tarjeta regalo. Puedes continuar con el pedido o volver a intentar la transaccis tarde." "walletDrawerGiftCardRedeemMultipleFailureTitle": "Canjea tus puntos de Rewards como tarjeta regalo." "walletECAllFailureMessageBottom": "No te preocupes, todava puedes continuar con la transaccin." "walletECAllFailureTitle": "Las siguientes caractersticas no estn disponibles en este momento:" "walletECApplyCashBackTitle": "Dinero devuelto" "walletECApplyCashCackTitle": "Obtendr hasta $1 en efectivo devuelto." "walletECApplySavingTitle": "Ahorrar $1 y obtendr hasta $2 en efectivo." "walletECAutoApplyApplyingBestCouponsNew": "Aplicando el mejor cupn que encontramos..." "walletECAutoApplyFailureTitle": "Las pruebas de cupones no estn disponibles en este momento, pero todava puede probar los cupones manualmente." "walletECAutoApplyFeature": "Cupones de prueba" "walletECAutoApplyTryingCoupons": "Intentando $1..." "walletECAutofillErrorMessage": "Detalles de Autorrellenar" "walletECAutofillPaymentOnlySingleErrorMessage": "Autorrellenar no pudo completar todos los detalles. Introdcelos manualmente para continuar con la transaccin." "walletECAutofillPaymentOnlySuccessMessage": "Hemos rellenado automticamente sus datos de pago para finalizar la compra rpidamente." "walletECAvailableRewardsPoints": "$1 puntos disponibles" "walletECCancelCouponButton": "Omitir cupones" "walletECCancelCouponFooter": "Un 45% de los usuarios ahorraron con cupones" "walletECCancelCouponStatus": "Cancelar cupones que se estn aplicando" "walletECCashBackAndCouponTitle": "Efectivo devuelto y cupones" "walletECCashBackDisplayValue": "Hasta $1" "walletECCashBackEnableErrorMessage": "No se pudo aplicar el reembolso a la compra en este momento. Intntalo de nuevo ms tarde." "walletECCashBackEnableSubErrorMessage": "Activar reembolso" "walletECCashBackInfo": "Recibir actualizaciones por correo electrnico y har un seguimiento del efectivo devuelto por $1." "walletECCashBackOptionText": "Obtener una devolucin de dinero" "walletECCashBackUpto": "Hasta $1" "walletECCashbackActivateFailedLabel": "No pudimos activar la devolucin de efectivo para esta compra. Intntalo de nuevo ms tarde." "walletECCashbackActivateLabel": "Activar reembolso" "walletECCashbackEnrollDisclaimer": "Iniciars sesin en Microsoft Edge, que realizar una copia de seguridad de sus datos de navegacin y te permitir ver tus favoritos, contraseas, historial y ms en todos sus dispositivos. Tambin te unirs y recibirs correos electrnicos de alrededor de $1, que incluyen ofertas sobre productos de socios. $2 | $3" "walletECCashbackLinkLabel": "Ver detalles de la oferta en $1" "walletECCashbackPrivacyLinkLabel": "Privacidad y cookies" "walletECCashbackSigninLabel": "nete ahora y activa la devolucin de dinero" "walletECCashbackStatus": "Reembolso activado" "walletECCashbackTermsLinkLabel": "Trminos" "walletECContinueSavingsAndFillDetailsButtonLabel": "Aplicar descuento y continuar" "walletECContinueSavingsAndFillDetailsLabel": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones automticamente y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsLabelBNPL": "Al continuar, activaremos el programa de reembolsos, aplicaremos cupones y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsAndFillDetailsNoCouponLabel": "Al continuar, activaremos el programa de reembolsos y rellenaremos la informacin de envo y facturacin." "walletECContinueSavingsAndFillDetailsNoCouponLabelBNPL": "Al continuar, activaremos el programa de reembolsos y rellenaremos automticamente el envo y le llevaremos a $1" "walletECContinueSavingsButtonLabel": "Aplicar descuento" "walletECContinueSavingsLabel": "Al continuar, activaremos el programa de reembolsos y aplicaremos cupones automticamente." "walletECContinueSavingsNoCouponLabel": "Si contina, activaremos el programa de reembolsos." "walletECCouponAverageSaving": "De media, se ha ahorrado $1" "walletECCouponOptionText": "Usar cup "walletECCouponsCookieDisclaimer": "Permito colocar $1 en mi dispositivo para ayudar a facturar con el proveedor de cupones segn $2", "walletECCouponsCookieDisclaimerPrivacyLinkLabel": "Declaracin de privacidad de Microsoft", "walletECEnjoyMessage": "Disfrute del resto de su recorrido de compra.", "walletECFillDetailsButtonLabelUXSimplify": "Rellenar detalles", "walletECFreBannerContent": "Encuentre las mejores ofertas con cupones y reembolsos todo antes de pagar.", "walletECFreBannerTitle": "Ahorre dinero y tiempo con Wallet en Microsoft Edge", "walletECGetCashbackLabel": "Puede conseguir hasta $1 de reembolso en $2.", "walletECGiftCardTitle": "Tarjeta regalo", "walletECManagePersonalInfo": "Administrar la informacin personal", "walletECMaskedCardDetailFetching": "Escriba su CVC para continuar", "walletECMaskedFetchErrorMessage": "Intntelo de nuevo y escriba su CVC cuando se le solicite. O bien seleccione otro mtodo de pago para continuar.", "walletECNewCtaDescriptionTemplateFive": "Si contina se le pedir $1 $2 $3 $4 y $5.", "walletECNewCtaDescriptionTemplateFour": "Si contina se le pedir $1 $2 $3 y $4.", "walletECNewCtaDescriptionTemplateOne": "Si contina se le pedir $1.", "walletECNewCtaDescriptionTemplateThree": "Si contina se le pedir $1 $2 y $3.", "walletECNewCtaDescriptionTemplateTwo": "Si contina se le pedir $1 y $2.", "walletECNewShippingAddressTitle": "Detalles del env "walletECNewUXErrorMessageTemplateFive": "Los $1, $2, $3, $4 y $5 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateFour": "Los $1, $2, $3 y $4 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateThree": "Los $1, $2 y $3 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNewUXErrorMessageTemplateTwo": "Los $1 y $2 no estn disponibles en este momento. No se preocupe, an puede completar la transaccin." "walletECNoSavedAddress": "No hay direccin guardada" "walletECNoSavedName": "No hay nombre guardado" "walletECRebatesCouponsSelectorDescription": "Le hemos aplicado los mejores descuentos y hemos encontrado que solo puede utilizar uno para esta compra. Seleccione una de las opciones siguientes para continuar." "walletECRebatesCouponsSelectorTitle": "Elija uno para continuar" "walletECReturnToCheckoutButtonAria": "Cerrar el panel y volver a la pgina de finalizacin de la compra" "walletECRewardsDonotRedeemOptionPoints": "No canjear puntos de recompensa" "walletECRewardsNoGiftCardSelected": "No hay ninguna tarjeta regalo seleccionada" "walletECRewardsPointsAndAvailableRewardsPoints": "$1/$2 puntos" "walletECRewardsRedeemOptionPoints": "$1 puntos" "walletECRewardsRedeemOptionTitle": "Canjear tarjeta regalo de $1" "walletECRewardsTitle": "tarjeta regalo Microsoft Rewards" "walletECSavingsButtonLabelUXSimplify": "Aplicar los descuentos y rellenar los detalles" "walletECSavingsDisableMessage": "$1 para activar el reembolso y aplicar cupones automticamente. Esto puede ahorrarle tiempo y dinero cuando compre en Edge." "walletECShoppingInfo": "Est usando el efectivo devuelto y cupones de compra de Microsoft." "walletECShoppingInfoForCoupon": "y cupones" "walletECShoppingInfoNew": "Est usando la devolucin de dinero de Microsoft$1." "walletECSkipCouponProgressStatus": "Omitiendo cupones "walletECThirdPartyCookies": "Cookies de terceros", "walletECTokenizationCardDetailFetching": "Estamos conectando con su banco para generar los detalles de la tarjeta para esta transaccin. Esto puede llevar unos segundos.", "walletECTokenizationFetchErrorMessage": "No se pueden generar los detalles de la tarjeta virtual. Vuelva a intentarlo o elija otra tarjeta.", "walletECUXAffirmDescription": "Dividir pagos en 8 semanas", "walletECUXAffirmDescriptionFinanced": "Compre ahora. Pague con el tiempo con Affirm.", "walletECUXBNPLDropdownTitle": "Pagar a lo largo del tiempo", "walletECUXCardKlarnaDescription": "Sin cuotas de inters pueden aplicarse recargo por demora", "walletECUXKlarnaDescription": "Compre ahora. Pague con el tiempo con Klarna.", "walletECUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletECUXNewAddressDropdownLabel": "Seleccionar direccin de env "walletECUXNewOnlyCardDropdownTitle": "Pagar con tarjeta" "walletECUXNewPaymentDropdownLabel": "Seleccionar mtodo de pago" "walletECUXNewPaymentDropdownTitle": "Pagar con tarjeta o pagar a lo largo del tiempo" "walletECUXSBillingTheSameWithShipAddress": "La direccin de facturacin es la misma que la direccin de env "walletECUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletECUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "walletECUXSmallCardAffirmDescription": "Sin recargo por demora sin intereses", "walletECUXSmallCardZipDescription": "Sin impacto en la puntuacin de crdito pueden aplicarse recargo por demora", "walletECUXZipDescription": "Dividir pagos en 6 semanas", "walletECUXsimplifyBGAANegativeContent": "Cartera prob todos los cupones pero no encontr ningn ahorro", "walletECUXsimplifyBGAANegativeTitle": "Tiene el mejor precio", "walletECUXsimplifyBGAAPostiveCouponContent": "Cartera ha probado todos los cupones disponibles", "walletECUXsimplifyBGAAPostiveTitle": "Ests ahorrando $1", "walletECUXsimplifyCashbackEnrollText": "Obtener hasta $1 con $2", "walletECUXsimplifyCashbackValue": "Hasta $1", "walletECUXsimplifyMutipleCoupon": "$1 cupones", "walletECUXsimplifyOneCoupon": "1 cup "walletECUXsimplifySavingTitle": "Aplicar descuento" "walletECUXsimplifyShoppingToggleOffCashback": "Activar Reembolso de Microsoft" "walletECUXsimplifyShoppingToggleOffCashbackAndCoupon": "Activar MicrosoftCashback y aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffContentLabel": "$1 para ahorrar tiempo y dinero al comprar online." "walletECUXsimplifyShoppingToggleOffCoupon": "Aplicar cupones automticamente" "walletECUXsimplifyShoppingToggleOffTitle": "Activar las compras en MicrosoftEdge" "walletECUXsimplifyStandardCouponContent": "Ahorro medio: $1 en $2" "walletECUXsimplifyStandardCouponContentForBestOffer": "Cartera encontrar la mejor oferta para ti" "walletECUXsimplifyStandardCouponTitle": "Se probar $1" "walletSelectString": "$1 o $2"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e futuras", "addAPassword": "Adicionar uma palavra-passe", "addMembership": "Adicionar associa "addPassword": "Adicionar palavra-passe" "address": "Endereos" "all": "Tudo" "autoSignInToggleDescription": "Inicie sesso automaticamente em sites atravs das credenciais armazenadas. Quando esta opo estiver desativada, ser-lhe- sempre solicitada a verificao antes de iniciar sesso num site." "autoSignInToggleTitle": "Incio de Sesso Automtico" "autofillAuthToggleDescription": "Se estiver ativado, ter de verificar a sua identidade com um biomtrico ou PIN sempre que utilizar o preenchimento automtico." "autofillAuthToggleTitle": "Exigir biometria ou PIN" "autofillToggleTitle": "Preenchimento automtico para outras Aplicaes" "bookingId": "ID da Reserva: $1" "cancel": "Cancelar" "cancelled": "Cancelado" "cards": "Cartas" "cashback": "Reembolso" "changePasswordActionButtonTitle": "Alterar palavra-passe" "checkIn": "Check-in" "checkOut": "Check-out" "copiedMessage": "$1 copiado(a)" "copy": "Copiar" "copyLabel": "Copiar $1" "deleteExceptionSiteActionButtonTitle": "Remover" "deleteExceptionSiteMessage": "Remover da lista recusada?" "deleteExceptionSiteTitle": "Remover" "deletePasswordActionButtonTitle": "Eliminar" "deletePasswordConfirmButton": "Eliminar palavra-passe" "deletePasswordMessage": "A eliminao desta palavra-passe no eliminar a sua conta em $1" "deletePasswordSuccessMessage": "Palavra-passe eliminada." "deletePasswordTitle": "Eliminar palavra-passe?" "digitalIdMembershipAddMembership": "Adicionar nova" "digitalIdMembershipEmptySubtitle": "Armazenamos a sua associao para ajudar a preencher rapidamente as informaes quando reserva bilhetes de voo e fornecemos capacidades diversas para que consiga maximizar as suas poupanas em conformidade." "digitalIdMembershipEmptyTitle": "Ainda no existe nenhuma associa "dismissButton": "Dispensar", "done": "Concludo", "earn": "Ganhe", "edit": "Editar", "editMembership": "Editar associa "editPassword": "Editar palavra-passe" "editPasswordActionButtonTitle": "Editar" "editPasswordDescription": "Alterar a palavra-passe aqui apenas a atualiza na sua conta Microsoft. Certifique-se de que esta palavra-passe tamb atualizada para a sua conta em $1." "enterHerePlaceholder": "Introduzir aqui" "expiredTickets": "Bilhetes expirados" "hide": "Ocultar" "hideLabel": "Ocultar $1" "hidePasswordButtonLabel": "Ocultar palavra-passe" "ignoreLeakedPasswordActionButtonTitle": "Ignorar aviso" "importPasswordFromCSV": "Importar a partir de um ficheiro CSV" "importPasswordFromGoogleChrome": "Importar do Google Chrome" "importPasswordsTitle": "Importar palavras-passe" "in1Day": "Dentro de 1 dia" "inUse": "Em utiliza "inXDays": "Dentro de $1 dias", "join": "Participar", "loginExpired": "A sua sesso expirou. Inicie sesso na sua conta nas definies do browser para continuar.", "manage": "Gerir", "membership": "ASSOCIA "membershipAdded": "Nova associao adicionada" "membershipCardHolderFirstName": "Nome prprio" "membershipCardHolderLastName": "Apelido" "membershipCardHolderMiddleName": "Nome do meio" "membershipCardHolderName": "TITULAR DO CART "membershipCopied": "Nmero de associao copiado", "membershipCopyButtonLabel": "Copiar nmero de associa "membershipDetails": "Detalhes da associa "membershipFormAddButtonLabel": "Adicionar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Guardar", "membershipInvalid": "Campo(s) necessrio(s) em falta", "membershipNumber": "N. DE ASSOCIA "membershipRemoveTitle": "Tem a certeza de que pretende remover?" "membershipRemoved": "Associao removida" "membershipType": "Tipo de associa "membershipUpdated": "Associao atualizada", "memberships": "Associaes", "moreActions": "Mais", "newPassword": "Nova palavra-passe", "offerToSavePasswordsToggleTitle": "Perguntar se pretende guardar palavras-passe", "open": "Abrir", "openChangePasswordLinkDescription": "Abrir a pgina \"$1\" para alterar a sua palavra-passe", "openChangePasswordLinkTitle": "Alterar palavra-passe", "openPasswordSiteMessage": "Abra a pgina para gerir a sua palavra-passe.", "openPasswordSiteTitle": "Abrir site", "openTicketUrlMessage": "Abra a pgina \"$1\" para gerir as suas reservas.", "openTicketUrlTitle": "Gerir reservas", "openUrlTitle": "Abrir o \"$1\"", "passwordAccountCount": "$1 contas", "passwordAccountDetails": "Detalhes da conta", "passwordAddFailed": "Falha ao adicionar a palavra-passe a palavra-passe pode j existir.", "passwordAddSuccess": "Palavra-passe adicionada.", "passwordCheck": "Verificao de palavra-passe", "passwordCheckDescription": "Verificamos as suas palavras-passe guardadas no Microsoft Edge comparando-as com um repositrio conhecido de credenciais comprometidas.", "passwordCheckLeakSubTitle": "Atualizar estas palavras-passe agora", "passwordCheckNoLeakButIgnoredSubTitle": "Tem $1 avisos ignorados", "passwordCheckNoLeakButIgnoredSubTitleSingular": "Tem 1 aviso ignorado", "passwordCheckNoLeakSubTitle": "Receber um alerta se uma palavra-passe for divulgada", "passwordCheckNoLeakTitle": "Sem palavras-passe divulgadas", "passwordCheckNoReusedSubTitle": "No est a reutilizar nenhuma palavra-passe", "passwordCheckNoReusedTitle": "As suas palavras-passe so exclusivas", "passwordCheckNoWeakSubTitle": "As suas palavras-passe parecem ser difceis de adivinhar", "passwordCheckNoWeakTitle": "Est a utilizar palavras-passe fortes", "passwordCheckReusedSubTitle": "Em vez disso utilize palavras-passe exclusivas", "passwordCheckStatus": "Palavras-passe verificadas para $1 sites", "passwordCheckStatusSingular": "Palavra-passe verificada para 1 site", "passwordCheckTimeStatus": "ltima verificao: $1", "passwordCheckTimeStatusXDaysAgo": "H $1 dias", "passwordCheckTimeStatusXDaysAgoSingular": "1 dia atr "passwordCheckWeakSubTitle": "Em vez disso, utilize palavras-passe mais fortes" "passwordChecknow": "Verificar agora" "passwordCheckup": "Verificao de palavra-passe" "passwordEditFailed": "Falha ao adicionar palavra-passe." "passwordEditFailedAlreadyExist": "Falha ao adicionar a palavra-passe, a palavra-passe pode j existir." "passwordEditSuccess": "Palavra-passe editada." "passwordEmtpyDescription": "Melhore a sua experincia de navegao e preenchimento automtico ao adicionar ou importar as suas palavras-passe." "passwordEmtpyTitle": "Adicionar ou importar palavras-passe para a sua Carteira" "passwordExceptionListSiteApps": "$1 sites e aplicaes recusados" "passwordIgnoredWarnings": "Avisos ignorados" "passwordInvalidFieldMissing": "Campo(s) necessrio(s) em falta" "passwordLabel": "Palavra-passe" "passwordLeakActionMessage": "As palavras-passe de $1 apareceram em fugas" "passwordLeakActionMessageSingular": "Uma palavra-passe apareceu em fugas de informa "passwordLeakNoteBody": "Para proteger as suas contas altere estas palavras-passe agora.", "passwordLeakNoteTitle": "Estas palavras-passe foram encontradas numa falha de segurana de dados", "passwordLeakTitle": "Palavras-passe divulgadas", "passwordLeaked": "$1 palavras-passe divulgadas", "passwordLeakedMessage": "Palavra-passe divulgada", "passwordLeakedSingular": "1 palavra-passe divulgada", "passwordListSiteApps": "$1 sites e aplicaes", "passwordListSiteAppsFound": "$1 sites e aplicaes encontrados", "passwordListSummary": "$1 sites", "passwordListSummarySingular": "1 site", "passwordPassword": "Palavra-passe", "passwordReuseAccountCountTitle": "$1 contas com a mesma palavra-passe", "passwordReuseNoteBody": "Se algum descobrir uma palavra-passe reutilizada esta pode ser utilizada para aceder s suas outras contas.", "passwordReuseNoteTitle": "Utilize palavras-passe exclusivas para cada site ou aplica "passwordReuseTitle": "Palavras-passe reutilizadas" "passwordReused": "$1 palavra-passe reutilizadas" "passwordReusedSingular": "1 palavra-passe reutilizada" "passwordSearch": "Pesquisa" "passwordSearchAria": "Pesquisar palavras-passe" "passwordSearchEmpty": "No existem sites ou aplicaes que correspondam sua pesquisa" "passwordSectionTitle": "$1 palavras-passe divulgadas" "passwordSectionTitleSingular": "1 palavra-passe divulgada" "passwordSectionViewAll": "Ver todas as palavras-passe ($1)" "passwordSectionViewAllCheck": "Verificar todas as palavras-passe" "passwordSectionViewAllLeak": "Ver todas as palavras-passe divulgadas ($1)" "passwordSectionViewMore": "Ver mais $1 palavras-passe divulgadas" "passwordSectionViewMoreSingular": "Ver mais 1 palavra-passe divulgada" "passwordSettings": "Definies" "passwordSite": "Site" "passwordSiteDetails": "Detalhes do site" "passwordSyncPageTitle": "Sincronizao de Palavras-passe" "passwordUsername": "Nome de utilizador" "passwordViewDetails": "Ver detalhes da fuga" "passwordWeak": "$1 palavras-passe fracas" "passwordWeakNoteBody": "Para proteger as suas contas, altere estas palavras-passe agora." "passwordWeakNoteTitle": "As palavras-passe fracas so mais fceis de adivinhar. Mantenha as suas contas mais seguras com uma palavra-passe mais segura." "passwordWeakSingular": "1 palavra-passe fraca" "passwords": "Palavras-passe" "paymentCard": "Carto de pagamento" "paymentCardExpireDate": "Data de expira "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Mtodos de pagamento" "prefManaged": "Esta definio foi imposta pelo seu administrador." "providedBy": "Fornecido por $1" "remove": "Remover" "removeExceptionSiteSuccessMessage": "Removido" "removeTicketMessage": "Remover este passe da Carteira" "restoreLeakedPasswordActionButtonTitle": "Aviso de restauro" "rewardPoints": "Pontos do Rewards" "rewards": "Recompensas" "savePassword": "Guardar" "showPasswordButtonLabel": "Mostrar palavra-passe" "siteLabel": "Site" "suggestStrongPasswordToggleDescription": "As sugestes de palavra-passe s funcionam quando Perguntar se pretende guardar palavras-passe e $1 esto ativas." "suggestStrongPasswordToggleManagedDescription": "A definio de sugesto de palavra-passe imposta pelo administrador." "suggestStrongPasswordToggleTitle": "Sugerir palavra-passe seguras" "ticketBeRemovedAlert": "$1 removido" "tickets": "Pedidos" "ticketsEmptySubTitle": "Podemos sincronizar os seus bilhetes do Bing Travel para a Carteira agora." "ticketsEmptyTitle": "Ainda no existem pedidos" "ticketsViewExpired": "Ver $1 passes expirados" "ticketsViewExpiredSingular": "Ver 1 passe expirado" "today": "Hoje" "tomorrow": "Amanh "turnOnSyncButton": "Sincroniza "turnOnSyncWalletTitle": "Sincronizar a sua associao em todos os dispositivos" "usernameLabel": "Nome de utilizador" "view": "Visualiza "viewLabel": "Ver $1", "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalles", "actionsAndUpcomingTitle": "Acciones y prximos", "addAPassword": "Agregue una contrase "addMembership": "Agregar suscripci "addPassword": "Agregar contrase "address": "Direcciones" "all": "Todos" "autoSignInToggleDescription": "Iniciar sesin automticamente en los sitios web mediante las credenciales almacenadas. Si se desactiva esta opcin, se te pedir confirmacin cada vez que inicies sesin en un sitio web." "autoSignInToggleTitle": "Inicio de sesin automtico" "autofillAuthToggleDescription": "Si esta opcin est activada, debers comprobar tu identificacin con un PIN o una biometra cada vez que uses autorrellenar." "autofillAuthToggleTitle": "Requieren biometra o PIN" "autofillToggleTitle": "Autorrellenar para otras aplicaciones" "bookingId": "Id. de reserva: $1" "cancel": "Cancelar" "cancelled": "Cancelado" "cards": "Tarjetas" "cashback": "Reembolso" "changePasswordActionButtonTitle": "Cambiar contrase "checkIn": "Registro", "checkOut": "Salida", "copiedMessage": "Se copi $1", "copy": "Copiar", "copyLabel": "Copiar $1", "deleteExceptionSiteActionButtonTitle": "Quitar", "deleteExceptionSiteMessage": "Quitar de la lista rechazada?", "deleteExceptionSiteTitle": "Quitar", "deletePasswordActionButtonTitle": "Eliminar", "deletePasswordConfirmButton": "Eliminar contrase "deletePasswordMessage": "La eliminacin de esta contrasea no eliminar tu cuenta en $1" "deletePasswordSuccessMessage": "Contrasea eliminada." "deletePasswordTitle": "Eliminar contrasea?" "digitalIdMembershipAddMembership": "Agregar nueva" "digitalIdMembershipEmptySubtitle": "Almacenamos tu suscripcin para ayudarte a rellenar rpidamente la informacin cuando reserves vuelos y proporcionamos diversas funcionalidades para maximizar tus ahorros consecuentemente." "digitalIdMembershipEmptyTitle": "An no hay ninguna suscripci "dismissButton": "Descartar", "done": "Listo", "earn": "Ganar", "edit": "Editar", "editMembership": "Editar suscripci "editPassword": "Editar contrase "editPasswordActionButtonTitle": "Editar", "editPasswordDescription": "Si cambias la contrasea aqu solo se actualizar en tu cuenta de Microsoft. Asegrate de que esta contrasea tambin se haya actualizado para tu cuenta en $1.", "enterHerePlaceholder": "Escribe aqu "expiredTickets": "Vales expirados" "hide": "Ocultar" "hideLabel": "Ocultar $1" "hidePasswordButtonLabel": "Ocultar contrase "ignoreLeakedPasswordActionButtonTitle": "Ignorar advertencia", "importPasswordFromCSV": "Importar desde un archivo CSV", "importPasswordFromGoogleChrome": "Importar desde Google Chrome", "importPasswordsTitle": "Importar contraseas", "in1Day": "En 1 d "inUse": "En uso" "inXDays": "En $1 das" "join": "Unirse" "loginExpired": "La sesin ha expirado. Inicie sesin en su cuenta en la configuracin del explorador para continuar." "manage": "Administrar" "membership": "MEMBRES "membershipAdded": "Nueva pertenencia agregada", "membershipCardHolderFirstName": "Nombre", "membershipCardHolderLastName": "Apellidos", "membershipCardHolderMiddleName": "Segundo nombre", "membershipCardHolderName": "TITULAR", "membershipCopied": "Nmero de pertenencia copiado", "membershipCopyButtonLabel": "Copiar el nmero de suscripci "membershipDetails": "Detalles de suscripci "membershipFormAddButtonLabel": "Agregar", "membershipFormNumber": "Nmero", "membershipFormOptionalField": "(Opcional)", "membershipFormSaveButtonLabel": "Guardar", "membershipInvalid": "Campos requeridos no encontrados", "membershipNumber": "NO DE PERTENENCIA.", "membershipRemoveTitle": " seguro de que lo desea retirar?", "membershipRemoved": "Pertenencia quitada", "membershipType": "Tipo de suscripci "membershipUpdated": "Pertenencia actualizada" "memberships": "Suscripciones" "moreActions": "M "newPassword": "Nueva contrase "offerToSavePasswordsToggleTitle": "Preguntar si quieres guardar tus contraseas" "open": "Abrir" "openChangePasswordLinkDescription": "Abrir la pgina \"$1\" para cambiar la contrase "openChangePasswordLinkTitle": "Cambiar contrase "openPasswordSiteMessage": "Abrir la pgina \"$1\" para cambiar la contrase "openPasswordSiteTitle": "Abrir sitio", "openTicketUrlMessage": "Abra la pgina \"$1\" para administrar sus reservas.", "openTicketUrlTitle": "Administrar reservas", "openUrlTitle": "Abrir \"$1\"", "passwordAccountCount": "$1cuentas", "passwordAccountDetails": "Detalles de la cuenta", "passwordAddFailed": "No se ha podido agregar la contrasea. Es posible que la contrasea ya exista.", "passwordAddSuccess": "Contrasea agregada.", "passwordCheck": "Comprobacin de contrase "passwordCheckDescription": "Comprobamos las contraseas guardadas en Edge en un repositorio conocido de credenciales expuestas." "passwordCheckLeakSubTitle": "Actualice estas contraseas ahora" "passwordCheckNoLeakButIgnoredSubTitle": "Tiene $1 advertencias omitidas" "passwordCheckNoLeakButIgnoredSubTitleSingular": "Tiene 1 advertencia omitida" "passwordCheckNoLeakSubTitle": "Recibir una alerta si se filtra una contrase "passwordCheckNoLeakTitle": "No hay contraseas filtradas", "passwordCheckNoReusedSubTitle": "No se ha reutilizando ninguna contrase "passwordCheckNoReusedTitle": "Las contraseas son nicas" "passwordCheckNoWeakSubTitle": "Las contraseas parecen difciles de adivinar" "passwordCheckNoWeakTitle": "Ests usando contraseas seguras" "passwordCheckReusedSubTitle": "Use contrasenicas en su lugar" "passwordCheckStatus": "Contraseas comprobadas para $1sitios" "passwordCheckStatusSingular": "Contrasea comprobada para 1sitio" "passwordCheckTimeStatus": "ltima comprobacin $1" "passwordCheckTimeStatusXDaysAgo": "Hace $1as" "passwordCheckTimeStatusXDaysAgoSingular": "Hace 1 "passwordCheckWeakSubTitle": "Use contraseas ms seguras en su lugar", "passwordChecknow": "Comprobar ahora", "passwordCheckup": "Comprobacin de contrase "passwordEditFailed": "No se pudo agregar la contrasea." "passwordEditFailedAlreadyExist": "No se ha podido agregar la contrasea. Es posible que la contrasea ya exista." "passwordEditSuccess": "Contrasea editada." "passwordEmtpyDescription": "Mejore la experiencia de exploracin y autorrelleno al agregar o importar sus contraseas." "passwordEmtpyTitle": "Agregue o importe contraseas a su Cartera" "passwordExceptionListSiteApps": "$1sitios y aplicaciones rechazados" "passwordIgnoredWarnings": "Advertencias omitidas" "passwordInvalidFieldMissing": "Campos requeridos no encontrados" "passwordLabel": "Contrase "passwordLeakActionMessage": "Han aparecido $1 contraseas en filtraciones", "passwordLeakActionMessageSingular": "Ha aparecido 1 contrasea en filtraciones", "passwordLeakNoteBody": "Para proteger sus cuentas cambie estas contraseas ahora.", "passwordLeakNoteTitle": "Se encontraron estas contraseas en una vulneracin de seguridad", "passwordLeakTitle": "Contraseas filtradas", "passwordLeaked": "$1Contraseas filtradas", "passwordLeakedMessage": "Contrasea filtrada", "passwordLeakedSingular": "1contrasea filtrada", "passwordListSiteApps": "$1sitios y aplicaciones", "passwordListSiteAppsFound": "$1 sitios y aplicaciones encontrados", "passwordListSummary": "$1sitios", "passwordListSummarySingular": "1sitio", "passwordPassword": "Contrase "passwordReuseAccountCountTitle": "$1 cuenta con la misma contrase "passwordReuseNoteBody": "Si alguien detecta una contrasea reutilizada la puede usar para acceder a sus dems cuentas.", "passwordReuseNoteTitle": "Use contrasenicas para cada sitio o aplicaci "passwordReuseTitle": "Contraseas reutilizadas" "passwordReused": "$1contraseas reutilizadas" "passwordReusedSingular": "1contrasea reutilizada" "passwordSearch": "Busque" "passwordSearchAria": "Busque contraseas" "passwordSearchEmpty": "Ningn sitio ni aplicacin coincide con la bsqueda" "passwordSectionTitle": "$1 Contraseas filtradas por" "passwordSectionTitleSingular": "1 contrasea filtrada" "passwordSectionViewAll": "Ver todas las contraseas ($1)" "passwordSectionViewAllCheck": "Comprobar todas las contraseas" "passwordSectionViewAllLeak": "Ver todas las contraseas filtradas ($1)" "passwordSectionViewMore": "Ver $1 ms contraseas filtradas" "passwordSectionViewMoreSingular": "Ver 1 contrases filtradas" "passwordSettings": "Configuraci "passwordSite": "Sitio", "passwordSiteDetails": "Detalles del sitio", "passwordSyncPageTitle": "Sincronizacin de contraseas", "passwordUsername": "Nombre de usuario", "passwordViewDetails": "Ver los detalles de filtraci "passwordWeak": "$1 contraseas no seguras" "passwordWeakNoteBody": "Para proteger sus cuentas, cambie estas contraseas ahora." "passwordWeakNoteTitle": "Las contraseas dbiles son mciles de adivinar. Mantenga sus cuentas ms seguras con una contrases segura." "passwordWeakSingular": "1 contrasea no segura" "passwords": "Contraseas" "paymentCard": "Tarjeta de pago" "paymentCardExpireDate": "Fecha de caducidad" "paymentSectionAddNew": "Agregar una nueva tarjeta" "paymentSectionTitle": "Mtodos de pago" "prefManaged": "Su administrador exige esta configuracin." "providedBy": "Proporcionado por $1" "remove": "Quitar" "removeExceptionSiteSuccessMessage": "Quitado" "removeTicketMessage": "Quitar este pase de Cartera" "restoreLeakedPasswordActionButtonTitle": "Restaurar advertencia" "rewardPoints": "Puntos de Rewards" "rewards": "Recompensas" "savePassword": "Guardar" "showPasswordButtonLabel": "Mostrar contrase "siteLabel": "Sitio", "suggestStrongPasswordToggleDescription": "Las sugerencias de contrasea solo funcionan cuando estn activadas las opciones Ofrecer para guardar contraseas y $1.", "suggestStrongPasswordToggleManagedDescription": "El administrador exige la configuracin de sugerencia de contrasea.", "suggestStrongPasswordToggleTitle": "Sugerir contraseas seguras", "ticketBeRemovedAlert": "Eliminado $1", "tickets": "Entradas", "ticketsEmptySubTitle": "Ahora podemos sincronizar sus billetes de Bing Travel con Wallet.", "ticketsEmptyTitle": "An no hay ningn vale", "ticketsViewExpired": "Ver $1 pases expirados", "ticketsViewExpiredSingular": "Ver 1 pase expirado", "today": "Hoy", "tomorrow": "Maana", "turnOnSyncButton": "Sincronizar", "turnOnSyncWalletTitle": "Sincronizar la pertenencia en todos los dispositivos", "usernameLabel": "Nombre de usuario", "view": "Ver", "viewLabel": "Ver $1", "wallet": "Cartera"" (Indicator: ""ver ") in Source: strings.json Observed string: ""actionCardSeeDetails": "Ver detalhes", "actionsAndUpcomingTitle": "Aes e prximos passos", "addAPassword": "Adicione umasenha", "addMembership": "Adicionar assinatura", "addPassword": "Adicionar senha", "address": "Endereos", "all": "Tudo", "autoSignInToggleDescription": "Entre em sites automaticamente usando as credenciais armazenadas. Se essa opo estiver desativada ser necessrio uma verificao sempre que voc entrar em um site.", "autoSignInToggleTitle": "Entrada Automtica", "autofillAuthToggleDescription": "Se estiver ativado voc precisar verificar sua identidade com uma biometria ou PIN sempre que usar o preenchimento automtico.", "autofillAuthToggleTitle": "Exigir biometria ou PIN", "autofillToggleTitle": "Preenchimento automtico para outros aplicativos", "bookingId": "ID da Reserva: $1", "cancel": "Cancelar", "cancelled": "Cancelado", "cards": "Cartes", "cashback": "Cashback", "changePasswordActionButtonTitle": "Alterar senha", "checkIn": "Fazer check-in", "checkOut": "Check-out", "copiedMessage": "$1 copiado", "copy": "Copiar", "copyLabel": "Copiar $1", "deleteExceptionSiteActionButtonTitle": "Remover", "deleteExceptionSiteMessage": "Remover da lista recusada?", "deleteExceptionSiteTitle": "Remover", "deletePasswordActionButtonTitle": "Excluir", "deletePasswordConfirmButton": "Excluir senha", "deletePasswordMessage": "Excluir esta senha no excluir sua conta em $1", "deletePasswordSuccessMessage": "Senha excluda.", "deletePasswordTitle": "Excluir senha?", "digitalIdMembershipAddMembership": "Adicionar novo", "digitalIdMembershipEmptySubtitle": "Armazenamos sua associao para ajudar voc a preencher rapidamente as informaes ao reservar passagens areas e fornecer diversos recursos para maximizar suas economias adequadamente.", "digitalIdMembershipEmptyTitle": "Ainda n nenhuma associa "dismissButton": "Ignorar" "done": "Concludo" "earn": "Ganhe" "edit": "Editar" "editMembership": "Editar carto de assinatura" "editPassword": "Editar senha" "editPasswordActionButtonTitle": "Editar" "editPasswordDescription": "Alterar a senha aqui apenas a atualiza em sua conta da Microsoft. Certifique-se de que esta senha tambm seja atualizada para sua conta em $1." "enterHerePlaceholder": "Inserir aqui" "expiredTickets": "Tquetes expirados" "hide": "Ocultar" "hideLabel": "Ocultar $1" "hidePasswordButtonLabel": "Ocultar senha" "ignoreLeakedPasswordActionButtonTitle": "Ignorar aviso" "importPasswordFromCSV": "Importar do arquivo CSV" "importPasswordFromGoogleChrome": "Importar do Google Chrome" "importPasswordsTitle": "Importar senhas" "in1Day": "Em 1 dia" "inUse": "Em uso" "inXDays": "Em $1 dias" "join": "Ingressar" "loginExpired": "Sua sesso expirou. Faa login em sua conta nas configuraes do navegador para continuar." "manage": "Gerenciar" "membership": "ASSOCIA "membershipAdded": "Nova associao adicionada", "membershipCardHolderFirstName": "Nome", "membershipCardHolderLastName": "Sobrenome", "membershipCardHolderMiddleName": "Sobrenome", "membershipCardHolderName": "TITULAR", "membershipCopied": "Nmero de associao copiado", "membershipCopyButtonLabel": "Copiar nmero da associa "membershipDetails": "Detalhes da assinatura" "membershipFormAddButtonLabel": "Adicionar" "membershipFormNumber": "Nmero" "membershipFormOptionalField": "(Opcional)" "membershipFormSaveButtonLabel": "Salvar" "membershipInvalid": "Campo(s) obrigatrio(s) ausente(s)" "membershipNumber": "N. DE ASSOCIAO." "membershipRemoveTitle": "Tem certeza de que deseja remover?" "membershipRemoved": "Associao removida" "membershipType": "Tipo de associa "membershipUpdated": "Associao atualizada", "memberships": "Associaes", "moreActions": "Mais", "newPassword": "Nova senha", "offerToSavePasswordsToggleTitle": "Oferecer para salvar senhas", "open": "Abrir", "openChangePasswordLinkDescription": "Abra a pgina \"$1\" para alterar sua senha", "openChangePasswordLinkTitle": "Alterar senha", "openPasswordSiteMessage": "Abra a pgina \"$1\" para gerenciar sua senha.", "openPasswordSiteTitle": "Abrir site", "openTicketUrlMessage": "Abra a pgina \"$1\" para gerenciar suas reservas.", "openTicketUrlTitle": "Gerenciar reservas", "openUrlTitle": "Abra o \"$1\"", "passwordAccountCount": "$1 contas", "passwordAccountDetails": "Detalhes da conta", "passwordAddFailed": "Falha ao adicionar senha a senha pode j existir.", "passwordAddSuccess": "Senha adicionada.", "passwordCheck": "Verificao de senha", "passwordCheckDescription": "Verificamos suas senhas salvas no Edge em um repositrio conhecido de credenciais expostas.", "passwordCheckLeakSubTitle": "Atualizar estas senhas agora", "passwordCheckNoLeakButIgnoredSubTitle": "Voc tem $1 avisos ignorados", "passwordCheckNoLeakButIgnoredSubTitleSingular": "Voc tem 1 aviso ignorado", "passwordCheckNoLeakSubTitle": "Voc receber um alerta se uma senha for vazada", "passwordCheckNoLeakTitle": "Nenhuma senha vazada", "passwordCheckNoReusedSubTitle": "Voco est reutilizando nenhuma senha", "passwordCheckNoReusedTitle": "Suas senhas so exclusivas", "passwordCheckNoWeakSubTitle": "Suas senhas parecem difceis de adivinhar", "passwordCheckNoWeakTitle": "Voc est usando senhas fortes", "passwordCheckReusedSubTitle": "Em vez disso use senhas exclusivas", "passwordCheckStatus": "Senhas verificadas para sites de $1", "passwordCheckStatusSingular": "Senha verificada para 1 site", "passwordCheckTimeStatus": "ltima verificao de $1", "passwordCheckTimeStatusXDaysAgo": "$1 dias atr "passwordCheckTimeStatusXDaysAgoSingular": "1 dia atr "passwordCheckWeakSubTitle": "Em vez disso use senhas mais fortes", "passwordChecknow": "Verificar agora", "passwordCheckup": "Verificao de senha", "passwordEditFailed": "Falha ao adicionar senha.", "passwordEditFailedAlreadyExist": "Falha ao adicionar senha a senha pode j existir.", "passwordEditSuccess": "Senha editada.", "passwordEmtpyDescription": "Melhore sua experincia de navegao e autopreenchimento ao adicionar ou importar suas senhas.", "passwordEmtpyTitle": "Adicionar ou importar senhas para sua Carteira", "passwordExceptionListSiteApps": "$1 sites e aplicativos recusados", "passwordIgnoredWarnings": "Avisos ignorados", "passwordInvalidFieldMissing": "Campo(s) obrigatrio(s) ausente(s)", "passwordLabel": "Senha", "passwordLeakActionMessage": "Senhas de $1 apareceram em vazamentos", "passwordLeakActionMessageSingular": "A senha de $1 apareceu em vazamentos", "passwordLeakNoteBody": "Para proteger suas contas altere essas senhas agora.", "passwordLeakNoteTitle": "Essas senhas foram encontradas em um vazamento de dados", "passwordLeakTitle": "Senhas vazadas", "passwordLeaked": "$1 senhas vazadas", "passwordLeakedMessage": "Senha vazada", "passwordLeakedSingular": "1 senha vazada", "passwordListSiteApps": "$1 sites e aplicativos", "passwordListSiteAppsFound": "Sites e aplicativos de $1 encontrados", "passwordListSummary": "$1 sites", "passwordListSummarySingular": "1 site", "passwordPassword": "Senha", "passwordReuseAccountCountTitle": "$1 contas usando a mesma senha", "passwordReuseNoteBody": "Se algum descobrir uma senha reutilizada ela poder ser usada para acessar suas outras contas.", "passwordReuseNoteTitle": "Usar senhas exclusivas para cada site ou aplicativo", "passwordReuseTitle": "Senhas reutilizadas", "passwordReused": "$1 senhas reutilizadas", "passwordReusedSingular": "1 senha reutilizada", "passwordSearch": "Pesquisar", "passwordSearchAria": "Pesquisar senhas", "passwordSearchEmpty": "Nenhum site ou aplicativo corresponde sua pesquisa", "passwordSectionTitle": "$1 senhas vazadas", "passwordSectionTitleSingular": "1 senha vazada", "passwordSectionViewAll": "Exibir toas as senhas ($1)", "passwordSectionViewAllCheck": "Verificar todas as senhas ($1)", "passwordSectionViewAllLeak": "Exibir todas as senhas vazadas ($1)", "passwordSectionViewMore": "Exibir mais $1 senhas vazadas", "passwordSectionViewMoreSingular": "Exibir mais 1 senha vazada", "passwordSettings": "Configuraes", "passwordSite": "Site", "passwordSiteDetails": "Detalhes do site", "passwordSyncPageTitle": "Sincronizao de Senhas", "passwordUsername": "Nome de usurio", "passwordViewDetails": "Exibir detalhes do vazamento", "passwordWeak": "Senhas fracas de $1", "passwordWeakNoteBody": "Para proteger suas contas altere essas senhas agora.", "passwordWeakNoteTitle": "Senhas fracas so mais fceis de adivinhar. Mantenha suas contas mais seguras com uma senha mais forte.", "passwordWeakSingular": "1 senha fraca", "passwords": "Senhas", "paymentCard": "Carto de pagamento", "paymentCardExpireDate": "Data de expira "paymentSectionAddNew": "Adicionar um novo cart "paymentSectionTitle": "Formas de pagamento", "prefManaged": "Esta configura imposta pelo seu administrador.", "providedBy": "Fornecido por $1", "remove": "Remover", "removeExceptionSiteSuccessMessage": "Removido", "removeTicketMessage": "Remover este passe da Carteira", "restoreLeakedPasswordActionButtonTitle": "Aviso de restaura "rewardPoints": "Pontos do Rewards" "rewards": "Rewards" "savePassword": "Salvar" "showPasswordButtonLabel": "Mostrar senha" "siteLabel": "Site" "suggestStrongPasswordToggleDescription": "As sugestes de senha funcionam apenas quando a opo Oferecer para salvar senhas e $1 esto ativadas." "suggestStrongPasswordToggleManagedDescription": "A configurao de sugesto de senha imposta pelo administrador." "suggestStrongPasswordToggleTitle": "Sugerir senhas fortes" "ticketBeRemovedAlert": "$1 Removido" "tickets": "Tquetes" "ticketsEmptySubTitle": "Podemos sincronizar seus bilhetes do Bing Viagem para a Carteira agora." "ticketsEmptyTitle": "Ainda n nenhum tquete" "ticketsViewExpired": "Exibir $1 passes expirados" "ticketsViewExpiredSingular": "Exibir 1 passagem expirada" "today": "Hoje" "tomorrow": "Amanh "turnOnSyncButton": "Sincronizar", "turnOnSyncWalletTitle": "Sincronizar sua assinatura em todos os dispositivos", "usernameLabel": "Nome de usurio", "view": "Exibir", "viewLabel": "Modo de exibio $1", "wallet": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declarao de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Utilizao do Microsoft Edge", "affirmDescriptionText": "Compre agora pague de forma faseada com o Affirm. $1", "affirmDisclaimerLinkText": "Contacte a Affirm", "affirmDisclaimerText": "O Carto Affirm um carto virtual de utilizao limitada financiado pelo Cross River Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ou pela Affirm Loan Services LLC dependendo dos termos do seu contrato de emprstimo. emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A. Inc. O Carto Affirm emitido pela Marqeta. Se tiver alguma questo $1.", "affirmEstimatedFeesText": "No aplicadas taxas por atrasos", "affirmLogoDesc": "Compre agora pague de forma faseada com a Affirm", "affirmPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Affirm de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Affirm podem aplicar-se os termos de pagamento com essa aprovao.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicie sesso na sua aplicao de banca online para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para o seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "O seu banco est a enviar-lhe um cdigo de verificao para o seu endereo de e-mail $1.", "challengeDescriptionOnlineBanking": "Introduza abaixo o cdigo que recebeu do seu banco.", "challengeDescriptionOutboundCall": "O seu banco ir ligar para o seu nmero de telemvel $1 com um cdigo de verificao.", "challengeDescriptionSMS": "O seu banco est a enviar-lhe um cdigo de verificao para o nmero de telemvel $1.", "close": "Fechar", "commonSubtitle": "Veja se elegvel para pagamentos faseados", "dismiss": "Dispensar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outro", "feedbackOptionTookTooMuchTime": "Demorou demasiado tempo", "klarnaDescriptionText": "Faa as suas compras agora. Pague ao longo do tempo com a Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Klarna Visa emitido pelo Sutton Bank Membro da Agncia Federal de Garantia de Depsitos Bancrios ao abrigo da licena da Visa U.S.A Inc. O Carto Klarna tem tecnologia da Marqeta. Apoio a Clientes: $1", "klarnaEstimatedFeesText": "Podem aplicar-se taxas do servio Klarna de atraso", "klarnaFeeTermLinkText": "Servio \"Pague Depois\" da Klarna em $1", "klarnaLogoDesc": "Poupe dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar concorda com $1 e reconhece que o seu montante total de compra juntamente com o local onde faz compras ser partilhado com a Klarna de acordo com $2. Se tiver sido recentemente aprovado para uma transao pela Klarna podem aplicar-se os termos de pagamento com essa aprovao.", "learnMore": "Saber mais", "manageYourPaymentMethodsLinkText": "Gerir os seus mtodos de pagamento", "msPayAddCardAgreement": "Ao continuar concorda com $1 $2 e $3 relativamente forma como os seus dados so tratados.", "nextButtonAriaLabel": "Ir para a pgina seguinte", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos do Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Inscrever-se", "tokenizationEnrollConfirmDialogTitle": "Pague em segurana com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configure um carto virtual e ganhe 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou pedir o cdigo de segurana do carto para verificar se se trata de si.", "tokenizationEnrollConfirmModalDescription": "Um carto virtual oculta os detalhes do seu carto a comerciantes quando fizer compras online. Se algum deles tiver uma falha de segurana de dados os seus detalhes permanecero protegidos. $1", "tokenizationTerms": "Ao continuar concorda com os $1.", "tokenizeCardBack": "Voltar", "tokenizeCardChallengeMethodAPPToAPP": "Aplicao de servio bancrio mvel", "tokenizeCardChallengeMethodCustomerService": "Suporte ao cliente do banco", "tokenizeCardChallengeMethodEmail": "E-mail", "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria", "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensagem de texto", "tokenizeCardCvvInvalidError": "Verifique o seu cdigo de segurana e tente novamente.", "tokenizeCardEnterCode": "Introduzir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos efetuar a verifica "tokenizeCardEnterCvvStepDescription": "O seu banco exige que verifique o cdigo de segurana CVV associado ao seu carto $1 que termina em $2." "tokenizeCardErrorStepTitle": "Ocorreu um erro" "tokenizeCardFetchCodeError": "O emissor do seu carto teve um problema ao enviar o cdigo. Pea outro cdigo ou utilize um mtodo de verificao diferente." "tokenizeCardFetchCodeErrorCustomerService": "O emissor do seu carto teve um problema ao gerar o cdigo. Experimente um mtodo de verificao diferente ou tente novamente mais tarde." "tokenizeCardGeneralError": "O emissor do seu carto est a ter problemas neste momento. Tente novamente mais tarde." "tokenizeCardLoadingTitle": "A contactar o seu banco "tokenizeCardNext": "Seguinte", "tokenizeCardResendCode": "Reenviar o cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos efetuar a verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tentar novamente" "tokenizeCardValidationError": "O emissor do seu carto consegue efetuar a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "A verificar" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "No conseguimos preencher automaticamente as informaes do seu carto a partir do $1. Insira manualmente as informaes do seu carto $1 durante a compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto e do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Os seus detalhes de pagamento de $1 foram preenchidos. Caso no tenha, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha o seu endereo de faturao." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de expira "walletDrawerLinkErrorMessage": "No conseguimos associar a sua conta Microsoft a $1. Tente novamente mais tarde.", "walletDrawerNameAndAddressLabel": "O seu nome e endereo para fatura "walletDrawerPayWithVirtualCard": "Pague com o seu carto $1 $2" "walletDrawerSystemErrorHeader": "Ups" "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado pelo seu feedback. Ir ajudar-nos a melhorar a Carteira." "walletMicrofeedbackPrompt": "Est contente com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerir mtodos de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta cartes virtuais", "walletUXSTokenCardLogoContent": "Nmero de carto virtual $1 ativado para proteger as suas informaes de pagamento", "zipDescriptionText": "Compre agora pague durante seis semanas com o Zip. $1", "zipEstimatedFeesText": "Podem aplicar-se taxas de atraso", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip compre agora pague depois", "zipPolicy": "Ao continuar concorda com os nossos $1 e reconhece que o seu valor total de compra ser partilhado com a Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Poltica de Privacidade da Microsoft", "aboutTermsOfUseLinkText": "Termos de Uso do Microsoft Edge", "affirmDescriptionText": "Compre agora pague ao longo do tempo com Affirm. $1", "affirmDisclaimerLinkText": "Contactar a Affirm", "affirmDisclaimerText": "O Carto Afirmativo um carto virtual de uso limitado e financiamento pelo Cross River Bank membro da FDIC ou Affirm Loan Services empresa de responsabilidade limitada dependendo dos termos do seu contrato de emprstimo e emitido por Mila Bank membro da FDIC de acordo com a licena da Visa U.S.A. Inc. O Carto da Affirm emitido pela Marqeta. $1 se voc tiver alguma dvida.", "affirmEstimatedFeesText": "No se aplicam tarifas atrasadas", "affirmLogoDesc": "Compre agora pague a longo prazo com a Affirm", "affirmPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Affirm de acordo com $2. Se voc tiver sido aprovado recentemente pela Affirm para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Entre em seu aplicativo online do banco para receber um cdigo de verificao.", "challengeDescriptionCustomerService": "Ligue para seu banco no $1 para receber um cdigo de verificao.", "challengeDescriptionEmail": "Seu banco est lhe enviando um cdigo de verificao para seu endereo de email $1.", "challengeDescriptionOnlineBanking": "Insira abaixo o cdigo que voc recebeu de seu banco.", "challengeDescriptionOutboundCall": "Seu banco ligar para seu nmero de celular $1 com um cdigo de verificao.", "challengeDescriptionSMS": "Seu banco est lhe enviando um cdigo de verificao para seu nmero do telefone celular $1.", "close": "Fechar", "commonSubtitle": "Confira se est qualificado para pagamento a longo prazo", "dismiss": "Ignorar", "feedbackOptionAutofillDontWork": "O preenchimento automtico no funcionou", "feedbackOptionOthers": "Outros", "feedbackOptionTookTooMuchTime": "Demorou muito tempo", "klarnaDescriptionText": "Compre agora. Pague depois com o Klarna. $1", "klarnaDisclaimerText": "O Carto Comercial Visa Klarna emitido pelo Sutton Bank membro da FDIC de acordo com uma licena da Visa U.S.A Inc. O Carto Klarna da plataforma Marqeta. Servio de Atendimento ao Cliente $1", "klarnaEstimatedFeesText": "Servio Klarna e taxas atrasadas podem ser aplicadas", "klarnaFeeTermLinkText": "Pagar mais tarde em $1 do Klarna", "klarnaLogoDesc": "Economize dinheiro com a Klarna.", "klarnaPolicy": "Ao continuar voc concorda com $1 e reconhece que o valor total da compra junto com o local em que voc compra ser compartilhado com a Klarna de acordo com $2. Se voc tiver sido aprovado recentemente pela Klarna para uma transao os termos de pagamento dessa aprovao podero ser aplicados.", "learnMore": "Saiba mais", "manageYourPaymentMethodsLinkText": "Gerenciar suas formas de pagamento", "msPayAddCardAgreement": "Ao continuar voc concorda com os $1 $2 e $3 sobre como seus dados so tratados.", "nextButtonAriaLabel": "Ir para a prxima pgina", "paginationButtonAriaLabel": "Ir para a pgina $1", "paymentServiceTermsLinkText": "Termos e Condies de Servio de Pagamento", "previousButtonAriaLabel": "Ir para a pgina anterior", "textOfChangeButton": "Alterar", "textOfCreateButton": "Criar", "tokenizationEnroll": "Registrar", "tokenizationEnrollConfirmDialogTitle": "Pague de forma segura com um carto virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar um carto virtual e ganhar 20 pontos do Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "O emissor do seu carto pode enviar um cdigo de verificao ou solicitar o cdigo de segurana do carto para verificar se voc "tokenizationEnrollConfirmModalDescription": "Um carto virtual esconde os detalhes do seu carto dos comerciantes quando voc faz compras online. Se algum deles sofrer uma violao de dados, seus dados permanecero protegidos. $1" "tokenizationTerms": "Ao continuar, voc concorda com $1." "tokenizeCardBack": "Voltar" "tokenizeCardChallengeMethodAPPToAPP": "Aplicativo de dispositivo mvel do banco" "tokenizeCardChallengeMethodCustomerService": "Servio de atendimento ao cliente do banco" "tokenizeCardChallengeMethodEmail": "Email" "tokenizeCardChallengeMethodOnlineBanking": "Conta bancria" "tokenizeCardChallengeMethodOutboundCall": "Chamada telefnica" "tokenizeCardChallengeMethodSMS": "Mensagem de texto" "tokenizeCardCvvInvalidError": "Verifique seu cdigo de segurana e tente novamente." "tokenizeCardEnterCode": "Inserir cdigo" "tokenizeCardEnterCodeStepTitle": "Vamos fazer sua verifica "tokenizeCardEnterCvvStepDescription": "Seu banco exige que voc verifique o cdigo de segurana CVV associado ao seu $1 que termina em $2.", "tokenizeCardErrorStepTitle": "Algo deu errado", "tokenizeCardFetchCodeError": "O emissor do carto teve um problema ao enviar o cdigo. Solicite outro cdigo ou use um mtodo de verificao diferente.", "tokenizeCardFetchCodeErrorCustomerService": "O emissor do carto teve um problema ao gerar o cdigo. Tente um mtodo de verificao diferente ou tente novamente mais tarde.", "tokenizeCardGeneralError": "O emissor de seu carto est tendo problemas no momento. Tente novamente mais tarde.", "tokenizeCardLoadingTitle": "Contatando seu banco...", "tokenizeCardNext": "Avanar", "tokenizeCardResendCode": "Reenviar cdigo", "tokenizeCardSelectMethodDescription": "Escolha um dos seguintes mtodos de verificao:", "tokenizeCardSelectMethodStepTitle": "Vamos fazer sua verifica "tokenizeCardSendingCode": "Cdigo enviado!" "tokenizeCardTryAgain": "Tente novamente" "tokenizeCardValidationError": "O emissor de seu carto pode fazer a verificao. Tente novamente em breve." "tokenizeCardVerify": "Verificar" "tokenizeCardVerifyWithAnotherMethod": "Verificar com outro mtodo" "tokenizeCardVerifying": "Verificando" "walletCommonAccountCount": "$1 contas" "walletDrawerAutoFillErrorMessage": "N possvel preencher automaticamente as informaes do carto a partir de $1. Insira manualmente as informaes do carto de $1 durante a finalizao da compra." "walletDrawerAutoFillMessage": "Preenchemos automaticamente as informaes do seu carto a partir de $1." "walletDrawerAutoFillMessageWithBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique no carto e nos detalhes do endereo abaixo para copiar." "walletDrawerAutoFillMessageWithoutBillingAddress": "Seus detalhes de pagamento de $1 foram preenchidos. Caso contrrio, clique nos detalhes do carto abaixo para copiar. Para concluir esta compra, preencha seu endereo de cobrana residencial." "walletDrawerCvcLabel": "CVC" "walletDrawerExpirationLabel": "Expira "walletDrawerLabelCopyCardNumber": "Copiar nmero do cart "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nome e endere "walletDrawerLabelShowCardNumber": "Mostrar nmero do cart "walletDrawerLabelShowCvc": "Mostrar CVC" "walletDrawerLabelShowExpirationDate": "Copiar data de validade" "walletDrawerLinkErrorMessage": "N possvel vincular sua conta Microsoft a $1. Tente novamente mais tarde." "walletDrawerNameAndAddressLabel": "Seu nome e endereo para cobran "walletDrawerPayWithVirtualCard": "Pague com seu carto $1 $2", "walletDrawerSystemErrorHeader": "Ah n "walletDrawerVirtualCardNumberLabel": "Nmero do carto virtual" "walletFeedbackThankYouText": "Obrigado por seus comentrios. Isso nos ajudar a melhorar a velocidade da Carteira." "walletMicrofeedbackPrompt": "Satisfeito com a Carteira?" "walletSeeDetailsAriaLabel": "ver detalhes" "walletUXAddPaymentButtonTitle": "Adicionar novo cart "walletUXManagePaymentButtonTitle": "Gerenciar formas de pagamento", "walletUXSInEligibleCardLogoContent": "Este site no suporta carto virtual", "walletUXSTokenCardLogoContent": "Nmero do carto virtual $1 ativado para proteger suas informaes de pagamento", "zipDescriptionText": "Compre agora pague em 6 semanas com Zip. $1", "zipEstimatedFeesText": "Taxas atrasadas podem ser aplicadas", "zipFeeTermLinkText": "Termos de Servio do Zip", "zipLogoDesc": "Zip comprar agora pagar depois", "zipPolicy": "Ao continuar voc concorda com nossos $1 e reconhece que o valor total da compra ser compartilhado com o Zip de acordo com $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""aboutPrivacyStatementLinkText": "Declaracin de privacidad de Microsoft", "aboutTermsOfUseLinkText": "Trminos de uso de Microsoft Edge", "affirmDescriptionText": "Compra ahora y paga despus con Affirm. $1", "affirmDisclaimerLinkText": "Ponerme en contacto con Affirm", "affirmDisclaimerText": "La tarjeta Affirm es una tarjeta virtual de uso limitado con fondos de Cross River Bank FDIC o Affirm Loan Services LLC en funcin de los trminos del contrato de prstamo y emitida por Sutton Bank banco miembro de FDIC en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Affirm cuenta con tecnologa de Marqeta. $1 si tienes alguna pregunta.", "affirmEstimatedFeesText": "No se aplican cargos con retraso", "affirmLogoDesc": "Compra ahora y paga despus con Affirm", "affirmPolicy": "Al continuar acepta $1 y reconoce que el importe total de la compra junto con el lugar en el que compra se compartirn con La autorizacin de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Parte de la Funcin pueden aplicarse los trminos de pago con esa aprobacin.", "cancel": "Cancelar", "challengeDescriptionAPPToAPP": "Inicia sesin en tu aplicacin de banca en lnea para recibir un cdigo de verificacin.", "challengeDescriptionCustomerService": "Llama a tu banco al $1 para recibir un cdigo de verificacin.", "challengeDescriptionEmail": "Tu banco te est enviando un cdigo de verificacin a tu direccin de correo electrnico $1.", "challengeDescriptionOnlineBanking": "Introduce a continuacin el cdigo que recibiste de tu banco.", "challengeDescriptionOutboundCall": "Tu banco llamar a tu nmero de telfono mvil $1 con un cdigo de verificacin.", "challengeDescriptionSMS": "Tu banco te est enviando un cdigo de verificacin a tu nmero de telfono mvil $1.", "close": "Cerrar", "commonSubtitle": "Comprueba si cumples los requisitos para pagar despu "dismiss": "Descartar" "feedbackOptionAutofillDontWork": "Error al autorrellenar" "feedbackOptionOthers": "Otro" "feedbackOptionTookTooMuchTime": "Se tard demasiado tiempo" "klarnaDescriptionText": "Compra ahora. Paga despus con Klarna. $1" "klarnaDisclaimerText": "La tarjeta Klarna Visa Commercial Card es emitida por Sutton Bank, banco miembro de la Corporacin Federal de Seguro de Depsitos (FDIC), en virtud de una licencia emitida por VisaU.S.AInc. La tarjeta Klarna cuenta con tecnologa de Marqeta. Atencin al cliente $1" "klarnaEstimatedFeesText": "Pueden aplicarse cargos por servicio y demora de Klarna" "klarnaFeeTermLinkText": "\"Paga despus\" de Klarna en $1" "klarnaLogoDesc": "Ahorra dinero con Klarna." "klarnaPolicy": "Al continuar, acepta $1 y reconoce que el importe total de la compra junto con el lugar donde compre se compartir con Klarna, de acuerdo con $2. Si ha sido aprobado recientemente para una transaccin por Klarna, pueden aplicarse los trminos de pago con esa aprobacin." "learnMore": "Obtener ms informaci "manageYourPaymentMethodsLinkText": "Administrar los mtodos de pago", "msPayAddCardAgreement": "Al continuar aceptas $1 $2 y $3 relativos a cmo se administran sus datos.", "nextButtonAriaLabel": "Ir a la pgina siguiente", "paginationButtonAriaLabel": "Ir a la pgina $1", "paymentServiceTermsLinkText": "Trminos del servicio de pago", "previousButtonAriaLabel": "Ir a la pgina anterior", "textOfChangeButton": "Cambiar", "textOfCreateButton": "Crear", "tokenizationEnroll": "Inscribirse", "tokenizationEnrollConfirmDialogTitle": "Paga de forma segura con una tarjeta virtual", "tokenizationEnrollConfirmDialogTitleForRewards": "Configurar una tarjeta virtual y ganar 20 puntos de Microsoft Rewards", "tokenizationEnrollConfirmFooterDescription": "El emisor de la tarjeta puede enviar un cdigo de verificacin o solicitar el cdigo de seguridad de la tarjeta para comprobar que eres t "tokenizationEnrollConfirmModalDescription": "Una tarjeta virtual oculta los detalles de la tarjeta a los comerciantes cuando compras en lnea. Si alguno de ellos experimenta una vulneracin de datos, tus detalles permanecern protegidos. $1" "tokenizationTerms": "Al continuar, aceptas el $1." "tokenizeCardBack": "Atr "tokenizeCardChallengeMethodAPPToAPP": "Aplicacin de banca mvil", "tokenizeCardChallengeMethodCustomerService": "Servicio de atencin al cliente del banco", "tokenizeCardChallengeMethodEmail": "Correo electrnico", "tokenizeCardChallengeMethodOnlineBanking": "Cuenta bancaria", "tokenizeCardChallengeMethodOutboundCall": "Llamada telefnica", "tokenizeCardChallengeMethodSMS": "Mensaje de texto", "tokenizeCardCvvInvalidError": "Comprueba el cdigo de seguridad e intntalo de nuevo.", "tokenizeCardEnterCode": "Introducir cdigo", "tokenizeCardEnterCodeStepTitle": "Vamos a realizar la comprobaci "tokenizeCardEnterCvvStepDescription": "Tu banco requiere que compruebes el cdigo de seguridad CVV asociado a tu $1 que termina en $2." "tokenizeCardErrorStepTitle": "Hubo un problema" "tokenizeCardFetchCodeError": "El emisor de la tarjeta tuvo un problema para enviar el cdigo. Solicite otro cdigo o use otro mtodo de verificacin." "tokenizeCardFetchCodeErrorCustomerService": "El emisor de la tarjeta tuvo un problema al generar el cdigo. Pruebe con otro mtodo de verificacin o intntelo de nuevo ms tarde." "tokenizeCardGeneralError": "El emisor de la tarjeta tiene problemas en este momento. Vuelve a intentarlo ms tarde." "tokenizeCardLoadingTitle": "Contactando con tu banco..." "tokenizeCardNext": "Siguiente" "tokenizeCardResendCode": "Reenviar cdigo" "tokenizeCardSelectMethodDescription": "Elige uno de los mtodos de comprobacin siguientes:" "tokenizeCardSelectMethodStepTitle": "Vamos a realizar la comprobaci "tokenizeCardSendingCode": "Cdigo enviado", "tokenizeCardTryAgain": "Volver a intentarlo", "tokenizeCardValidationError": "El emisor de la tarjeta no pudo comprobarlo. Intntalo de nuevo en breve.", "tokenizeCardVerify": "Comprobar", "tokenizeCardVerifyWithAnotherMethod": "Comprobar con otro mtodo", "tokenizeCardVerifying": "Verificando", "walletCommonAccountCount": "$1 cuenta", "walletDrawerAutoFillErrorMessage": "No podemos rellenar automticamente la informacin de tu tarjeta desde $1. Escribe manualmente esta informacin de $1 durante la finalizacin de la compra.", "walletDrawerAutoFillMessage": "Hemos rellenado automticamente la informacin de la tarjeta desde $1.", "walletDrawerAutoFillMessageWithBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en la tarjeta y los detalles de direccin siguientes para copiar.", "walletDrawerAutoFillMessageWithoutBillingAddress": "Se han rellenado los detalles de pago de $1. Si no es as haga clic en los detalles de la tarjeta a continuacin para copiar. Para completar esta compra rellene la direccin de facturacin de su hogar.", "walletDrawerCvcLabel": "CVC", "walletDrawerExpirationLabel": "Expiraci "walletDrawerLabelCopyCardNumber": "Copiar nmero de la tarjeta" "walletDrawerLabelCopyCvc": "Copiar CVC" "walletDrawerLabelCopyNameAddress": "Copiar nombre y direcci "walletDrawerLabelShowCardNumber": "Mostrar nmero de tarjeta", "walletDrawerLabelShowCvc": "Mostrar CVC", "walletDrawerLabelShowExpirationDate": "Copiar fecha de expiraci "walletDrawerLinkErrorMessage": "No podemos vincular tu cuenta Microsoft a $1. Vuelve a intentarlo ms tarde." "walletDrawerNameAndAddressLabel": "Tu nombre y direccin de facturaci "walletDrawerPayWithVirtualCard": "Pagar con tu tarjeta $1 $2", "walletDrawerSystemErrorHeader": "Vaya!", "walletDrawerVirtualCardNumberLabel": "Nmero de tarjeta virtual", "walletFeedbackThankYouText": "Gracias por los comentarios. Nos ayudar a mejorar Cartera.", "walletMicrofeedbackPrompt": "s satisfecho con Cartera?", "walletSeeDetailsAriaLabel": "ver detalles", "walletUXAddPaymentButtonTitle": "Agregar nueva tarjeta", "walletUXManagePaymentButtonTitle": "Administrar mtodos de pago", "walletUXSInEligibleCardLogoContent": "Este sitio web no admite tarjeta virtual", "walletUXSTokenCardLogoContent": "Nmero de tarjeta virtual $1 activado para proteger la informacin de pago", "zipDescriptionText": "Compra ahora paga en 6 semanas con Zip. $1", "zipEstimatedFeesText": "Pueden aplicarse cargos con retraso", "zipFeeTermLinkText": "Trminos del servicio de Zip", "zipLogoDesc": "Zip compra ahora paga despu "zipPolicy": "Al continuar, aceptas nuestros $1 y reconoces que el importe total de la compra se compartir con Zip, de acuerdo con $2."" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Ativar carto virtual", "featurePromotionActionLinkText": "Experimentar agora", "learnMoreLinkTextShort": "Saber mais", "membershipsDescription": "Mantenha tudo organizado e sob controlo.", "membershipsPromotionTitle": "Faa a gesto das suas associaes na Carteira", "msWalletNotificationCardExpired": "O seu carto expirou", "msWalletNotificationCardExpiring": "O seu carto expira em breve", "msWalletNotificationCardTokenizationEligibleDescription": "Os cartes virtuais so credenciais de pagamento de utilizanica que so geradas aleatoriamente sempre que faz uma compra online. Isto ajuda a garantir que o seu $1 est protegido.", "msWalletNotificationCardTokenizationEligibleHeader": "Proteja os detalhes do seu cart "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure um carto virtual para tornar as compras online mais seguras e convenientes." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure um carto virtual para tornar as compras online mais seguras e ganhar 20 pontos do Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar para $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteja as suas compras com cartes virtuais" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explore a Web3 de forma segura com esta carteira sem depositrio" "msWalletNotificationCryptowalletSignupTitle": "Configurar a sua Carteira Criptogrfica" "msWalletNotificationDismissLabel": "Dispensar" "msWalletNotificationDismissPermanently": "Dispensar permanentemente" "msWalletNotificationDismissText": "No ver esta notificao novamente" "msWalletNotificationDonationSummaryLinkText": "Conferir" "msWalletNotificationDonationSummaryTitle": "Veja todo o seu resumo de donativos e n "msWalletNotificationFixLeakage": "Ver detalhes", "msWalletNotificationHotelReservationBody": "A sua data de reserva de $1 de $2 a $3 est a aproximar-se.", "msWalletNotificationHotelReservationTitle": "Alojamento futuro", "msWalletNotificationHotelReservationViewDetails": "Ver detalhes", "msWalletNotificationLeakageBody": "$1 das suas $2 palavras-passe foram divulgadas.", "msWalletNotificationLeakageTitle": "Divulgao de palavra-passe", "msWalletNotificationOrderStatusTitle": "Estado da encomenda atualizado", "msWalletNotificationPOMessage": "A sua oferta selecionada de $1 do Microsoft Cashback expira dentro de $2", "msWalletNotificationPOTitle": "Oferta a expirar em breve", "msWalletNotificationPasswordCompromiseBody": "O Microsoft Edge detetou que $1 das suas palavras-passe foram encontradas numa fuga de dados online conhecida.", "msWalletNotificationPasswordCompromiseTitle": "Palavra-passe comprometida", "msWalletNotificationRebatesCashoutAction": "Transferir para Paypal", "msWalletNotificationRebatesCashoutAmountDescription": "Parabns tem $1 de reembolso. Levante com o PayPal.", "msWalletNotificationRebatesCashoutDescription": "Saiba mais sobre o programa de reembolso e o levantamento com o PayPal.", "msWalletNotificationRebatesCashoutTitle": "Est na hora de receber o seu reembolso!", "msWalletNotificationRoamCardAction": "Guardar o cart "msWalletNotificationRoamCardActionV2": "Guardar carto na conta Microsoft" "msWalletNotificationRoamCardHeader": "Guardar o carto na conta Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pague mais rapidamente e a partir de diferentes dispositivos em compras futuras" "msWalletNotificationRoamCardHeaderV3": "Pague mais rapidamente a partir de qualquer dispositivo" "msWalletNotificationSnoozeLabel": "Suspender" "msWalletNotificationSnoozeText": "Notificao suspensa durante sete dias" "msWalletNotificationSnoozeText1": "Notificao suspensa durante $1 dias" "msWalletNotificationTrackOrderLink": "Monitorizar encomenda" "msWalletNotificationTrackOrderSubTitle": "A carteira ajuda a monitorizar a sua encomenda quando compra em determinados sites." "msWalletNotificationTrackOrderTitle": "Monitorizar a sua encomenda" "msWalletNotificationUpdateButton": "Atualizar agora" "msWalletNotificationUpdateButton1": "Atualizar ou remover cart "msWalletNotificationUpdateButton2": "Corrigir", "msWalletNotificationUpdateCardFailText": "A atualizao falhou. Tente novamente em $1", "msWalletNotificationUpdateExpText": "Edite as informaes do seu carto para continuar a utilizar o seu carto que termina em $1.", "msWalletNotificationUpdateExpTextV2MissingIssuer": "Atualize o seu carto com terminao em $1 para continuar a utiliz-lo.", "msWalletNotificationUpdatedCardText": "Carto atualizado com xito!", "msWalletNotificationViewDetailLink": "Ver detalhes", "passwordsDescription": "Desfrute da nova experincia de gesto na Carteira.", "passwordsPromotionTitle": "Gerir as suas palavras-passe na Carteira", "personalizedOffersCashBackDescription": "Ganhe $1 de reembolso com a $2.", "personalizedOffersNoThanksText": "No obrigado", "personalizedOffersOfferExpiresInText": "A oferta expira dentro de", "personalizedOffersViewOfferText": "Ver oferta", "rewardsPromotionActionLinkText": "Adicionar nova associa "rewardsPromotionDescription": "Ganhe at 20 pontos Rewards ao adicionar novas associa carteira" "rewardsPromotionTitle": "Adicione associaes para obter Microsoft Rewards" "walletTitle": "Carteira"" (Indicator: ""ver ") in Source: strings.json Observed string: ""activateVirtualCardButtonText": "Activar tarjeta virtual", "featurePromotionActionLinkText": "Probar ahora", "learnMoreLinkTextShort": "Obtener ms informaci "membershipsDescription": "Mantngase organizado y en control." "membershipsPromotionTitle": "Administra tus suscripciones en Cartera" "msWalletNotificationCardExpired": "Su tarjeta ha caducado" "msWalletNotificationCardExpiring": "Su tarjeta expirar pronto" "msWalletNotificationCardTokenizationEligibleDescription": "Las tarjetas virtuales son credenciales de pago de un solo uso que se generan aleatoriamente cada vez que se realiza una compra en lnea. Esto ayuda a garantizar que su tarjeta $1 est protegida." "msWalletNotificationCardTokenizationEligibleHeader": "Proteja los datos de sus tarjetas" "msWalletNotificationCardTokenizationEligibleIntroduction": "Configure una tarjeta virtual para que las compras en lnea sean ms seguras y mmodas." "msWalletNotificationCardTokenizationEligibleIntroductionForRewards": "Configure una tarjeta virtual para que sus compras en lnea sean ms seguras y gane 20 puntos de Microsoft Rewards." "msWalletNotificationCardTokenizationEligibleSetUpText": "Configurar por $1" "msWalletNotificationCardTokenizationEligibleTitle": "Proteger las compras con tarjetas virtuales" "msWalletNotificationCryptowalletJoinButton": "Configurar" "msWalletNotificationCryptowalletSignupDescription": "Explorar Web3 de forma segura con esta cartera que no es custodio" "msWalletNotificationCryptowalletSignupTitle": "Configure su Cartera criptogrfica" "msWalletNotificationDismissLabel": "Descartar" "msWalletNotificationDismissPermanently": "Descartar permanentemente" "msWalletNotificationDismissText": "No volvers a ver esta notificaci "msWalletNotificationDonationSummaryLinkText": "Comprubelo", "msWalletNotificationDonationSummaryTitle": "Ver todo el resumen de la entrega y mucho m "msWalletNotificationFixLeakage": "Ver detalles" "msWalletNotificationHotelReservationBody": "Tu fecha de reserva de $1 del $2 al $3 estxima." "msWalletNotificationHotelReservationTitle": "Prximo alojamiento" "msWalletNotificationHotelReservationViewDetails": "Ver detalles" "msWalletNotificationLeakageBody": "Se han filtrado $1 de sus $2 contraseas." "msWalletNotificationLeakageTitle": "Filtracin de contraseas" "msWalletNotificationOrderStatusTitle": "Estado del pedido actualizado" "msWalletNotificationPOMessage": "Tu oferta seleccionada de Microsoft Cashback de $1 expira en $2" "msWalletNotificationPOTitle": "La oferta expirar pronto" "msWalletNotificationPasswordCompromiseBody": "Microsoft Edge detect que se encontr $1 de tus contraseas en una filtracin en lnea conocida." "msWalletNotificationPasswordCompromiseTitle": "Contrasea en peligro" "msWalletNotificationRebatesCashoutAction": "Transferir a PayPal" "msWalletNotificationRebatesCashoutAmountDescription": "Enhorabuena, tienes $1 en efectivo. Reembolso con PayPal." "msWalletNotificationRebatesCashoutDescription": "Ms informacin sobre el programa de devolucin de efectivo y el reembolso con PayPal." "msWalletNotificationRebatesCashoutTitle": "Es hora de cobrar!" "msWalletNotificationRoamCardAction": "Guardar la tarjeta" "msWalletNotificationRoamCardActionV2": "Guardar tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeader": "Guardar la tarjeta en la cuenta de Microsoft" "msWalletNotificationRoamCardHeaderV2": "Pagar mpido y desde diferentes dispositivos en futuras compras" "msWalletNotificationRoamCardHeaderV3": "Pagar mpido desde cualquier dispositivo" "msWalletNotificationSnoozeLabel": "Posponer" "msWalletNotificationSnoozeText": "Notificacin pospuesta durante 7 das" "msWalletNotificationSnoozeText1": "Notificacin pospuesta durante $1 das" "msWalletNotificationTrackOrderLink": "Seguimiento de pedidos" "msWalletNotificationTrackOrderSubTitle": "La Cartera se ayuda a realizar un seguimiento de su pedido cuando compra en determinados sitios." "msWalletNotificationTrackOrderTitle": "Realizar un seguimiento del pedido" "msWalletNotificationUpdateButton": "Actualizar ahora" "msWalletNotificationUpdateButton1": "Actualizar o quitar tarjeta" "msWalletNotificationUpdateButton2": "Corregir" "msWalletNotificationUpdateCardFailText": "Error al actualizar. Intntalo de nuevo en $1" "msWalletNotificationUpdateExpText": "Edita la informacin de la tarjeta para seguir usando la tarjeta que termina en $1." "msWalletNotificationUpdateExpTextV2MissingIssuer": "Actualice la tarjeta que termina en $1 para seguir usndola." "msWalletNotificationUpdatedCardText": "La tarjeta se actualiz correctamente" "msWalletNotificationViewDetailLink": "Ver detalles" "passwordsDescription": "Probar la nueva experiencia de administracin en Cartera." "passwordsPromotionTitle": "Administrar las contraseas en Cartera" "personalizedOffersCashBackDescription": "Recupera $1 en efectivo con $2." "personalizedOffersNoThanksText": "No, gracias" "personalizedOffersOfferExpiresInText": "La oferta caduca en" "personalizedOffersViewOfferText": "Ver la oferta" "rewardsPromotionActionLinkText": "Agregar nueva suscripci "rewardsPromotionDescription": "Gane hasta 20 puntos de recompensa agregando nuevas suscripciones a la cartera", "rewardsPromotionTitle": "Agrega suscripciones para ganar Microsoft Rewards", "walletTitle": "Cartera"" (Indicator: ""ver ") in Source: strings.json29:T99c,"7ab74.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\\mscoreeis.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00001744)2a:T286c,"7ab74.Trojan.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00001744) "7ab74.Trojan.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001744)2b:T5366,Found reference to API (Indicator: "EncodePointer"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "DecodePointer"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FlsFree"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FlsSetValue"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FlsGetValue"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FlsAlloc"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "MessageBoxA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "Sleep"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "CreateThread"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "lstrlenW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "VirtualProtect"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetProcAddress"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GlobalFindAtomA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FreeConsole"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetLastError"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "HeapFree"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "HeapAlloc"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "RtlUnwind"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "RaiseException"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "TerminateProcess"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetCPInfo"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "LCMapStringA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "LCMapStringW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "HeapCreate"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "VirtualFree"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "ExitProcess"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "WriteFile"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetStdHandle"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "TlsGetValue"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "TlsAlloc"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "TlsSetValue"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "TlsFree"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "SetLastError"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "SetHandleCount"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetFileType"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetTickCount"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "ReadFile"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "SetFilePointer"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "CloseHandle"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "HeapSize"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetACP"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetOEMCP"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "IsValidLocale"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "SetStdHandle"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "CreateFileA"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "7ab74.Trojan.exe") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "PathCombine"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp")2c:T576,Launches browser "msedge.exe" (UID: 00000000-00008160) Launches browser "msedge.exe" (UID: 00000000-00002168) Launches browser "msedge.exe" (UID: 00000000-00003672) Launches browser "msedge.exe" (UID: 00000000-00007576) Launches browser "msedge.exe" (UID: 00000000-00003604) Launches browser "msedge.exe" (UID: 00000000-00005276) Launches browser "msedge.exe" (UID: 00000000-00007596) Launches browser "msedge.exe" (UID: 00000000-00007828) Launches browser "msedge.exe" (UID: 00000000-00001464) Launches browser "msedge.exe" (UID: 00000000-00000188) Launches browser "msedge.exe" (UID: 00000000-00007156) Launches browser "msedge.exe" (UID: 00000000-00007236) Launches browser "msedge.exe" (UID: 00000000-00003252) Launches browser "msedge.exe" (UID: 00000000-00003100) Launches browser "msedge.exe" (UID: 00000000-00006400) Launches browser "msedge.exe" (UID: 00000000-00008136) Launches browser "msedge.exe" (UID: 00000000-00007788) Launches browser "msedge.exe" (UID: 00000000-00002684) Launches browser "msedge.exe" (UID: 00000000-00004764) Launches browser "msedge.exe" (UID: 00000000-00002692) Launches browser "msedge.exe" (UID: 00000000-00002796) Launches browser "msedge.exe" (UID: 00000000-00001656) Launches browser "msedge.exe" (UID: 00000000-00006736) Launches browser "msedge.exe" (UID: 00000000-00007780) Launches browser "msedge.exe" (UID: 00000000-00007756)2d:Td13,"7ab74.Trojan.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76250000 "7ab74.Trojan.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76250000 "7ab74.Trojan.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76250000 "7ab74.Trojan.exe" loaded module "KERNEL32" at base 77720000 "7ab74.Trojan.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73230000 "7ab74.Trojan.exe" loaded module "MSCOREE.DLL" at base 731d0000 "7ab74.Trojan.exe" loaded module "ADVAPI32.DLL" at base 745c0000 "7ab74.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73140000 "7ab74.Trojan.exe" loaded module "SHLWAPI.DLL" at base 74660000 "7ab74.Trojan.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76720000 "7ab74.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MUI\0409\\MSCOREEIS.DLL" at base 0 "7ab74.Trojan.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEIS.DLL" at base 4e70000 "7ab74.Trojan.exe" loaded module "USER32.DLL" at base 77520000 "7ab74.Trojan.exe" loaded module "IMM32.DLL" at base 74720000 "7ab74.Trojan.exe" loaded module "COMCTL32.DLL" at base 730b0000 "7ab74.Trojan.exe" loaded module "USER32" at base 77520000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fc0000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 767a0000 "7ab74.Trojan.exe" loaded module "KERNEL32.DLL" at base 77720000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77220000 "7ab74.Trojan.exe" loaded module "OLEAUT32.DLL" at base 768f0000 "7ab74.Trojan.exe" loaded module "RPCRT4.DLL" at base 747a0000 "7ab74.Trojan.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77520000 "7ab74.Trojan.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77520000 "7ab74.Trojan.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76b00000 "7ab74.Trojan.exe" loaded module "SHELL32.DLL" at base 74f10000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 729b0000 "7ab74.Trojan.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77720000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 73e30000 "7ab74.Trojan.exe" loaded module "COMCTL32.DLL" at base 73750000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 71cb0000 "7ab74.Trojan.exe" loaded module "PROPSYS.DLL" at base 73a90000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a90000 "7ab74.Trojan.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 76b00000 "7ab74.Trojan.exe" loaded module "SECUR32.DLL" at base 71c20000 "7ab74.Trojan.exe" loaded module "SSPICLI.DLL" at base 74540000 "7ab74.Trojan.exe" loaded module "MLANG.DLL" at base 71be0000 "7ab74.Trojan.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 77320000 "7ab74.Trojan.exe" loaded module "WININET.DLL" at base 71910000 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "7ab74.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74860000 "7ab74.Trojan.exe" loaded module "NTDLL.DLL" at base 77b200002e:T507,"7ab74.Trojan.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "7ab74.Trojan.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "7ab74.Trojan.exe" touched "Query file associations" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A07034FD-6CAA-4954-AC3F-97A27216F98A}\INPROCSERVER32") "7ab74.Trojan.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "7ab74.Trojan.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "7ab74.Trojan.exe" touched "File Property Page Extension" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}\INPROCSERVER32") "7ab74.Trojan.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "7ab74.Trojan.exe" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "7ab74.Trojan.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS")2f:Te00,Process "msedge.exe" (UID: 00000000-00008160) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00008160) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002168) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8160_MVBAKZZDZTSELHFU", EDGE_BROWSER_PID="8160"" Process "msedge.exe" (UID: 00000000-00002168) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002168) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00003672) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007576) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00007788) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007788) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007788) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002684) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8160_MVBAKZZDZTSELHFU", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="8160"" Process "msedge.exe" (UID: 00000000-00002684) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002684) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00002692) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002692) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00002796) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00002796) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID"30:Tdf5,Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00008160) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002168), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00003672), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007576), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003604), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005276), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007596), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007828), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00001464), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00000188), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007156), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007236), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00003252), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003100), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00006400), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00008136), Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00007788), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00002684), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00004764), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002692) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002796) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001656) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006736) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007780) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007756)31:Tdf5,Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00008160) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002168), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00003672), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007576), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003604), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00005276), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007596), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007828), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00001464), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00000188), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007156), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007236), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00003252), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003100), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00006400), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00008136), Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00007788), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00002684), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00004764), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002692) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002796) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001656) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006736) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007780) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007756)32:T671,The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB" (SHA1: E5:7C:E0:1F:6A:5E:1D:4C:52:2B:C6:84:88:AF:53:D9:BA:D1:3A:B7; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 0B:C5:E7:67:73:D2:E4:4F:C9:90:3D:4D:FE:FE:45:15:53:BB:EC:4A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: F3:87:22:4D:86:33:82:92:35:A9:94:BC:BD:8F:96:E9:FE:1C:7C:73; see report for more information)33:T416,"msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8160_180635197\manifest.fingerprint" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8160_258774221\manifest.fingerprint" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8160_152381190\manifest.fingerprint" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\ed098abc-6025-4985-8af6-bfe3f4f52b50.tmp" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\13522e90-c0b9-4932-b06e-e7eea060c5e9.tmp" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\f0e0c42a-96f0-46d5-853b-45ad52c13401.tmp" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8160_328122529\crl-set" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8160_328122529\manifest.json" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8160_180635197\adblock_snippet.js" "msedge.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8160_180635197\Filtering Rules"34:Tace8,"wallet-icon.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: 00000000-00001744] "data_3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00008160] "data_2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00008160] "Ruleset Data" has type "data"- [targetUID: 00000000-00008160] "wallet.bundle.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: 00000000-00001744] "wallet-stable.json" has type "ASCII text"- Location: [%TEMP%\8160_979058422\json\wallet\wallet-stable.json]- [targetUID: 00000000-00006484] "wallet-pre-stable.json" has type "ASCII text"- [targetUID: 00000000-00001744] "recovery-component-inner.crx" has type "Google Chrome extension version 3"- Location: [%TEMP%\8160_1552637047\recovery-component-inner.crx]- [targetUID: 00000000-00007780] "edge_driver.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%TEMP%\8160_979058422\edge_driver.js]- [targetUID: 00000000-00006484] "Filtering Rules" has type "data"- Location: [%TEMP%\8160_180635197\Filtering Rules]- [targetUID: 00000000-00006736] "vendor.bundle.js" has type "ASCII text with very long lines"- [targetUID: 00000000-00001744] "d8de9d7292381645_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d8de9d7292381645_0]- [targetUID: 00000000-00008160] "wallet-drawer.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: 00000000-00001744] "d5dcd28b2c992c87_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d5dcd28b2c992c87_0]- [targetUID: 00000000-00008160] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00008160] "f0e0c42a-96f0-46d5-853b-45ad52c13401.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 4363798"- Location: [%TEMP%\f0e0c42a-96f0-46d5-853b-45ad52c13401.tmp]- [targetUID: 00000000-00008160] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00007828] "000009.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00008160] "000013.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00008160] "bnpl.bundle.js" has type "UTF-8 Unicode text with very long lines"- Location: [%TEMP%\8160_979058422\bnpl\bnpl.bundle.js]- [targetUID: 00000000-00006484] "wallet-checkout-eligible-sites-pre-stable.json" has type "ASCII text"- Location: [%TEMP%\8160_979058422\json\wallet\wallet-checkout-eligible-sites-pre-stable.json]- [targetUID: 00000000-00008160] "f_0004c6" has type "gzip compressed data from TOPS/20 original size modulo 2^32 2181905"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00007576] "tokenized-card.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: 00000000-00001744] "f_0004cd" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cd]- [targetUID: 00000000-00007576] "v1FieldTypes.json" has type "JSON data"- Location: [%TEMP%\8160_258774221\v1FieldTypes.json]- [targetUID: 00000000-00008160] "wallet-checkout-eligible-sites.json" has type "ASCII text"- Location: [%TEMP%\8160_979058422\json\wallet\wallet-checkout-eligible-sites.json]- [targetUID: 00000000-00006484] "notification.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: 00000000-00001744] "000014.ldb" has type "data"- [targetUID: 00000000-00001744] "Filtering Rules-AA" has type "data"- Location: [%TEMP%\8160_180635197\Filtering Rules-AA]- [targetUID: 00000000-00006736] "miniwallet.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: 00000000-00001744] "notification_fast.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: 00000000-00001744] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00008160] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00008160] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00008160] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00008160] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00008160] "f_0004c7" has type "gzip compressed data from TOPS/20 original size modulo 2^32 1173007"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007576] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0 dBase III DBT version number 0 next free block index 3238251203"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00008160] "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00008160] "edge_autofill_field_data.json" has type "JSON data"- Location: [%TEMP%\8160_258774221\edge_autofill_field_data.json]- [targetUID: 00000000-00008160] "History" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00001744] "Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00008160] "Visited Links" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00008160] "4e4b4d9fb24820c3_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4e4b4d9fb24820c3_0]- [targetUID: 00000000-00008160] "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00008160] "Tabs_13342524257868750" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13342524257868750]- [targetUID: 00000000-00008160] "f_0004cb" has type "PNG image data 1300 x 300 8-bit colormap non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cb]- [targetUID: 00000000-00007576] "e1a37bd4-e91c-4216-9e67-ad955a62bceb.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\e1a37bd4-e91c-4216-9e67-ad955a62bceb.tmp]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\el\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\ru\strings.json]- [targetUID: 00000000-00006484] "ef2eb63e-37d2-4dbf-b936-37def47d7c1d.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ef2eb63e-37d2-4dbf-b936-37def47d7c1d.tmp]- [targetUID: 00000000-00008160] "data.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\8160_1560353706\data.txt]- [targetUID: 00000000-00008160] "Diagnostic Data-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Diagnostic Data-wal]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\ar\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\ja\strings.json]- [targetUID: 00000000-00006484] "f_0004c3" has type "gzip compressed data from TOPS/20 original size modulo 2^32 451164"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00007576] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\fr-CA\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\fr\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\de\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\pt-PT\strings.json]- [targetUID: 00000000-00006484] "f_0004c5" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00007576] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\es\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\it\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\pt-BR\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\nl\strings.json]- [targetUID: 00000000-00006484] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00008160] "ee3591d8-902a-45b4-962a-27c6e1394b71.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ee3591d8-902a-45b4-962a-27c6e1394b71.tmp]- [targetUID: 00000000-00008160] "65b39f35-ab9b-45db-80fa-dafbe1e9a65e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\65b39f35-ab9b-45db-80fa-dafbe1e9a65e.tmp]- [targetUID: 00000000-00008160] "8491b6d5-eb61-4e9f-bcca-670fafa723f8.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8491b6d5-eb61-4e9f-bcca-670fafa723f8.tmp]- [targetUID: 00000000-00008160] "53bd812d-0c50-4a04-9dac-ff118493a86b.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\53bd812d-0c50-4a04-9dac-ff118493a86b.tmp]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\fi\strings.json]- [targetUID: 00000000-00006484] "6b593cc2-9d85-4e09-8b82-06cecc9cc53c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\6b593cc2-9d85-4e09-8b82-06cecc9cc53c.tmp]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\sv\strings.json]- [targetUID: 00000000-00006484] "00534e52-3fde-432b-bd84-9e8860316f09.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\00534e52-3fde-432b-bd84-9e8860316f09.tmp]- [targetUID: 00000000-00008160] "523585a6-d5cb-46f9-b80f-9043bcbdbf0e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\523585a6-d5cb-46f9-b80f-9043bcbdbf0e.tmp]- [targetUID: 00000000-00008160] "4bbd21db-3d14-442b-bec9-fc3574cacc7e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4bbd21db-3d14-442b-bec9-fc3574cacc7e.tmp]- [targetUID: 00000000-00008160] "b7bf297e-55c9-4f9f-be42-381b07e6b410.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b7bf297e-55c9-4f9f-be42-381b07e6b410.tmp]- [targetUID: 00000000-00008160] "8d37556c-e122-4ed7-ba20-e25d653803ea.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8d37556c-e122-4ed7-ba20-e25d653803ea.tmp]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\id\strings.json]- [targetUID: 00000000-00006484] "History-journal" has type "SQLite Rollback Journal"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History-journal]- [targetUID: 00000000-00008160] "Network Action Predictor" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network Action Predictor]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\en-GB\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\zh-Hant\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-hub\zh-Hans\strings.json]- [targetUID: 00000000-00006484] "HubApps Icons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\HubApps Icons]- [targetUID: 00000000-00008160] "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_7ab74.T" has type "HTML document ASCII text with very long lines with CRLF LF line terminators"- [targetUID: 00000000-00001744] "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00007576] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00008160] "Favicons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons]- [targetUID: 00000000-00008160] "checkoutdata.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\wallet\wallet-checkout\checkoutdata.json]- [targetUID: 00000000-00006484] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00007576] "f_0004c8" has type "PNG image data 475 x 212 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00007576] "f_0004c4" has type "gzip compressed data from NTFS filesystem (NT) original size modulo 2^32 106026"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00007576] "4646250df6550668_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4646250df6550668_0]- [targetUID: 00000000-00008160] "Favicons-journal" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons-journal]- [targetUID: 00000000-00008160] "shopping_iframe_driver.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: 00000000-00001744] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00007828] "53078e67-acd3-46ba-96e8-5586699b6990.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\53078e67-acd3-46ba-96e8-5586699b6990.tmp]- [targetUID: 00000000-00008160] "LICENSE" has type "ASCII text with CRLF line terminators"- [targetUID: 00000000-00006736] "wallet-tokenization-config.json" has type "ASCII text"- Location: [%TEMP%\8160_979058422\json\wallet\wallet-tokenization-config.json]- [targetUID: 00000000-00006484] "455849d8-44c6-434c-a1e1-f0038e1cb7dc.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\455849d8-44c6-434c-a1e1-f0038e1cb7dc.tmp]- [targetUID: 00000000-00008160] "dbbe9ca7-f55d-466d-b02f-fd9051d5b66f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\dbbe9ca7-f55d-466d-b02f-fd9051d5b66f.tmp]- [targetUID: 00000000-00008160] "f0735688-16af-43a8-9c14-f44bf0645ce8.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f0735688-16af-43a8-9c14-f44bf0645ce8.tmp]- [targetUID: 00000000-00008160] "3db1fa62-907d-45c2-9239-60c1b36e6430.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3db1fa62-907d-45c2-9239-60c1b36e6430.tmp]- [targetUID: 00000000-00008160] "0c821904-0abf-4e41-b99c-629da90a2ffc.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\0c821904-0abf-4e41-b99c-629da90a2ffc.tmp]- [targetUID: 00000000-00008160] "3b798bdd-47fb-4edb-a65e-e189e00c617f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3b798bdd-47fb-4edb-a65e-e189e00c617f.tmp]- [targetUID: 00000000-00008160] "982f29f1-5ad4-46bc-8743-f6cfa98b7686.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\982f29f1-5ad4-46bc-8743-f6cfa98b7686.tmp]- [targetUID: 00000000-00008160] "crl-set" has type "data"- Location: [%TEMP%\8160_328122529\crl-set]- [targetUID: 00000000-00001656] "super_coupon.json" has type "JSON data"- [targetUID: 00000000-00001744] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\ru\strings.json]- [targetUID: 00000000-00006484] "Shortcuts" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Shortcuts]- [targetUID: 00000000-00008160] "f_0004c9" has type "PNG image data 533 x 478 8-bit/color RGBA non-interlaced"- [targetUID: 00000000-00001744] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\ar\strings.json]- [targetUID: 00000000-00006484] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00008160] "f_0004ca" has type "Web Open Font Format (Version 2) TrueType length 17956 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ca]- [targetUID: 00000000-00007576] "f_0004cc" has type "MS Windows icon resource - 6 icons 128x128 16 colors 72x72 16 colors"- [targetUID: 00000000-00001744] "Cookies-journal" has type "SQLite Rollback Journal"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies-journal]- [targetUID: 00000000-00007576] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\ja\strings.json]- [targetUID: 00000000-00006484] "load-ec-i18n.bundle.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: 00000000-00001744] "driver-signature.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\8160_979058422\driver-signature.txt]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\fr-CA\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\fr\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\ru\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\de\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\pt-PT\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\it\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\es\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\nl\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\pt-BR\strings.json]- [targetUID: 00000000-00006484] "WebAssistDatabase" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\WebAssistDatabase]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\sv\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\id\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\ar\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- [targetUID: 00000000-00006484] "Session_13342524257422761" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Session_13342524257422761]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\zh-Hant\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\en-GB\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\ja\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-ec\zh-Hans\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-shared-components\ru\strings.json]- [targetUID: 00000000-00006484] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\fr-CA\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\fr\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\de\strings.json]- [targetUID: 00000000-00006484] "bnpl_driver.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\8160_979058422\bnpl_driver.js]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\pt-PT\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\es\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\nl\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\it\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\id\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\sv\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\pt-BR\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\zh-Hant\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\en-GB\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-mobile-hub\zh-Hans\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-shared-components\fr-CA\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-shared-components\fr\strings.json]- [targetUID: 00000000-00006484] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log]- [targetUID: 00000000-00007828] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-shared-components\nl\strings.json]- [targetUID: 00000000-00006484] "data_2" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2]- [targetUID: 00000000-00008160] "data_3" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3]- [targetUID: 00000000-00008160] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0 dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\el\strings.json]- [targetUID: 00000000-00006484] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log]- [targetUID: 00000000-00008160] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\ar\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\ja\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\fr-CA\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\fr\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\de\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\pt-PT\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\es\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\it\strings.json]- [targetUID: 00000000-00006484] "fffa4e77-7fb7-4e43-a7a7-94a6c3b96dcc.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\fffa4e77-7fb7-4e43-a7a7-94a6c3b96dcc.tmp]- [targetUID: 00000000-00007576] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\nl\strings.json]- [targetUID: 00000000-00006484] "954c0f31-2dc0-4f93-9fb9-822489e1d304.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\954c0f31-2dc0-4f93-9fb9-822489e1d304.tmp]- [targetUID: 00000000-00007576] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\pt-BR\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\id\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\fi\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-notification-shared\en-GB\strings.json]- [targetUID: 00000000-00006484] "notification.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\8160_979058422\Notification\notification.html]- [targetUID: 00000000-00008160] "edge_autofill_global_block_list.json" has type "JSON data"- Location: [%TEMP%\8160_258774221\edge_autofill_global_block_list.json]- [targetUID: 00000000-00008160] "deny_full_domains.list" has type "data"- Location: [%TEMP%\8160_588493226\deny_full_domains.list]- [targetUID: 00000000-00008160] "13522e90-c0b9-4932-b06e-e7eea060c5e9.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260"- Location: [%TEMP%\13522e90-c0b9-4932-b06e-e7eea060c5e9.tmp]- [targetUID: 00000000-00008160] "nav_config.json" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\8160_152381190\nav_config.json]- [targetUID: 00000000-00008160] "dd6b3ba9-3996-4eea-980b-757c6e19222d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\dd6b3ba9-3996-4eea-980b-757c6e19222d.tmp]- [targetUID: 00000000-00007576] "ecbb6099-e1e6-4b72-b496-05e73422fecf.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\ecbb6099-e1e6-4b72-b496-05e73422fecf.tmp]- [targetUID: 00000000-00007576] "0d7fd3c8-be06-4862-ac00-c7760c100903.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\0d7fd3c8-be06-4862-ac00-c7760c100903.tmp]- [targetUID: 00000000-00007576] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-tokenized-card\ar\strings.json]- [targetUID: 00000000-00006484] "vendor.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\8160_979058422\vendor.bundle.js.LICENSE.txt]- [targetUID: 00000000-00006484] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00008160] "adblock_snippet.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\8160_180635197\adblock_snippet.js]- [targetUID: 00000000-00006736] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-tokenized-card\es\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-tokenized-card\it\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-tokenized-card\pt-BR\strings.json]- [targetUID: 00000000-00006484] "runtime.bundle.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: 00000000-00001744] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-tokenized-card\nl\strings.json]- [targetUID: 00000000-00006484] "wallet-crypto.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00001744] "wallet.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00001744] "strings.json" has type "JSON data"- Location: [%TEMP%\8160_979058422\json\i18n-tokenized-card\zh-Hant\strings.json]- [targetUID: 00000000-00006484] "wallet-drawer.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00001744] "daffaa069977dcc2_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\daffaa069977dcc2_0]- [targetUID: 00000000-00008160] "wallet-drawer.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\8160_979058422\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt]- [targetUID: 00000000-00006484] "bnpl.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\8160_979058422\bnpl\bnpl.bundle.js.LICENSE.txt]- [targetUID: 00000000-00006484] "mini-wallet.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00001744] "notification_fast.html" has type "HTML document ASCII text with very long lines"- [targetUID: 00000000-00001744] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00007828] "tokenized-card.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\8160_979058422\Tokenized-Card\tokenized-card.html]- [targetUID: 00000000-00006484] "bnpl.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\8160_979058422\bnpl\bnpl.html]- [targetUID: 00000000-00006484] "load-hub-i18n.bundle.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: 00000000-00001744] "tokenized-card.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: 00000000-00001744] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00007828] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\000003.log]- [targetUID: 00000000-00007828] "hub-signature.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\8160_979058422\hub-signature.txt]- [targetUID: 00000000-00006484] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00007828] "wallet_donation_driver.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: 00000000-00001744] "wallet-notification-config.json" has type "ASCII text"- [targetUID: 00000000-00001744] "buynow_driver.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\8160_979058422\buynow_driver.js]- [targetUID: 00000000-00006484] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG]- [targetUID: 00000000-00007828] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001]- [targetUID: 00000000-00008160] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG]- [targetUID: 00000000-00007828] "deny_etld1_domains.list" has type "data"- Location: [%TEMP%\8160_588493226\deny_etld1_domains.list]- [targetUID: 00000000-00008160] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG]- [targetUID: 00000000-00007828] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00007828] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00007828] "manifest.webapp.json" has type "UTF-8 Unicode (with BOM) text"- [targetUID: 00000000-00001744] "121e617942ab5fec_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\121e617942ab5fec_0]- [targetUID: 00000000-00008160] "miniwallet.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\8160_979058422\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt]- [targetUID: 00000000-00008160] "48b0b4a3c03af1e9_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\48b0b4a3c03af1e9_0]- [targetUID: 00000000-00008160] "9c1e175bdb6cd9ef_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9c1e175bdb6cd9ef_0]- [targetUID: 00000000-00008160] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00008160] "8f3c2e2c260a7099_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8f3c2e2c260a7099_0]- [targetUID: 00000000-00008160] "59a0dffc442ad043_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\59a0dffc442ad043_0]- [targetUID: 00000000-00008160] "app-setup.js" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_979058422\app-setup.js]- [targetUID: 00000000-00006484] "regex_patterns.json" has type "JSON data"- Location: [%TEMP%\8160_258774221\regex_patterns.json]- [targetUID: 00000000-00008160] "manifest.json" has type "JSON data"- Location: [%TEMP%\8160_588493226\manifest.json]- [targetUID: 00000000-00001656] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\8160_152381190\manifest.json]- [targetUID: 00000000-00001656] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\8160_1552637047\manifest.json]- [targetUID: 00000000-00001656] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: 00000000-00001656] "crypto.bundle.js" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_979058422\crypto.bundle.js]- [targetUID: 00000000-00006484] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00008160] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\8160_258774221\manifest.json]- [targetUID: 00000000-00001656] "manifest.json" has type "JSON data"- Location: [%TEMP%\8160_180635197\manifest.json]- [targetUID: 00000000-00001656] "manifest.json" has type "JSON data"- Location: [%TEMP%\8160_328122529\manifest.json]- [targetUID: 00000000-00001656] "52d93f14-0dfb-4cdc-86ae-b08eb058ea30.tmp" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\52d93f14-0dfb-4cdc-86ae-b08eb058ea30.tmp]- [targetUID: 00000000-00007576] "README.md" has type "ASCII text"- Location: [%TEMP%\8160_979058422\json\wallet\README.md]- [targetUID: 00000000-00008160] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00008160] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log]- [targetUID: 00000000-00007828] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_258774221\manifest.fingerprint]- [targetUID: 00000000-00008160] "manifest.fingerprint" has type "ASCII text with no line terminators"- [targetUID: 00000000-00008160] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_180635197\manifest.fingerprint]- [targetUID: 00000000-00008160] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_152381190\manifest.fingerprint]- [targetUID: 00000000-00008160] "000012.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000012.log]- [targetUID: 00000000-00008160] ".ses" has type "ASCII text with CRLF line terminators"- [targetUID: 00000000-00001744] "manifest.json" has type "JSON data"- Location: [%TEMP%\8160_1560353706\manifest.json]- [targetUID: 00000000-00001656] "app-setup.js" has type "ASCII text with no line terminators"- [targetUID: 00000000-00006484] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00008160] "deny_domains.list" has type "data"- Location: [%TEMP%\8160_588493226\deny_domains.list]- [targetUID: 00000000-00008160] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_979058422\json\i18n-notification\zh-Hant\strings.json]- [targetUID: 00000000-00006484] "16de73f9-48ff-410a-839b-4953c38c98a0.tmp" has type "very short file (no magic)"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\16de73f9-48ff-410a-839b-4953c38c98a0.tmp]- [targetUID: 00000000-00008160] "ed098abc-6025-4985-8af6-bfe3f4f52b50.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 4363798"- Location: [%TEMP%\ed098abc-6025-4985-8af6-bfe3f4f52b50.tmp]- [targetUID: 00000000-00008160] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1]- [targetUID: 00000000-00008160] "LICENSE" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\8160_180635197\LICENSE]- [targetUID: 00000000-00006736] "notification.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: 00000000-00001744] "notification_fast.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: 00000000-00001744] "strings.json" has type "ASCII text with no line terminators"- [targetUID: 00000000-00006484] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_979058422\json\i18n-notification\de\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_979058422\json\i18n-notification\ar\strings.json]- [targetUID: 00000000-00006484] "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\8160_979058422\json\i18n-notification\sv\strings.json]- [targetUID: 00000000-00006484]35:T145d,"f0e0c42a-96f0-46d5-853b-45ad52c13401.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 4363798" - Location: [%TEMP%\f0e0c42a-96f0-46d5-853b-45ad52c13401.tmp] "e1a37bd4-e91c-4216-9e67-ad955a62bceb.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\e1a37bd4-e91c-4216-9e67-ad955a62bceb.tmp] "ef2eb63e-37d2-4dbf-b936-37def47d7c1d.tmp" has type "JSON data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ef2eb63e-37d2-4dbf-b936-37def47d7c1d.tmp] "ee3591d8-902a-45b4-962a-27c6e1394b71.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ee3591d8-902a-45b4-962a-27c6e1394b71.tmp] "65b39f35-ab9b-45db-80fa-dafbe1e9a65e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\65b39f35-ab9b-45db-80fa-dafbe1e9a65e.tmp] "8491b6d5-eb61-4e9f-bcca-670fafa723f8.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8491b6d5-eb61-4e9f-bcca-670fafa723f8.tmp] "53bd812d-0c50-4a04-9dac-ff118493a86b.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\53bd812d-0c50-4a04-9dac-ff118493a86b.tmp] "6b593cc2-9d85-4e09-8b82-06cecc9cc53c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\6b593cc2-9d85-4e09-8b82-06cecc9cc53c.tmp] "00534e52-3fde-432b-bd84-9e8860316f09.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\00534e52-3fde-432b-bd84-9e8860316f09.tmp] "523585a6-d5cb-46f9-b80f-9043bcbdbf0e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\523585a6-d5cb-46f9-b80f-9043bcbdbf0e.tmp] "4bbd21db-3d14-442b-bec9-fc3574cacc7e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4bbd21db-3d14-442b-bec9-fc3574cacc7e.tmp] "b7bf297e-55c9-4f9f-be42-381b07e6b410.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b7bf297e-55c9-4f9f-be42-381b07e6b410.tmp] "8d37556c-e122-4ed7-ba20-e25d653803ea.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8d37556c-e122-4ed7-ba20-e25d653803ea.tmp] "53078e67-acd3-46ba-96e8-5586699b6990.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\53078e67-acd3-46ba-96e8-5586699b6990.tmp] "455849d8-44c6-434c-a1e1-f0038e1cb7dc.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\455849d8-44c6-434c-a1e1-f0038e1cb7dc.tmp] "dbbe9ca7-f55d-466d-b02f-fd9051d5b66f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\dbbe9ca7-f55d-466d-b02f-fd9051d5b66f.tmp] "f0735688-16af-43a8-9c14-f44bf0645ce8.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f0735688-16af-43a8-9c14-f44bf0645ce8.tmp] "3db1fa62-907d-45c2-9239-60c1b36e6430.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3db1fa62-907d-45c2-9239-60c1b36e6430.tmp] "0c821904-0abf-4e41-b99c-629da90a2ffc.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\0c821904-0abf-4e41-b99c-629da90a2ffc.tmp] "3b798bdd-47fb-4edb-a65e-e189e00c617f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3b798bdd-47fb-4edb-a65e-e189e00c617f.tmp] "982f29f1-5ad4-46bc-8743-f6cfa98b7686.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\982f29f1-5ad4-46bc-8743-f6cfa98b7686.tmp] "fffa4e77-7fb7-4e43-a7a7-94a6c3b96dcc.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\fffa4e77-7fb7-4e43-a7a7-94a6c3b96dcc.tmp] "954c0f31-2dc0-4f93-9fb9-822489e1d304.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\954c0f31-2dc0-4f93-9fb9-822489e1d304.tmp] "13522e90-c0b9-4932-b06e-e7eea060c5e9.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260" - Location: [%TEMP%\13522e90-c0b9-4932-b06e-e7eea060c5e9.tmp] "dd6b3ba9-3996-4eea-980b-757c6e19222d.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\dd6b3ba9-3996-4eea-980b-757c6e19222d.tmp]36:T507,"7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "7ab74.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "")37:Tebd,"7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "7ab74.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "")38:T870,"7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\MSCOREE.DLL" "7ab74.Trojan.exe" trying to access non-existent file "C:\mscoree.dll" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\MUI\0409\MSCOREEIS.DLL" "7ab74.Trojan.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MUI\0409\mscoreeis.dll" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "7ab74.Trojan.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\PROPSYS.DLL" "7ab74.Trojan.exe" trying to access non-existent file "C:\PROPSYS.dll" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\URLMON.DLL" "7ab74.Trojan.exe" trying to access non-existent file "C:\urlmon.dll" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\IERTUTIL.DLL" "7ab74.Trojan.exe" trying to access non-existent file "C:\iertutil.dll" "7ab74.Trojan.exe" trying to access non-existent file "\Device\HarddiskVolume2\EDPUTIL.DLL" "7ab74.Trojan.exe" trying to access non-existent file "C:\edputil.dll"39:T8c7,Observed string: ""curlbible.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlcandi.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldaze.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldefinition.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlflip.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfriendcollective.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfrodisiac.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlkalon.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlmix.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curls.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsandpotions.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsdynasty.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsmith.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsnolye.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsofcolor.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsponge.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curltastic.co"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyair.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlycupcakes.ca"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlboutique.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlzcandy.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyheaven.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlykisses.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshayco.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshiny.com"," (Indicator: ""curl") in Source: wallet-stable.json3a:T6e2,Observed email domain:""colourpop.com"," [Source: wallet-stable.json] Observed email domain:""aepop.net"," [Source: wallet-stable.json] Observed email domain:""artpop.com"," [Source: wallet-stable.json] Observed email domain:""avenuepop.com"," [Source: wallet-stable.json] Observed email domain:""bassettbmx.com"," [Source: wallet-stable.json] Observed email domain:""canvasmx.com"," [Source: wallet-stable.json] Observed email domain:""drinkolipop.com"," [Source: wallet-stable.json] Observed email domain:""fashionfunpop.com"," [Source: wallet-stable.json] Observed email domain:""fastandloosebmx.com"," [Source: wallet-stable.json] Observed email domain:""flitebmx.com"," [Source: wallet-stable.json] Observed email domain:""fofopop.com"," [Source: wallet-stable.json] Observed email domain:""gellipop.com"," [Source: wallet-stable.json] Observed email domain:""gforcemx.com"," [Source: wallet-stable.json] Observed email domain:""happipop.com"," [Source: wallet-stable.json] Observed email domain:""hauzofpop.com"," [Source: wallet-stable.json] Observed email domain:""hiccapop.com"," [Source: wallet-stable.json] Observed email domain:""hijabipop.com"," [Source: wallet-stable.json] Observed email domain:""jellypop.la"," [Source: wallet-stable.json] Observed email domain:""kinkbmx.com"," [Source: wallet-stable.json] Observed email domain:""kloudkpop.com"," [Source: wallet-stable.json] Observed email domain:""knitpop.com"," [Source: wallet-stable.json] Observed email domain:""kpop.exchange"," [Source: wallet-stable.json] Observed email domain:""laperlamx.com"," [Source: wallet-stable.json] Observed email domain:""lovepop.com"," [Source: wallet-stable.json] Observed email domain:""lullipop.com"," [Source: wallet-stable.json]3b:T1c9f,Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7ab74.Trojan.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0" Pattern match: "https://sectigo.com/CPS0" Pattern match: "crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y" Pattern match: "crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#" Pattern match: "http://ocsp.sectigo.com0*" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl04" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0" Pattern match: "http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl0" Pattern match: "crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digicert.com0X" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170Latest" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "learn.microsoft.com/static/third-party/adobe-target/at-js/2.9.0/at.js\L`*QcfCassignQb:getOwnPropertyNamesfromCharCode0123456789" Pattern match: "https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531edge://settings/profileskeygjgieestate_{edge://settingsedge://settings/edge://settings/?search=smartkeygr10nmstate_{edge://settingsedge://settings/?search=smartedge" Pattern match: "https://ntp.www.office.com&_https://ntp.msn.comCookieSyncExpiry'_https://ntp.msn.comDefaultFeedPolicy_https://ntp.msn.comGpuExist/_https://ntp.msn.comNOTIFICATION_CACHE_LS_KEY_https://ntp.msn.combkgdV+_https://ntp.msn.combreakingNewsDismissed" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redisthttps://www.bing.com/ck/a?!&&p=dda47b155ec1706bJmltdHM9MTY3ODQwNjQwMCZpZ3VpZD0xYmQzZjhjNS1lMTdlLTZ" Pattern match: "edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_etree_light.png/1.1.9/asset96defd79-4015-4a32-bd09-794ff72183efhttps://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_games_light.png/1.4.5/asset2caf0cf4-ea42-4083-b928-29b39da1182bht" Pattern match: "www.clarity.msCLIDv10" Pattern match: "https://learn.microsoft.com/favicon.ico$Mhttps://www.bing.com/favicon.icohttps://assets.msn.com/statics/icons/favicon_newtabpage.pnghttps://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&proces" Pattern match: "identity.nel.measure.office.net/api/report?catId=GW+estsfd+estc#" Pattern match: "wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.jswindowLL`calltoStringTag__esModulehasOwnPropertyQb^" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redisthttps://www.bing.com/ck/a?!&&p=dda47b155ec1706bJmltdHM9MTY3ODQwNjQwMCZpZ3VpZD0xYmQzZjhjNS1lMTdlLTZkNzctMWUxYi1lYWE2ZTU3ZTYzMzUmaW5zaWQ9NTE4Ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-" Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-A" Pattern match: "https://chrome.google.com/webstore},urls:[https://chrome.google.com/webstore]},description:Discover" Pattern match: "https://github.com/easylist" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://www.coupert.com" Pattern match: "https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7ab74.Trojan.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0Fix" Pattern match: "learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7ab74.Trojan.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0https://learn.microsoft.comhttp://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=App" Pattern match: "http://www.w3.org/2000/svg,svg" Pattern match: "https://ntp.msn.com/REG:https://ntp.msn.com/https://ntp.msn.com/edge/ntp.https://ntp.msn.com/edge/ntp/service-worker.js" Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "autofill.account.microsoft.com/,type" Pattern match: "www.microsoft365.com" Pattern match: "jedwatson.github.io/classnames" Pattern match: "learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/global/67a45209.deprecation.js" Pattern match: "https://github.com/focus-trap/tabbable/blob/master/LICENSE" Pattern match: "https://github.com/jsstyles/css-vendor" Pattern match: "assets.db/MANIFEST-0000012023/10/23-01:44:20.816" Pattern match: "learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/4d703278.index-docs.js" Pattern match: "learn.microsoft.com/static/third-party/adobe-target/at-js/2.9.0/at.js" Pattern match: "learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js" Pattern match: "wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js" Pattern match: "js.monitor.azure.com/scripts/c/ms.jsll-3.min.js" Heuristic match: "microsoftmscompoc.tt.omtrdc.net" Heuristic match: "mscom.demdex.net" Pattern match: "www.klarna.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.transunion.com" Pattern match: "www.googletagmanager.com" Pattern match: "www.facebook.com" Pattern match: "www.googleadservices.com" Pattern match: "http://www.w3.org/2000/svg};class" Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4" Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7" Pattern match: "http://www.w3.org/2001/XMLSchema-instance"3c:T4af,GET /fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7ab74.Trojan.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1Host: go.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "5.0.0" Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 Cookie: _clck=1uiiig1|1|f6r|0; MUID=1BD3F8C5E17E6D771E1BEAA6E57E6335; MC1=GUID=99db494f794a4c21af6255a5bf556203&HASH=99db&LV=202303&V=4&LU=1678459558597; MSCC=NR; at_check=true; mbox=session#9a18e917b90145c7b852556a5d7ff0d2#1698052522|PC#9a18e917b90145c7b852556a5d7ff0d2.35_0#1732230662; MS0=592e919ec7f0410a9503c994445472f43d:T9cc,"7ab74.Trojan.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001744) "7ab74.Trojan.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001744)3e:T92d,Found string "ymvmvtuciybxaeylgxicpuzquxgukdamxetahbfdhsmpgwfcgeufaevfnwshlfkcsatntkzpnwbxrxfodaeswomixvwsosdb" (Indicator: "aes"; File: "7ab74.Trojan.exe") file/memory contains long string with (Indicator: "base64"; File: "Web Data") file/memory contains long string with (Indicator: "aes"; File: "4646250df6550668_0") file/memory contains long string with (Indicator: "aes"; File: "wallet-tokenization-config.json") file/memory contains long string with (Indicator: "aes"; File: "driver-signature.txt") file/memory contains long string with (Indicator: "aes"; File: "strings.json") file/memory contains long string with (Indicator: "aes"; File: "fffa4e77-7fb7-4e43-a7a7-94a6c3b96dcc.tmp") file/memory contains long string with (Indicator: "aes"; File: "954c0f31-2dc0-4f93-9fb9-822489e1d304.tmp") Found string "{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}" (Indicator: "aes"; File: "52d93f14-0dfb-4cdc-86ae-b08eb058ea30.tmp") Found string ""403designs.com"," (Indicator: "3des"; File: "wallet-stable.json") Found string ""8bitaesthetics.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""acceleratedaesthetics.shop"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesajewelry.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesbowco.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aeshaafricanbaskets.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aeshascloset.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesop.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesoprock.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestacia.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestelance.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestherapy.co"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestheticafcandles.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestheticautosolutions.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aesthetic-byniesha.com"," (Indicator: "aes"; File: "wallet-stable.json") Found string ""aestheticcosplay.com"," (Indicator: "aes"; File: "wallet-stable.json")3f:T60e,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001744.00000000.66989.03410000.00000004.mdmp")40:T7e2,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "7ab74.Trojan.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "7ab74.Trojan.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "7ab74.Trojan.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "7ab74.Trojan.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "7ab74.Trojan.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "7ab74.Trojan.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001744.00000000.66989.0041F000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp")41:T97c,Found string ""MEANINGFUL_NAME": { "en": [ { "positive_pattern": "^(((field|input)(_|-)?\\d+)|.*captcha.*|(security|access).*code|one.*time.*password)$|(_|-|^)+otp+(_|-)?" } ]" (Indicator: "password"; File: "regex_patterns.json") Found string ""victoriassecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""airmidbeautysecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""amirasecretscosmedic.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""aphroditessecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""beautysecretscosmetics.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""beautysecretsusa.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""bellessecrets.org"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""bestkeptsecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""chicsecretsjewelry.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""cinemasecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""daintysecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""danassecretcloset.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""dbeautysecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""desirablesecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""dirtysecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""eastafricansecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""fantasyandsecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""godivassecretwigs.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""herhiddensecrets.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""herlittlesecretcollection.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""honeysnailsecret.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""humboldtssecretsupplies.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""kinkysecretsbeauty.com"," (Indicator: "secret"; File: "wallet-stable.json") Found string ""kouturesecrets.com"," (Indicator: "secret"; File: "wallet-stable.json")42:T75b,""4amscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""6whiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""99centsubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""allieandmickey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""alteregoscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""annabelbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""aspirefashionscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""augustbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""bananasmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""baseballmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautiiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautyandwhiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bellagracehealthscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""belleandbubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""beyondblessedscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""blingbykey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""boosted-luckey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bowlingmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""burgeonbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""busybeescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cabbagekey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""coatsandscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""codenxtscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cognitiontsscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""concreterosescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com")43:Tea9,Dropped file: "data_3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00008160] Dropped file: "data_2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00008160] Dropped file: "d8de9d7292381645_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d8de9d7292381645_0]- [targetUID: 00000000-00008160] Dropped file: "d5dcd28b2c992c87_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d5dcd28b2c992c87_0]- [targetUID: 00000000-00008160] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00008160] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00007828] Dropped file: "000009.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00008160] Dropped file: "000013.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00008160] Dropped file: "f_0004c6" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00007576] Dropped file: "f_0004cd" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cd]- [targetUID: 00000000-00007576] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00008160] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00008160] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00008160] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00008160] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00008160] Dropped file: "f_0004c7" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00007576] Dropped file: "index" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00008160] Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00008160] Dropped file: "History" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00001744] Dropped file: "Web Data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00008160] Dropped file: "Visited Links" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00008160] Dropped file: "4e4b4d9fb24820c3_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4e4b4d9fb24820c3_0]- [targetUID: 00000000-00008160] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00008160] Dropped file: "Tabs_13342524257868750" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13342524257868750]- [targetUID: 00000000-00008160] Dropped file: "f_0004cb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cb]- [targetUID: 00000000-00007576]44:T40e,"7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-40612462 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-40613511 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-47844181 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-47845532 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-48275543 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-48276959 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-48535762 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-48537165 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-48681582 [PID: 1744] "7ab74.Trojan.exe" queried SystemProcessInformation at 00000000-00001744-00000C13-48683008 [PID: 1744]45:T7c6,"7ab74.Trojan.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F1\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "7ab74.Trojan.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "0000") "7ab74.Trojan.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "7ab74.Trojan.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "7ab74.Trojan.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "34EE1B1F8D05DA0100000000000000000000000002000000"), "7ab74.Trojan.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC4C75"; Value: "5C000000000000000400000001010100B1CE9800020078007E0007809E1124006400640063EE1D0000009A11240064000E3F1A0064000000530000006F6E65636F72657561705C7368656C6C5C77696E646F77732E73746F726167655C657865636173736F632E6370700037616237342E54726F6A616E2E6578650077696E646F77732E73746F726167652E646C6C00"), "7ab74.Trojan.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "90180000000000000400040001000100010100007E3391002400020000000D78790016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A007477AD0075A37E007814B00078EF6400799C39007E3391008106950087DE83008E78A200938661009D9D9200A736A800B1CE9800B3F1A200C36D8100CC495600CF74AA00D3826100D3E88D00E1C97700E21B5600E7997F00F1FC6000F7125E00F7D36F00F7ED6A0007000600000019C398001C4452007140A30091508A009D9FA000A522A400DC38AB000100400100007E339100")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790422649096,"unified_at":"2026-09-26T11:37:29.096Z","metadata":{"hashes":{"sha256":"7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5","sha1":"5bcb143ae8aed98749c96f43eb82384a8d01cd1e","md5":"ecddd46e6263f71c7ad5526e67a6e014","sha512":"51e507fa1395652d38ad6d24f8faca6b544e021008ceaa131889e353f3bec57dc4c980b6502d2562f314e8cc4f0fc21dd09a08334b96d657b7edac408e4f4d53","ssdeep":"12288:f808MwoQB2o97Hr62k3n/+pLsv9+eXUeF6e1L:QMwoQkAr62k3n/+pAv+enL","ssdeep_chunks":["12288:f808Mwo","12288:808MwoQ","12288:08MwoQB","12288:8MwoQB2","12288:MwoQB2o","12288:woQB2o9","12288:oQB2o97","12288:QB2o97H","12288:B2o97Hr","12288:2o97Hr6","12288:o97Hr62","12288:97Hr62k","12288:7Hr62k3","12288:Hr62k3n","12288:r62k3n/","12288:62k3n/+","12288:2k3n/+p","12288:k3n/+pL","12288:3n/+pLs","12288:n/+pLsv","12288:/+pLsv9","12288:+pLsv9+","12288:pLsv9+e","12288:Lsv9+eX","12288:sv9+eXU","12288:v9+eXUe","12288:9+eXUeF","12288:+eXUeF6","12288:eXUeF6e","12288:XUeF6e1","12288:UeF6e1L","24576:f808Mwo","24576:808MwoQ","24576:08MwoQB","24576:8MwoQB2","24576:MwoQB2o","24576:woQB2o9","24576:oQB2o97","24576:QB2o97H","24576:B2o97Hr","24576:2o97Hr6","24576:o97Hr62","24576:97Hr62k","24576:7Hr62k3","24576:Hr62k3n","24576:r62k3n/","24576:62k3n/+","24576:2k3n/+p","24576:k3n/+pL","24576:3n/+pLs","24576:n/+pLsv","24576:/+pLsv9","24576:+pLsv9+","24576:pLsv9+e","24576:Lsv9+eX","24576:sv9+eXU","24576:v9+eXUe","24576:9+eXUeF","24576:+eXUeF6","24576:eXUeF6e","24576:XUeF6e1","24576:UeF6e1L","12288:QMwoQkA","12288:MwoQkAr","12288:woQkAr6","12288:oQkAr62","12288:QkAr62k","12288:kAr62k3","12288:Ar62k3n","12288:k3n/+pA","12288:3n/+pAv","12288:n/+pAv+","12288:/+pAv+e","12288:+pAv+en","12288:pAv+enL"],"imphash":"d350427820086a321ccf21b695161218"},"file_info":{"file_name":"7ab74.Trojan.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":508488,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1698000609000,"last_seen":1698025304000,"last_multi_scan":1698025304000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","commodity","informationstealer","redlinestealer"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":57},"sandbox_signatures":{"informative_count":125,"suspicious_count":14,"malicious_count":5,"total":144},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenKryptik.GPHV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Spy.Win32.Stealer.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains reference to licensed c/c++ library"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains ability to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file packed with confuser protection"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Drops a license file"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries list of installed browsers"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001744.00000000.66989.03410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00000000-00001744.00000000.66989.00425000.00000004.mdmp\n 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00000000-00001744.00000000.66989.00425000.00000004.mdmp\n 00000000-00001744.00000000.66989.04E12000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"msedge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\ef2eb63e-37d2-4dbf-b936-37def47d7c1d.tmp\" to \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\HubApps\"\n \"msedge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\LOG\" to \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\LOG.old\"\n \"msedge.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\BrowserMetrics-spare.pma.tmp\" to \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics-spare.pma\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"7ab74.Trojan.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"7ab74.Trojan.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 55118-2916-0041131F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"DecodeBase64\" (Indicator: \"decodebase64\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"b__754_0\" (Indicator: \"DecryptRSA\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")\n Found string \"DecryptRSA\" (Indicator: \"DecryptRSA\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")\n Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"7ab74.Trojan.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001744)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"7ab74.Trojan.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001744)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.dll at 55118-976-004149E3\n GetLocaleInfoA@KERNEL32.dll at 55118-974-0041494B\n GetLocaleInfoA@KERNEL32.dll at 55118-921-00418709\n GetLocaleInfoA@KERNEL32.dll at 55118-981-00414C29\n GetLocaleInfoW@KERNEL32.dll at 55118-919-004186D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"7ab74.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"strings.json\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"$28","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"7ab74.Trojan.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"7ab74.Trojan.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"\"; Value: \"\")\n \"7ab74.Trojan.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"HTTP\"; Value: \"\")\n \"7ab74.Trojan.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"\"; Value: \"\")\n \"7ab74.Trojan.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"HIDDEN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7ab74.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"7ab74.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"USESHORTNAME\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\\SUPPORTEDPROTOCOLS\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"APPENDPATH\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"7ab74.Trojan.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.\" - (UID: 00000000-00001744)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"44.236.202.254:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 7ab74.Trojan.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"7ab74.Trojan.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00001744.00000000.66989.03410000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:1744:168:WilStaging_02\"\n \"Local\\SM0:1744:168:WilStaging_02\"\n \"Local\\SM0:1744:64:WilError_01\"\n \"SM0:1744:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"7ab74.Trojan.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" - [base:0; Status:c0000135]\n \"7ab74.Trojan.exe\" failed to load missing module \"%WINDIR%\\System32\\Windows.UI.AppDefaults.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"\"baysidebuddy.com\",\" (Indicator: \"ebuddy.com\"; File: \"wallet-stable.json\")\n Found string \"\"comeherebuddy.com\",\" (Indicator: \"ebuddy.com\"; File: \"wallet-stable.json\")\n Found string \"\"www.facebook.com\",\" (Indicator: \"facebook.com\"; File: \"wallet-stable.json\")\n Found string \"\"linkedin.com\",\" (Indicator: \"linkedin.com\"; File: \"wallet-stable.json\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$2c","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"7ab74.Trojan.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 776C0000\n \"7ab74.Trojan.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 732B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7ab74.Trojan.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 747A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"7ab74.Trojan.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"7ab74.Trojan.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"7ab74.Trojan.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Part-RU\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Part-RU\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Part-RU\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7ab74.Trojan.exe\" has an executable section named \".text\"\n \"7ab74.Trojan.exe\" has an executable section named \".reloc\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"7ab74.Trojan.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"7ab74.Trojan.exe\" file has an entrypoint instructions - \"call\t0x411b97,jmp\t0x40a53e,cmp\tecx, dword ptr [0x47ac90],jne\t0x40a6a4,ret\t,jmp\t0x411c2d,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,mov\teax, dword ptr [0x47ac90],xor\teax, ebp,push\teax,push\tdword ptr [ebp - 4],mov\tdword ptr [ebp - 4], 0xffffffff,lea\teax, [ebp - 0xc],mov\tdword ptr fs:[0], eax,ret\t,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"microsoftmscompoc.tt.omtrdc.net\"\n \"mscom.demdex.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"7ab74.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00001744-00000C25-41390393]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" [Source: 00000000-00001744-00000C25-41505324]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreeis.dll\" [Source: 00000000-00001744-00000C25-41534352]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$30","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$32","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"7ab74.Trojan.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$33","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"7ab74.Trojan.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$34","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a license file","description":"\"tokenized-card.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00001744]\n \"notification.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00001744]\n \"notification_fast.bundle.js.LICENSE.txt\" has type \"ASCII text\"- [targetUID: 00000000-00001744]","origin":"Binary File","mitre_attack_id":"T1083","relevance":1,"id":"binary-50","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$35","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"7ab74.Trojan.exe\" queries basic process information of the \"C:\\7ab74.Trojan.exe\" (UID: 1744)\n \"7ab74.Trojan.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (UID: 1744)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"7ab74.Trojan.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"7ab74.Trojan.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\7ab74.Trojan.exe\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp_win.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32full.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32.dll\"\n \"7ab74.Trojan.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\user32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"7ab74.Trojan.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"7ab74.Trojan.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"7ab74.Trojan.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"7ab74.Trojan.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"7ab74.Trojan.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"7ab74.Trojan.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"7ab74.Trojan.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"\n \"7ab74.Trojan.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\mscoree.dll.local\"\n \"7ab74.Trojan.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\7AB74.TROJAN.EXE.CONFIG\"\n \"7ab74.Trojan.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\7AB74.TROJAN.EXE.LOCAL\"\n \"7ab74.Trojan.exe\" trying to access non-existent file \"C:\\7ab74.Trojan.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"7ab74.Trojan.exe\" writes file \"%localappdata%\\microsoft\\edge\\user data\\default\\history\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$39","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"History\")\n file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"000003.log\")\n file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"fffa4e77-7fb7-4e43-a7a7-94a6c3b96dcc.tmp\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"fffa4e77-7fb7-4e43-a7a7-94a6c3b96dcc.tmp\")\n file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"954c0f31-2dc0-4f93-9fb9-822489e1d304.tmp\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"954c0f31-2dc0-4f93-9fb9-822489e1d304.tmp\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"wallet-stable.json\")\n Found string \"\"maps.googleapis.com\",\" (Indicator: \".googleapis.com\"; File: \"wallet-stable.json\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"wallet-pre-stable.json\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"41.11.2.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://sectigo.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7ab74.Trojan.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"44.236.202.254\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"\"fingerhut.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json\n Observed string: \"\"fingerlakescoffee.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json\n Observed string: \"\"fingerprintsbylivescan.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"7ab74.Trojan.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"7ab74.Trojan.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"7ab74.Trojan.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"7ab74.Trojan.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$41","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 7ab74.Trojan.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"b__1284_0\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")\n Found reference to API \"b__1285_0\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")\n Found reference to API \"DeleteFilesWhere\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"7ab74.Trojan.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001744.00000000.66989.0041F000.00000002.mdmp, 00000000-00001744.00000000.66989.00425000.00000004.mdmp, 00000000-00001744.00000000.66989.04E12000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"7ab74.Trojan.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES (X86)\\MICROSOFT\\EDGE\\APPLICATION\\MSEDGE.EXE\"; Value: \"34EE1B1F8D05DA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"7ab74.Trojan.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES (X86)\\MICROSOFT\\EDGE\\APPLICATION\\MSEDGE.EXE\"; Value: \"\"), \"7ab74.Trojan.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"$42","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$43","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7ab74.Trojan.exe\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"7ab74.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"7ab74.Trojan.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"7ab74.Trojan.exe\" at 00000000-00001744-00000C13-48013293","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$44","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"sysinternals\"; File: \"000004.log\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"4e4b4d9fb24820c3_0\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMMANUFACTURER\")\n \"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMPRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 55118-900-0040EF10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextLengthW@USER32.dll at 55118-556-0041E8A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"32/71 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"\"pingoyportraits.com\",\" (Indicator: \"\"ping\"; File: \"wallet-stable.json\")\n Found string \"\"pingreedetroit.com\",\" (Indicator: \"\"ping\"; File: \"wallet-stable.json\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 184.26.130.115 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 44.236.202.254 on port 443 (TCP); Domain: \"mscom.demdex.net\"\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 63.140.36.139 on port 443 (TCP); Domain: \"microsoftmscompoc.tt.omtrdc.net\"\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 20.125.62.241 on port 443 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"wallet-pre-stable.json\" contains indicator \".Run\" (Line: 23793; Offset: 15)\n \"wallet-pre-stable.json\" contains indicator \".Run\" (Line: 56332; Offset: 19)\n \"vendor.bundle.js\" contains indicator \".Run\" (Line: 2; Offset: 941232)\n \"shopping_iframe_driver.js\" contains indicator \".Sleep(\" (Line: 1; Offset: 10920)\n \"shopping_iframe_driver.js\" contains indicator \".Run\" (Line: 1; Offset: 20015)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n VirtualProtect\n GetCommandLineA\n GetProcAddress\n CreateThread\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n IsDebuggerPresent\n TerminateProcess\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"7ab74.Trojan.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.\" - (UID: 00000000-00001744)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"32/71 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"7ab74.Trojan.exe\" called \"ShellExecuteW\" with parameter http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7 (UID: 00000000-00001744)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}]},"activity":{"stats":{"process_count":34,"spawned_processes_count":34,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":162,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":193,"files_deleted_count":0,"registry_keys_created_count":20,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","commodity","informationstealer","redlinestealer"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6535cf57edcc00231208741a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan","contacted_countries":["USA"],"submit_name":"7ab74.Trojan.exe","analysis_start_time":"2023-10-23T01:41:44+00:00","indicators_count":{"informative":125,"suspicious":24,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"44.236.202.254","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}],"dns_resolutions":[{"domain":"microsoftmscompoc.tt.omtrdc.net","address":"63.140.36.139","ttl":60,"country":"United States","registrar_name":"NOM-IQ Ltd dba Com Laude","registrar_organization":"Adobe Systems Incorporated","registrar_name_servers":"NS1.OMTRDC.NET","registrar_creation_date":"2008-07-23T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"domain":"mscom.demdex.net","address":"44.236.202.254","ttl":259,"country":"United States","registrar_name":"NOM-IQ Ltd dba Com Laude","registrar_organization":"Adobe Systems Incorporated","registrar_name_servers":"UDNS1.ULTRADNS.NET","registrar_creation_date":"2008-08-12T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}],"processes":[{"pid":1744,"ppid":0,"name":"7ab74.Trojan.exe","command_line":"","sha256":"7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5","normalized_path":"C:\\7ab74.Trojan.exe","uid":"00000000-00001744","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8160,"ppid":1744,"name":"msedge.exe","command_line":"--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7ab74.Trojan.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001744","uid":"00000000-00008160"},{"pid":2168,"ppid":8160,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd8,0x7ffe91e0b208,0x7ffe91e0b218,0x7ffe91e0b228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00002168"},{"pid":3672,"ppid":8160,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00003672"},{"pid":7576,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007576"},{"pid":3604,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00003604"},{"pid":5276,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1063068245 --mojo-platform-channel-handle=2668 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00005276"},{"pid":7596,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1063364638 --mojo-platform-channel-handle=2740 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007596"},{"pid":7828,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3556 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007828"},{"pid":1464,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1063957358 --mojo-platform-channel-handle=3444 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00001464"},{"pid":188,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1064269033 --mojo-platform-channel-handle=3616 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00000188"},{"pid":7156,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1064573347 --mojo-platform-channel-handle=3792 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007156"},{"pid":7236,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1064910270 --mojo-platform-channel-handle=3800 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007236"},{"pid":3252,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1065183746 --mojo-platform-channel-handle=3816 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00003252"},{"pid":3100,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1066418606 --mojo-platform-channel-handle=6048 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00003100"},{"pid":6400,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6216 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00006400"},{"pid":8136,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6548 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00008136"},{"pid":2684,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6760 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00002684"},{"pid":4764,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1070598214 --mojo-platform-channel-handle=4872 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00004764"},{"pid":2796,"ppid":8160,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --time-ticks-at-unix-epoch=-1698049592786120 --launch-time-ticks=1071303031 --mojo-platform-channel-handle=2764 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00002796"},{"pid":1656,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00001656"},{"pid":6736,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6732 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00006736"},{"pid":7780,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007780"},{"pid":7756,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007756"},{"pid":6484,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00006484"},{"pid":3904,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6004 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00003904"},{"pid":7412,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4848 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007412"},{"pid":7752,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5108 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00007752"},{"pid":6100,"ppid":8160,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3700 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00006100"},{"pid":6748,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00006748"},{"pid":3632,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7192 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00003632"},{"pid":4688,"ppid":8160,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1976 --field-trial-handle=2044,i,7089041130084473576,2850358358121896444,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008160","uid":"00000000-00004688"},{"pid":7788,"ppid":1744,"name":"msedge.exe","command_line":"--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7ab74.Trojan.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001744","uid":"00000000-00007788"},{"pid":2692,"ppid":7788,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0x144,0x7ffe91e0b208,0x7ffe91e0b218,0x7ffe91e0b228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007788","uid":"00000000-00002692"}],"all_imported_dlls":["msvcrt.dll","uxtheme.dll","ole32.dll","ntmarta.dll","clbcatq.dll","netutils.dll","ieframe.dll","dxgi.dll","mfperfhelper.dll","FWPUCLNT.DLL","profapi.dll","Windows.Shell.ServiceHostBuilder.dll","dsreg.dll","wlanapi.dll","libGLESv2.dll","rasadhlp.dll","wow64cpu.dll","fltLib.dll","msasn1.dll","oleacc.dll","vulkan-1.dll","ucrtbase.dll","oleaut32.dll","comctl32.dll","devobj.dll","d3d11.dll","WofUtil.dll","ntdll.dll","gdi32.dll","dwmapi.dll","cfgmgr32.dll","windows.storage.dll","dhcpcsvc.dll","PCPKsp.dll","D3D12.dll","gdi32full.dll","urlmon.dll","imagehlp.dll","twinapi.appcore.dll","biwinrt.dll","libEGL.dll","dnsapi.dll","win32u.dll","ws2_32.dll","wkscli.dll","OneCoreCommonProxyStub.dll","mf.dll","msmpeg2vdec.dll","d3dcompiler_47.dll","nsi.dll","dhcpcsvc6.dll","user32.dll","shell32.dll","mlang.dll","KBDUS.DLL","dmcmnutils.dll","d3d10warp.dll","TextInputFramework.dll","DataExchange.dll","kernel32.dll","samcli.dll","crypt32.dll","deviceassociation.dll","onramp.dll","advapi32.dll","SHCore.dll","dbghelp.dll","ncrypt.dll","DWrite.dll","dpapi.dll","Windows.UI.dll","atlthunk.dll","WinTypes.dll","propsys.dll","directmanipulation.dll","Windows.Devices.Enumeration.dll","Windows.Networking.Connectivity.dll","Windows.Security.Authentication.OnlineId.dll","sechost.dll","setupapi.dll","cryptsp.dll","cryptnet.dll","oneds.dll","ResourcePolicyClient.dll","dxilconv.dll","msvcp_win.dll","rpcrt4.dll","kernel.appcore.dll","msedge.dll","gpapi.dll","winhttp.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","vk_swiftshader.dll","wow64.dll","CoreUIComponents.dll","IPHLPAPI.DLL","wtsapi32.dll","vaultcli.dll","Windows.System.Profile.RetailInfo.dll","OneCoreUAPCommonProxyStub.dll","secur32.dll","mfsensorgroup.dll","srumapi.dll","combase.dll","edputil.dll","wininet.dll","wintrust.dll","fwpolicyiomgr.dll","wevtapi.dll","dxva2.dll","CompPkgSup.dll","mscoree.dll","msctf.dll","bcrypt.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","mscms.dll","Windows.Security.Authentication.Web.Core.dll","wldp.dll","RTWorkQ.dll","wow64win.dll","sspicli.dll","VxSSL32.dll","mscoreei.dll","netapi32.dll","nlaapi.dll","Windows.Media.dll","mswsock.dll","iertutil.dll","winmmbase.dll","rmclient.dll","dcomp.dll","imm32.dll","ffmpeg.dll","actxprxy.dll","telclient.dll","cryptbase.dll","shlwapi.dll","deviceaccess.dll","npmproxy.dll","msvcp110_win.dll","Windows.Web.dll","msvproc.dll","mscoreeis.dll","version.dll","winmm.dll","microsoft_apis.dll","bcryptprimitives.dll","CoreMessaging.dll","userenv.dll","apphelp.dll","UIAutomationCore.dll","netprofm.dll","twinapi.dll","tbs.dll","BitsProxy.dll","powrprof.dll","mfplat.dll","KernelBase.dll","msedge_elf.dll","DolbyDecMFT.dll","ntasn1.dll","winsta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"00534e52-3fde-432b-bd84-9e8860316f09.tmp","sha256":"ee2212a7be2a699d6050b7479f3b52693240f60538fd79ed2bc879b5f2a4a824","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"4bbd21db-3d14-442b-bec9-fc3574cacc7e.tmp","sha256":"9a29b9ba022630ee90af3ae327e5080294afa8ab0802d199b7fdb9b6748f7f52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"523585a6-d5cb-46f9-b80f-9043bcbdbf0e.tmp","sha256":"64e962ca072f9a9eb6ac9dd0587f74fea626235e53015ef4a3fa525b8db105ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"53bd812d-0c50-4a04-9dac-ff118493a86b.tmp","sha256":"c03af54dfc7720f370d039a041a7816eb28cfe59f5125c1ca58d9e201be805e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"65b39f35-ab9b-45db-80fa-dafbe1e9a65e.tmp","sha256":"751c7f2f74dcfeecdd64dda7b75a00691566a95b0c9246ee32a770c404a2dfe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"6b593cc2-9d85-4e09-8b82-06cecc9cc53c.tmp","sha256":"5247af8e0b6fa8027da986f318ce1ba00c50c88bd90ff218e41daab7566f293d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"8491b6d5-eb61-4e9f-bcca-670fafa723f8.tmp","sha256":"ffde7d8547d803af79272baa61d7fa722cc19f41fab5dcd67aed6957af198a13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"8d37556c-e122-4ed7-ba20-e25d653803ea.tmp","sha256":"d094a697b0bfdef49b3372b26fd459e03852c6cfad8f3a14db0a62ee85cbc4fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"e1a37bd4-e91c-4216-9e67-ad955a62bceb.tmp","sha256":"45bda0225a4aa730f99d7658cebc672dc00fb4c6ffb6f4171b7fc2efbd4c12f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"settings.dat","sha256":"cb7be7aac22e0315f628695d59d6952db1e648f99af5f58bd164300e0387a90f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"0c821904-0abf-4e41-b99c-629da90a2ffc.tmp","sha256":"60dcba35da58a0c16201804810fc06c9f9e976d2060e57149053d76c3236b096","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"16de73f9-48ff-410a-839b-4953c38c98a0.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"3b798bdd-47fb-4edb-a65e-e189e00c617f.tmp","sha256":"57e2b52d91ab4500c22b8dc0d1a8ccb33ebe8c1c2108cce853596cf3b8851cee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"3db1fa62-907d-45c2-9239-60c1b36e6430.tmp","sha256":"131ef515de08916e19abcacf44f54c279f2ffcc0251d93a25a42df60b5b6b825","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"455849d8-44c6-434c-a1e1-f0038e1cb7dc.tmp","sha256":"57e22c96939b8c3f90d6376c26d4374128230e6a5b9fac9e5c3f0c302690b2e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"53078e67-acd3-46ba-96e8-5586699b6990.tmp","sha256":"604a850003534855fd4bdc8b4ba48823e3f8967a7df3b757e0984cbf147959d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"982f29f1-5ad4-46bc-8743-f6cfa98b7686.tmp","sha256":"0aeb35b1c438b1fc8017e2d7fac2a871a354fbb21e2ecfd7584a3116f9926e7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"000003.log","sha256":"bce3dcb1bf95396fdd8e4118f548bf8bd254f490cff9df546a67a37ddc895320","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"LOG","sha256":"8a5fef19d7c78e40853f83933429f2ac505f98cd588727bbdd2d8d9896c68962","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"data_0","sha256":"260b277a4aff653678ad705dd23d801ce74f1ad08a37e679102a312819594f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\lockfile","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Last Version","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Top Sites","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\commerce_subscription_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\commerce_subscription_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\HubApps Icons","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\load_statistics.db-shm","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension State\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension State\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension State\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension State\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\a592f060-4e75-461a-8df2-3c734567e56a.tmp","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sessions\\Tabs_13342524257868750","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\e1a4523a-0b9b-4818-b53c-99a704fec2fc.tmp","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache\\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c3","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c4","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c5","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c6","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004c7","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\heavy_ad_intervention_opt_out.db","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\3d033381-1dc0-4f7a-b375-9349db43c421.tmp","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\000013.ldb","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\WebAssistDatabase","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Shortcuts","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Last Browser","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\4646250df6550668_0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\8f3c2e2c260a7099_0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\d8de9d7292381645_0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\9c1e175bdb6cd9ef_0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\d5dcd28b2c992c87_0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\48b0b4a3c03af1e9_0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Code Cache\\js\\4e4b4d9fb24820c3_0","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\arbitration_service_config.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0004cd","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\93b02707-baaa-4aa2-b072-64cc54b0a43b.tmp","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_hint_cache_store\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_hint_cache_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_model_metadata_store\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_model_metadata_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AutofillStrikeDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AutofillStrikeDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\BudgetDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\BudgetDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network Action Predictor-journal","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SegmentInfoDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SegmentInfoDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalStorageConfigDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Segmentation Platform\\SignalStorageConfigDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\DawnCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\LOCK","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\13522e90-c0b9-4932-b06e-e7eea060c5e9.tmp","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOG","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\000003.log","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_328122529\\crl-set","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_328122529\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\adblock_snippet.js","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Filtering Rules","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Filtering Rules-AA","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Filtering Rules-CA","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Part-DE","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Part-ES","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Part-FR","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Part-IT","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Part-NL","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Part-RU","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\Part-ZH","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_180635197\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_1552637047\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_1552637047\\recovery-component-inner.crx","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_258774221\\edge_autofill_field_data.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_258774221\\edge_autofill_global_block_list.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_258774221\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_258774221\\regex_patterns.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_258774221\\v1FieldTypes.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_258774221\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\app-setup.js","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\bnpl\\bnpl.bundle.js","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\bnpl\\bnpl.bundle.js.LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\bnpl\\bnpl.html","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\bnpl_driver.js","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\buynow_driver.js","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\crypto.bundle.js","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\driver-signature.txt","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\edge_driver.js","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\hub-signature.txt","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-ec\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\el\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\fi\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-hub\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"path":"%TEMP%\\8160_979058422\\json\\i18n-mobile-hub\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATEMEDIUM\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\PREFERENCEMACS\\DEFAULT\\EXTENSIONS.SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\PREFERENCEMACS\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\THIRDPARTY\\\\","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\PREFERENCEMACS\\DEFAULT\\EXTENSIONS.SETTINGS\\EXTENSIONS.SETTINGS","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\PREFERENCEMACS\\DEFAULT\\PREFS.PREFERENCE_RESET_TIME\\PREFS.PREFERENCE_RESET_TIME","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\PREFERENCEMACS\\DEFAULT\\PINNED_TABS\\PINNED_TABS","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:1744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"Local\\SM0:1744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"Local\\SM0:1744:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]},{"name":"SM0:1744:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6535cf57edcc00231208741a"}]}]}},"report_ids":{"sandbox_job_ids":["6535cf57edcc00231208741a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 7ab74f07884f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7ab74f07884f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 7ab74f07884f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7ab74f07884f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 7ab74f07884f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7ab74f07884f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]