Analysis Report 6a9b0000.da.dll

ID:	403004
Product:	CloudBasic
Start time:	17:17:17
Start date:	03.05.2021
Sample:	6a9b0000.da.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	6a032fa9c6bd795ad589260cce3c42e4
SHA1:	0f7d7a67bc59c263708666e383ccd3a9b848351a
SHA256:	7313c2675f4a3c247fc8fe50ed0d7cd4885454151de712f026e9830de0cd04e1
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\7ILUR3PL\contextual.media[1].xml	ASCII text, with very long lines, with no line terminators	CDC311E06CA9C07E45C93DE192084E02	A075F5AF3AABEC824EF35DF889A584743F0D5C05	E8241ECFE74C752BBD2DAE99C6022CCA90D237C8529763019DACBF3BF46AF90A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\WWK2CYIA\www.msn[1].xml	ASCII text, with no line terminators	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{34BD59AE-AC6E-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	961D787F03C1BB690D8C2DF5794BD943	951F682399448422975FAF4B4D82E3705BE31D1E	1BEFB2AA8A9AC3B399D4A7EE3B04724AE13C86106CD8F195809B9B87891C168C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	5FF666B61C1975BBDC5E096803D51967	792A6AC0FBB854C7E5457C2E4FBA587CF65BB73E	232D2C316601119558C5C336B0395A4F04BA05CD2F692BDE9032636C1FC985C7
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	EB14E5B219C30CE4A3D031C3A11B377A	D43DE5334B88C0F62D630DBE336EB6A9598AC7EC	848F0FECF284271BE47878C9FC92993C8D71B98BFC09BAF3E94688A3BAE92FC4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	38B3BCBFE477E6CAEBBC63586F89AECF	FD3FC100192928233E1A4EB2CEBBFE9DD9E53871	AA7A6E0360C08123C5C6907F4F2B10410D91B478AF9D47245B5F44254B21F74B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	89DE3E0B73838B4A194AA88C5AE715FD	73BED7D9C008D3D1DC05A24082D5D96A1742C485	529335BF806869CF79682BCB4BE34230A948D0619D2EC06020C31A13EA65A2C1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	44678FFB03405A0E948258B17B9DAE0D	38159CC61AA61FE60E025E1CBAC7C4DA810EBDC4	DFB3D7CBB116E5BF80A4CFC87CBB699D71F7728EE584F8D394828B24ED20013B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	D1C568DDE06255545A2ACA3F85908691	08128AB1C7DF561C856C700F7EEC69DB9E044E5F	284EC40782D7B7801B07E1B7D148439F30F46DBA4D6FF90BE47ABE83D50EFE38
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	D0B92166DBA8CBB23D2C7105702A183A	40BBBE776DC105499E0E24AB86AA6CD5B48AAAC1	75ED7CA4A741D2B7A7391FE7F320A8AEA0C65BF4EEE9C149FD2EEE2CF665D95F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	FAA3E443FD9A1C0A971B305CEDE9DC65	982FF897DD4CEB7ADF3A9C162AFC3FD2CF588B27	9AE3857B913507E689AB79E0D929AB3A16E536EFC95615AE09D9100840A1C8FD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	935AAA860E0324BEAFA6D0C5F208A252	F9D714EF9015F81D6BF6E1E61DA4D28082220D68	E3BADA178E5D71778D9DE794F7E4551DD2A936EDADB7710E757D3E57E166788B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	9B5CC18CEF259C5570AB93CCC50A23B0	43234013670EF5DBBD15DD75CF36D9912B4BCCDA	46F7A0DF3E1C6F95F78938AED3D38F40E51671026DCC14A936B928ED38D12AFD
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	83D217CD42B66ACC1809A9CBD9C7D801	303E2665C92FB61E5F14FB650B609DC321FF671A	34814D762BF9417562B3F3D73DDAE90E1CAB6B53F7AC1187C873F037592F76EA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\2d-0e97d4-185735b[1].css	UTF-8 Unicode text, with very long lines	DF1D314E447BB8D3FFDA218389306E8F	EF706994A0807683901AD3D8E81A7F49E50689DE	70EB7CE2E6CBE8A06F08AA25924EC3A2FB9E9E21191CDABCAEC6BE95CFB462F7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\52-478955-68ddb2ab[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	7C41BB68E5BD26DEDF185AF1EFF5559C	6CA6B34101AF0C4DF59948433602A4891482C5B2	03F0FF3B5BC8A29DF664F6DDB1DCFA608E18972E1CDC04A17DCA4DC45A5348E3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1ardZ3[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	641BF007DD9C5219123159E0DFC004D0	786F6610D6F9307933CAE53C482EB4CA0E769EC1	47E121B5B301E8B3F7D0C9EADCF3D4D2135072F99F141C856B47696FC71E86EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1cG73h[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	D1495662336B0F1575134D32AF5D670A	EF841C80BB68056D4EF872C3815B33F147CA31A8	8AD6ADB61B38AFF497F2EEB25D22DB30F25DE67D97A61DC6B050BB40A09ACD76
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1eIc4m[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	52579D7E332F4F67CDB9167C0DA9B216	E8E7BDA1C40A31FAE94806EB66A2DA3563E7B001	22A737D4ADD5FB4C7A88A98EC4CCDA522DC73CDFDCC39742AF6E471E98385977
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1g52AS[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	8C9848CBCE46A0EE68D0CB3C010A40FC	56F9DE73793BA15BB28466F2628E8ABBFA636C47	616F3B352B3BDF4A02BAC3D0C966A28A4D7B7BDE66600001347BB5B55431921B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1giGuf[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	A4C8546BCC6C02AF178A3605A6B7EAED	1D16163179AADCC244560BEFA51285BEC2F8D2A3	2FA212A399872390DEF51263E9E1C5D0A9B59310444488AB1FD0DC64421BA991
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1giL6z[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	3951BEC441CC4DFADB788E2961A49328	462D977D86AEA261DDF509F6664B5D670D20E05E	EB2F9EA44FC16BA9108BB92A7523F912574DC7DE566A9ABAD830889354B1BB14
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gj6Xu[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	501AB98066FB1EB3EB196DE5F99027A3	B5F8E771AD962616D8F7D5168DE8709A7CA8D61A	F216AA10A78056FE45DF2AE206B5AD37287FE4DEB588FC5B603C290A118A1F82
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gjA43[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	B9CCFC50D8597103A1AB656F6FC24AAF	CFA04349D6DA21B5E6069819CFD06F2D807F394B	3CC6530256F9A33A9323D82A8D02119B84C725A00E86823A203A807F5748696A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gjhNy[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	308E7AAAC626BAA574D7E385C4E265A3	2FE071C505D17A7682CC576CAD2295A62F1F0A55	918E995E577545FC1574AD6CAC3495DF1EC6779302C852BF25A3FB8DA069A2DF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gjiCF[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	574308DF0408AE04183E412C18ECF748	84594F8DA59A4A9035B477C5BD76D9F888C468DF	E80819E362CB51DCE8D999FAB6FAE3A10898B390861F51D4AAFAE018F6960D9C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gjlj0[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	F5076C0FF9F2D8AE245D538D4B951854	A0AA74114AD39AF6B2C52A3C2D771371E41C7CE0	521C3D2CD98EE6973B479BAF1E59FDAEC9B08E5AC2AF2D976076102DF470143B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gjnSo[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	A2E6FAA3F8B6089510260A2A13BFEF39	7CD38C77E749E3F8FAA4CC43E489A25D30E86111	6262544591304F6E7883E20266086B81BADFE7A14D35F6CE61B752CDB922AFC3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gjsfI[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	09A12219BDEDCEA8A254CFE2A4D9F1DC	EB381B6B163944D3ACBB94001C86BC5E3EDFE8B4	01AB8D9315E2C5C090003EE9EC8C849664E2CC75AFA33F3AE68D4CC2FC89A408
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gjvi0[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	F2E4231B89B35D03CFFF744FABC24C4C	DE8F92C5FAD1AABFED835DC7A992F0F2F96D901B	DEDA8792B7FF893431383FA264F0D526F80EA9D8FA128720ECA3A8B84EC35678
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB7hg4[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	A4F438CAD14E0E2CA9EEC23174BBD16A	41FC65053363E0EEE16DD286C60BEDE6698D96B3	9D9BCADE7A7F486C0C652C0632F9846FCFD3CC64FEF87E5C4412C677C854E389
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBPfCZL[1].png	GIF image data, version 89a, 50 x 50	59DAB7927838DE6A39856EED1495701B	A80734C857BFF8FF159C1879A041C6EA2329A1FA	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBUZVvV[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	16B34C1836A5FC244145527EC79361D4	18CB908457B380545D89D8A4D3F91CDABF3ADC78	DB797DF4F1E320C21BD6019E89E6CCC5569C5CED57E1D3BDD736F3B4A9371BC0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBX2afX[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	4AAAEC9CA6F651BE6C54B005E92EA928	7296EC91AC01A8C127CD5B032A26BBC0B64E1451	90396DF05C94DD44E772B064FF77BC1E27B5025AB9C21CE748A717380D4620DD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBih5H[1].png	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	F1AEB21B524DE2509415284BB45C9D1B	9C5D17A573FE2DC2ACB2729381BC777C9C8474A3	EFD678CBFA67BBD38DCF9BFBDBA90804EA2425B93F0A7447DACA21F9ECCCD458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fcmain[1].js	HTML document, ASCII text, with very long lines, with no line terminators	2653C194886DE38C2A00781B3A89313F	C8C44770F262ECB2670D5FF5118C1F8F85E3B285	3799B4C07864592EC6B29D049A25D32D6583DE5C7B775B2BACF9A6DB74CBA781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\http___cdn.taboola.com_libtrc_static_thumbnails_5b179a030c29a1ac065fdc22323514dd[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	44534C75F7EB3B79CDE764316D4DC36C	73C1E9535DC49DABF9CA0AFB8CD6080649063182	827331E8B1109C6327F4E0E7CB70E1E6D15AB530968AFF9B1C470199AB24F5BE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\http___cdn.taboola.com_libtrc_static_thumbnails_GETTY_IMAGES_SKP_1212754341__UAwpk84z[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	F90AF235E2F75A6C69679F36A21FEBD0	FA92C4CFA728323F840334F4F1C487D029A8970C	8F1B5C18A523927A373CFA5BDE76BC44A4D6F0B77513302A57BE7FC52D1E2911
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery-2.1.1.min[1].js	ASCII text, with very long lines, with CRLF line terminators	9A094379D98C6458D480AD5A51C4AA27	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\nrrV27271[1].js	ASCII text, with very long lines, with no line terminators	556E5A5EF97F07B9E3AE70826DA3A185	B0FE2F6AEC9B462E7935709A12E882E413560711	8FE78776FCEDC916C23B2FA803A38B4D1284B4A2F87E18F13C5B1BF1C0B80394
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\otFlat[1].json	ASCII text, with very long lines, with CRLF line terminators	A7049025D23AEC458F406F190D31D68C	450BC57E9C44FB45AD7DC826EB523E85B9E05944	101077328E77440ADEE7E27FC9A0A78DEB3EA880426DFFFDA70237CE413388A5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\otTCF-ie[1].js	UTF-8 Unicode text, with very long lines, with CRLF line terminators	52F29FAC6C1D2B0BAC8FE5D0AA2F7A15	D66C777DA4B6D1FEE86180B2B45A3954AE7E0AED	E497A9E7A9620236A9A67F77D2CDA1CC9615F508A392ECCA53F63D2C8283DC0E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17-361657-68ddb2ab[1].js	ASCII text, with very long lines, with no line terminators	7ADA9104CCDE3FDFB92233C8D389C582	4E5BA29703A7329EC3B63192DE30451272348E0D	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AA6wTdK[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	91EE9ECB5C9196CBD18EE4E9C41F94B5	F829201477F63B908789BB895823E5A4D16ABBD7	2BA5AC02E5C6AE8D5BBD3D8C0CD5603A02A67E192394813514D151AE1D6988B6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAyuliQ[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	8BE25BB557B3A41867C301BE4A5E5CF0	0E61854C405F4827FC034698BB84D536B3D6A6F2	A7074994D0ED3600F3F7B6388C0D093A5DB7E619C1470148567B8AF88F4D4331
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB10MkbM[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	569B24D6D28091EA1F76257B76653A4E	21B929E4CD215212572753F22E2A534A699F34BE	85A236938E00293C63276F2E4949CD51DFF8F37DE95466AD1A571AC8954DB571
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1cEP3G[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	18851868AB0A4685C26E2D4C2491B580	0B61A83E40981F65E8317F5C4A5C5087634B465F	C7F0A19554EC6EA6E3C9BD09F3C662C78DC1BF501EBB47287DED74D82AFD1F72
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1dCSOZ[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	5F25361D8730566E8A8C453E8CC1339D	CD0C5A8D20810511C42D2EB37381EA9213568EDD	7763287F5905D00A46BF4760FCF6C19E5BB0F234776BCAD174754BFBE304CF58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1giVLp[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	1EEDC73478A9893C80BE344A600D01CE	DDEAE326B1970E589B364665568912FF283FBAC2	B60B72202E02EABAEC5EA40144C43CACEE43DEADCB1596E696650EA209CB150E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1gj0pQ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3	B964A60F150BEE9966787E95E43F7BBA	0F812E200154AEEE4316C2D9A8E74E95618015AA	5E0DCDB1058241720BD334637465518C44493F89943941A9CD2466C0E3870C44
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1gj1H6[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	684B2CFF1FFA1ECFD30C1D68FA99BB87	33F24B9D13F85E1FA618AD8BD01CFFB1C613AE6E	134460818C1E6C9A6451D300DB599AD521B113847900ACDD42BF9E2B80F4AD17
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1gj9fS[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	74D5D9B6F4DC3CCBB3C54893EB900D76	CE286CBA8DE45DE9842D9570F3FA9DFE3A8FF4F1	68582F186768CF6C156FEE3E6770186C8578D9689A5B114752A469F873D0C14B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1gjcYM[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	6CDFF86F5B00D26626F2040CAC2DBC8F	74A089A866921266E4E1ED9C671B5EC062E6F8C3	A9693488B8D69FBAFE3843A56849CF73F65E321A3079C23F879131A1F89EFFB5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1gjfQA[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	95BA23B1C0203CDCC1D6D4078BEAB8C8	9B043C8228C683B646BF3E6B345328C034BE9786	38C70694C6B1B74F819E7705162BCCF0239FCAAA9C0809A300B9D7B9F2BEB93C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1gjvoa[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	55BD94DAFDC5250CF3069C88F05E7343	7FDFF26D0AA0D739423D48DCAD28B97900A10807	889806055A6C3D28A0E39DC4FBDF1848F540485913A151BCF9B031ECB6A3A4A3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1gjxJe[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	C38A26A1B27CF0BA7254070C55504F2C	1A813EE779F2B5D88EFCC1E966C6D3778C379968	E5B3998CFD40C0C814B9F921911C81358114BB260BFCF8D96EE8436616CAE41E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB6Ma4a[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	6D4A6F49A9B752ED252A81E201B7DB38	765E36638581717C254DB61456060B5A3103863A	500064FB54947219AB4D34F963068E2DE52647CF74A03943A63DC5A51847F588
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BBVuddh[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	636BACD8AA35BA805314755511D4CE04	9BB424A02481910CE3EE30ABDA54304D90D51CA9	157ED39615FC4B4BDB7E0D2CC541B3E0813A9C539D6615DB97420105AA6658E3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BBzk0eX[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	68D1848FA051DE00C5C068A0763D53AB	AE04C8B949224B78652D25B73CD569F35F1284BF	1E81100B6950F0E39C86CEAD6097AADC90A9ABBBA7DC2F3B4AFF2435015AE3E4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\checksync[1].htm	HTML document, ASCII text, with very long lines	97DF1589A6CA5F3ACEF72BA85231D74D	F483F407BEFCFDE4785B2DCDA32921DE0EF0A233	DE227EFC3ADF6C42FFDAF3A4B3F719DCC38D9732B373891C1AACB1A791822DF2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\checksync[2].htm	HTML document, ASCII text, with very long lines	97DF1589A6CA5F3ACEF72BA85231D74D	F483F407BEFCFDE4785B2DCDA32921DE0EF0A233	DE227EFC3ADF6C42FFDAF3A4B3F719DCC38D9732B373891C1AACB1A791822DF2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\de-ch[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	494C56559703758DB683C8C1C747CEA7	9FF77F91030F3BB7C96C3D66B4B8ADDE39858419	D4052D8030E40295789E712ABF088701809263A313E34441C4C41F28B25D96A0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\de-ch[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	15BCB7BBE03E5ABCE3162F71DADD8D63	2EF0AB2CC332049F5C79A7E088BD877759E93993	5004E4E24FE7DCD410FE6274C514A5E49984353512A1FB0F962812065C6A381B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\http___cdn.taboola.com_libtrc_static_thumbnails_39e6bbb6c0e2fde5d91affbdf29f0a4f[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	BA4C19A6727AF39F2E94E2A32C5A581C	497AB1A6A9770EB5802045B3D5821351CBD2CBCD	F2FC6A5B2F1F7C6094B0C6F4D48D3A640332C31AE7E98BC3F93328B34B983BA1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\http___cdn.taboola.com_libtrc_static_thumbnails_GETTY_IMAGES_SKP_1224629431__U7QkrbbP[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	76F9E67FDBDE0B23D8881C1C8B93B8EF	0C4281A1927E87110BA486B7584B88856A29E195	0E21BE6A24A876AA8152FA6B6A7C2CA2874B966B8ADC6A50FB973A6825244C2F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\http___cdn.taboola.com_libtrc_static_thumbnails_a940a7cc56071c6ca38fc4c34569e834[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	4F05C7DA1EF0727CFF8567E44C79B35F	D6B308A23C54B58D4B35187350199BEF134A4B15	F074A1108BF7B55321E5CCA9CF0CB518D9CC7AAC83E07A405571604287DF52A3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\http___cdn.taboola.com_libtrc_static_thumbnails_ea43c4b226ac15f4778a89a8dda3c83f[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	C18159256FE1F22CF1D02150F4A7630F	F61225583F6887D84A3BBB90E2A05F0D0C9F3AF0	C9C5DD1D038CC7E8305DA8F1517B7C8D3A98B288606ECD3EF32040783B0E4BAF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\iab2Data[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	D76FFE379391B1C7EE0773A842843B7E	772ED93B31A368AE8548D22E72DDE24BB6E3855C	D0EB78606C49FCD41E2032EC6CC6A985041587AAEE3AE15B6D3B693A924F08F2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\nrrV27271[1].js	ASCII text, with very long lines, with no line terminators	556E5A5EF97F07B9E3AE70826DA3A185	B0FE2F6AEC9B462E7935709A12E882E413560711	8FE78776FCEDC916C23B2FA803A38B4D1284B4A2F87E18F13C5B1BF1C0B80394
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\otSDKStub[1].js	ASCII text, with very long lines, with CRLF line terminators	82566994A83436F3BDD00843109068A7	6D28B53651DA278FAE9CFBCEE1B93506A4BCD4A4	450CFBC8F3F760485FBF12B16C2E4E1E9617F5A22354337968DD661D11FFAD1D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\50466dfa-2f83-495a-bc9d-93c9bba7054c[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3	B82A130DC78F2CC753B0E62AC5D4C7AD	E1A37934FC5463BB482E3D8A713F1EE153E84018	399AC699C38A4BC093DF2AF4C33DDBB53D1F31E8D96187B884CD66995BCDA257
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\55a804ab-e5c6-4b97-9319-86263d365d28[1].json	ASCII text, with very long lines, with no line terminators	B2B036D0AFB84E48CDB782A34C34B9D5	DFC7C8BA62D71767F2A60AED568D915D1C9F82D6	DC51F0A9F93038659B0DB1B69B69FCFB00FB5911805F8B1E40591F9867FD566F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAuTnto[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1472AF1857C95AC2B14A1FE6127AFC4E	D419586293B44B4824C41D48D341BD6770BAFC2C	67254D5EFB62D39EF98DD00D289731DE8072ED29F47C15E9E0ED3F9CEDB14942
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB15AQNm[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3	C701BB9A16E05B549DA89DF384ED874D	61F7574575B318BDBE0BADB5942387A65CAB213C	445339480FB2AE6C73FF3A11F9F9F3902588BFB8093D5CC8EF60AF8EF9C43B35
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1giiPN[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	A19E7557207698F78BF0D2E1B6CE1A8D	5D7FFD7A907EA58647F4BDC9F97836B2BD00A48F	2292E6D6B7C2DC7AD53D6A0A9D2665AEE97916A821AE2DA57269E5EB85B70EBB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1giiSX[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	9715230EADAA5BD0C02B313AAC71BD20	DE636102D1B056847B012090F96AB6E24376B6AA	06962553B73FD974089241B27EF778B1819380EB4844E21CDF34499D17CB9ABB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gj47Z[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	BBECA9F8583B5112E148EB79EF6B1F62	AD8678219CECA212A8CC31FDF80C666D612463CD	0057C6AC788A54759D7BFFC4E983EFFFE96A9ECDDED5A88CEB9BA4DFE75E10E9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gj4Xc[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	94F45166BBA1C6FC797C1A6C8054F0B0	1FFBD8A7684C8478EF853846F0ABDCEA11C55202	01AF9D709D9403B94BF0C2366929966EFB9F88429B1FD471B170F9BD54819562
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjc9N[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	7EB5445C825AF3A76F6636C7A79F39F6	3B2EBA6F53B88C6BB421699E96ADF3EFD5738ED3	EFB4449EC5E969E4EA5B9A3D4F6C0CDA3C086C27ADFBF145138080FC1BCB626E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjd5W[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	64B9E94F3AC951C4FBF563CCD65453D3	E39AFF4BBAAB0C5CFD06E41AF847460DCDB30403	8BAFDA601D985B371C44F0F24B5C921E065E1B5B620FD29CDBF14B89996D88F2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjfRO[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	FCD13B634FA38C2CCC178A9DDFE3BBE6	A43C16D677236D2FE8DD1101DEBF3F710F4C8DB5	1FAA90D0DC79E170EA47BF0695EE0C83E1FCD677FD6F1D41D40CDCD3C25C672B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjjyP[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	A0A60E1F2EAAAC3AFBD1DE5BA64B80D5	3923541C9927B65ABC4F62BC07CEB3C6EAA20C2B	7B6DFA23A36DE900FFD1FE772DC4A26533A7A8157C4FF9F35564A7EA3AC76340
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjlUj[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	55FAA3ECD54D6921DF3E8C54140A5848	13DCC233155BD4C70CAEAF0F2B2DB1AEA4F12BF3	24FC922429576C83E732C9D6AD0527C67FCF4F764009F8594B954C24C41394AB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjo4R[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	055D23D57B140F9CE634B79B5C3D277F	D4F028F698E4E96DBF1586D9546179558F9B98CA	4300BF6CFF93EEDB8D497C034FD1C7808BBBAAE12A448C3F71F752EAD5C78655
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjoJk[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3	429F80926EDE1B46AE6E308ABFB2F480	3708F5914B5FB0562542EF18FC18657759A4E962	95BF3D84579FB79EF73D15784DFEA1074DE3A4F132CAD5CF77DC3C3BF083DB95
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1gjxpT[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	A9E7AC5D915FF7132E78FD77140C69A3	0165362FB4123AC130EC0EB7E8D14DE8F2CEE3EC	A85E32BEA97505714DA5112312DEDFE4E5071B4741C87737C02E405E54D62BDC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BBJrII1[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	8E1FB6F831EDB003756420A8789619C3	AE3C4E18D5FD2772AE6BF59A6A52BDBB342FDE89	558462D58A045ACE0C8F05314CF2932C4190ADC328D30BB6B5C4416C9197D858
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\a8a064[1].gif	GIF image data, version 89a, 28 x 28	3CC1C4952C8DC47B76BE62DC076CE3EB	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\checksync[1].htm	HTML document, ASCII text, with very long lines	97DF1589A6CA5F3ACEF72BA85231D74D	F483F407BEFCFDE4785B2DCDA32921DE0EF0A233	DE227EFC3ADF6C42FFDAF3A4B3F719DCC38D9732B373891C1AACB1A791822DF2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\checksync[2].htm	HTML document, ASCII text, with very long lines	97DF1589A6CA5F3ACEF72BA85231D74D	F483F407BEFCFDE4785B2DCDA32921DE0EF0A233	DE227EFC3ADF6C42FFDAF3A4B3F719DCC38D9732B373891C1AACB1A791822DF2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\e151e5[1].gif	GIF image data, version 89a, 1 x 1	F8614595FBA50D96389708A4135776E4	D456164972B508172CEE9D1CC06D1EA35CA15C21	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\f489d89a-0e50-4a68-82ea-aa78359a514f[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3	CF11BAF2E1D8672BBE46055C034BAE56	7305B5298E7EFE304F11C4531A58D40ECD4EA99D	2F7B151005B4E02B04116E540BE590E8C838B5CFE947358993DE63880520D10E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fcmain[1].js	HTML document, ASCII text, with very long lines, with no line terminators	42F4DE71D56C50FC3D2F192205719CB5	0B2EBAE3DF8EF14C55B3B9D84A9740FC4064DD98	1CFD45BB03E5AD4D38F0D2498F0E81117E23A7F42568DB5D516D796C427AE3CD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\http___cdn.taboola.com_libtrc_static_thumbnails_80ebae7de5cd4dd5f336c2f56096104a[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	B095AE7CE8CC19799B6AC862DDD51F30	0147EBD2C556E3FDD836BA4CC1C9F12065AE83DC	67ED8147DF2A0C108BC2FA22838DD0638E8BE1C7898CE5EF464C508A4567A2DD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\http___cdn.taboola.com_libtrc_static_thumbnails_abf05a91eb65c05612420361a663663f[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	8B1A879EE099B8EADF8872E5DD8CABE6	C2A2CE59EE02EB9004C887F2247631623C908F16	C5844C57625C74C759EF201F9788DECA0B2D1B658A1C3FEB9F83116A8CEB015A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\https___gallery-pl.go-game.io_uploads_2021_01_Vk_BallistavsArmy_B91074_1000x600_NoOS_NoLanguage&IMG=1Y9U[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	3314D58A80727AA1AC1F31A158980EDF	ACE9AB39B857BA7DD80AE327944C02AB3339A86F	8B90E0F5E3058019CF92317CAF6B99735678DC05987924379F49E65283FBF11A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\location[1].js	ASCII text, with no line terminators	C4F67A4EFC37372559CD375AA74454A3	2B7303240D7CBEF2B7B9F3D22D306CC04CBFBE56	C72856B40493B0C4A9FC25F80A10DFBF268B23B30A07D18AF4783017F54165DE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\4996b9[1].woff	Web Open Font Format, TrueType, length 45633, version 1.0	A92232F513DC07C229DDFA3DE4979FBA	EB6E465AE947709D5215269076F99766B53AE3D1	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AA7XCQ3[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	C9E843CDDAD2F56F8F88B8D6A937B602	EE3382E8031321B266BA31CA47D0667F03C469F8	D0A577DFBCF142D19E89E5ABC3EEC3020AD0C3A65B9BA6F6534097D0806B2100
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB14EN7h[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3	A1ED4EB0C8FE2739CE3CB55E84DBD10F	7A185F8FF5FF1EC11744B44C8D7F8152F03540D5	17917B48CF2575A9EA5F845D8221BFBC2BA2C039B2F3916A3842ECF101758CCB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB14hq0P[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	01269B6BB16F7D4753894C9DC4E35D8C	B3EBFE430E1BBC0C951F6B7FB5662FEB69F53DEE	D3E92DB7FBE8DF1B9EA32892AD81853065AD2A68C80C50FB335363A5F24D227D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1euq7p[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	FB2FDFEE3C8EF880477D06B3C18B0B75	E3B63030A5D7198E7978EFA7579AF8CAAC4C061B	4B1E533F6D0BB2883FAA6489CCE2B4DA4CBFB27740F5D6471FE5E52AF853FC97
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1f7OLm[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	433F57059CC321FD80F6C3B26A07B1B4	2147C86C8949007878E317DFC45F65F3CC1D4C3A	E07D4117EC9F4FDECE98ED1C7922826477EB25EF531C8980C0B1D3E9FF83C1CD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1ftEY0[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	7FBE5C45678D25895F86E36149E83534	173D85747B8724B1C78ABB8223542C2D741F77A9	9E32BF7E8805F283D02E5976C2894072AC37687E3C7090552529C9F8EF4DB7C6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1giT7t[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	D69BC09661A27A5A7B79526DA478D551	483C2A8A4A0D8F87E1098893A04ECFBD87BEE655	295ED5C36B1834E3E664C20CF6321A044CE1F829BD496EA0A126AE8FFB4F903F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1gjbGn[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	9263BA9CB4A65059F6E1B9DF6E139457	00C7F54C7055AD1AF1F0622B5FC7A1D9DEFC5AB5	9A1431C5502D0049A0E5BCF90A283BBEDB3608672D7AF5BFB038D67461CEDDF5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1gjc8i[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	76B85024C4B3C6D83C7D41291DE5AC9A	D2703EDF39078D752A98C3124B251C1D54E8FB13	388A58073E04ECE6700BA6053E2C5A7EB2CC1CA93E5C466654056A19427875B2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1gjecu[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	6D59CF8985970F442AD3580445FC48A0	2416FBF574C4037CF4DA8698385B708004CB839F	322DED403DA80A750A4E30B0049B69C390081DAA1894FFDED2067EDBC4CC0237
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1gjf9R[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	50130BD880A8CEB9225023DDC99F1C37	91B1DF0B101013645F74CE0C194D3B3CDE4E32A5	FAB96CF5CAADC387D4AC5E70E1B9A91F19BB58986AFDD88CCD63576FB3D9C395
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1gjjIU[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	D190FB3CE6ED34444F505832F7E8387F	153CF1CE6BE0EF3FBEDE35A85CDC5A925081E3E7	A2CBAEF3957F56B57A52DF7CC2AD045C32DDA59B7092A56EF7E19D74787385B6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1gjxbH[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	44017601A8E8B0A313285473C7F379E7	FF529A32721B04474672F46C1032C67BDDD4738D	E36920A8C4A4B027699BE5005B11E91E8526659504EAAC0397395E04CF47A6A7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB7gRE[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	307888C0F03ED874ED5C1D0988888311	D6FB271D70665455A0928A93D2ABD9D9C0F4E309	D59C8ADBE1776B26EB3A85630198D841F1A1B813D02A6D458AF19E9AAD07B29F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBK9Hzy[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	4F50C6271B3DF24A75AD8E9822453DA3	F8987C61D1C2D2EC12D23439802D47D43FED3BDF	9AE6A4C5EF55043F07D888AB192D82BB95D38FA54BB3D41F701863239E16E21C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBRUB0d[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	C090E4C7C513884E6B10030FCE2F2B37	2BE9AD7D8CE94A585F0EA58DBC0B0A9A9933E854	C18187F3EF7089F6EA948C35797228FC4DFD3F90DBD2E78E531C6D2A92740471
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBY7ARN[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	30801A14BDC1842F543DA129067EA9D8	1900A9E6E1FA79FE3DF5EC8B77A6A24BD9F5FD7F	70BB586490198437FFE06C1F44700A2171290B4D2F2F5B6F3E5037EAEBC968A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBnYSFZ[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	CA188779452FF7790C6D312829EEE284	076DF7DE6D49A434BBCB5D88B88468255A739F53	D30AB7B54AA074DE5E221FE11531FD7528D9EEEAA870A3551F36CB652821292F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\a5ea21[1].ico	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	84CC977D0EB148166481B01D8418E375	00E2461BCD67D7BA511DB230415000AEFBD30D2D	BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\auction[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	E9ABC11CD03DD4AFFEB1D741CA54B4ED	F8D36F69A309D282C16EAD121099536873649AFE	1902C9B0CAE7C95886AD653E32C0DAEAB6540EC477E672287F6A9674DEEAB716
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\cfdbd9[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	FE5E6684967766FF6A8AC57500502910	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\medianet[1].htm	HTML document, ASCII text, with very long lines	CFB27C525FEEB3B333CC0AAF2A6D8897	2E70C0CCAD9B890A39C94D30E6B872EFF9CCDA40	6F8E5079BBBC25375C8D4CA4FB7622092FB352E73D6E34B9BCA156DF13C004B2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\medianet[2].htm	HTML document, ASCII text, with very long lines	14C8C7585D4E5723F093ECE8130383C5	6D4AA382CC99C170B2FD08F2D3BBFF62AEC3E68E	EFFCBFDD0DDE79F4C47E4F0BA416A19510923B751531815E21D68E83CCA850AB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otBannerSdk[1].js	ASCII text, with very long lines, with CRLF line terminators	2E5F92E8C8983AA13AA99F443965BB7D	D80209C734F458ABA811737C49E0A1EAF75F9BCA	11D9CC951D602A168BD260809B0FA200D645409B6250BD8E8996882EBE3F5A9D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otPcCenter[1].json	ASCII text, with very long lines, with CRLF line terminators	8EC5B25A65A667DB4AC3872793B7ACD2	6B67117F21B0EF4B08FE81EF482B888396BBB805	F6744A2452B9B3C019786704163C9E6B3C04F3677A7251751AEFD4E6A556B988
C:\Users\user\AppData\Local\Temp\~DF1A6527D10E172B52.TMP	data	6B2DC5C0CD8ACD2CB3660C0A7750992D	6603EB293EEC9E05A341D82D42FBA2CACE975358	40557285FBED75215D2CA46BFA4CE991DFD42C06B02FA62EF149D4A2B3AB9086
C:\Users\user\AppData\Local\Temp\~DF5565AF582ADEA16F.TMP	data	5E806DFBA9772D681E7BCCF32097164E	DEF45C49DB4F6487770847428A7B1B3B420C35AA	12F212DAD814CD9D42216A5A5872A68D641797B6ED5ABDA65E796310685BADDC

AV Detection:

Machine Learning detection for sample

Source: 6a9b0000.da.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 6a9b0000.da.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49758 version: TLS 1.2

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.20.184.68 104.20.184.68
Source: Joe Sandbox View	IP Address: 151.101.1.44 151.101.1.44

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Found strings which match to known social media urls

Source: de-ch[1].htm.8.dr	String found in binary or memory: <a href="https://www.facebook.com/" target="_blank" data-piitxt="facebooklite" piiurl="https://www.facebook.com/"> equals www.facebook.com (Facebook)
Source: msapplication.xml0.6.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x0b4c4bfa,0x01d7407b</date><accdate>0x0b4c4bfa,0x01d7407b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.6.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x0b4c4bfa,0x01d7407b</date><accdate>0x0b4c4bfa,0x01d7407b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.6.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x0b511095,0x01d7407b</date><accdate>0x0b511095,0x01d7407b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.6.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x0b511095,0x01d7407b</date><accdate>0x0b511095,0x01d7407b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.6.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x0b53730d,0x01d7407b</date><accdate>0x0b53730d,0x01d7407b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.6.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x0b53730d,0x01d7407b</date><accdate>0x0b53730d,0x01d7407b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.8.dr	String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="https://www.bing.com" /><link rel="preconnect" href="//web.vortex.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="https://www.bing.com" /><link rel="dns-prefetch" href="//web.vortex.data.msn.com" /><link rel="canonical" href="https://www.msn.com/de-ch/" /><meta name="msapplication-TileColor" content="#224f7b"/><meta name="msapplication-TileImage" content="//static-global-s-msn-com.akamaized.net/hp-neu/sc/1f/08ced4.png"/><meta name="msapplication-config" content="none"/> <title>MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: glich.",errorFooterText:"Zu Twitter wechseln",taskLinks:"Benachrichtigungen|https://twitter.com/i/notifications;Ich|#;Abmelden|#"}],xbox:[{header:"Spotlight",content:"",footerText:"Alle anzeigen",footerUrl:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"},{header:"Meine tolle Wiedergabeliste",headerUrl:"https://aka.ms/qeqf5y",content:"",errorMessage:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"}],bingrewards:[{header:"Pr equals www.twitter.com (Twitter)
Source: de-ch[1].htm.8.dr	String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"&nbsp;&nbsp;&nbsp;Ref 2: "+e.html(t.clientSettings.sid||"000000")+"&nbsp;&nbsp;&nbsp;Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console||{}).timeStamp?console.timeStamp(n):(r.performance||{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 72em)",size3column:"(min-width: 52.313em) and (max-width: 71.99em)",size2column:"(min-width: 43.75em) and (max-width: 52.303em)",size2rowsize4column:"(min-width: 72em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 52.303em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 72em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 52.303em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="https://www.msn.com/de-ch"/><meta property="og:url" content="https://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.facebook.com (Facebook)
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.twitter.com (Twitter)
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: ter erneut.",viewInboxErrorMessage:"Wenn beim Anzeigen Ihres Posteingangs weiterhin ein Problem auftritt, besuchen Sie",taskLinks:"Verfassen|https://outlook.live.com/mail/deeplink/compose;Kalender|https://outlook.live.com/calendar",piiText:"Read Outlook Email",piiUrl:"http://www.hotmail.msn.com/pii/ReadOutlookEmail/"}],office:[{header:"Office",content:"Zeigen Sie Ihre zuletzt verwendeten Dokumente an oder erstellen Sie kostenlos mit Office Online ein neues.",footerText:"Anmelden",footerUrl:"[[signin]]",ssoAutoRefresh:!0,taskLinks:"Word Online|https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel Online|https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway|https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoint Online|https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site"},{header:"Aktuelle Dokumente",headerUrl:"https://onedrive.live.com/#qt=mru",content:"Wird geladen ...",noContent:"Dieser Ordner ist leer. Klicken Sie unten, um ein neues Dokument zu erstellen.",errorMessage:"Keine Verbindung mit Office Online m equals www.hotmail.com (Hotmail)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.msn.com

URLs found in memory or binary data

Source: de-ch[1].htm.8.dr	String found in binary or memory: http://ogp.me/ns#
Source: de-ch[1].htm.8.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: auction[1].htm.8.dr	String found in binary or memory: http://popup.taboola.com/german
Source: {34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat.6.dr	String found in binary or memory: http://searchads.msn.net/.cfm?&&kp=1&
Source: msapplication.xml.6.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.6.dr	String found in binary or memory: http://www.google.com/
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: http://www.hotmail.msn.com/pii/ReadOutlookEmail/
Source: msapplication.xml2.6.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.6.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.6.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.6.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.6.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.6.dr	String found in binary or memory: http://www.youtube.com/
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://amzn.to/2TTxhNg
Source: auction[1].htm.8.dr	String found in binary or memory: https://api.taboola.com/2.0/json/msn-ch-de-home/recommendations.notify-click?app.type=desktop&ap
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://apps.apple.com/ch/app/microsoft-news/id945416273?pt=80423&ct=prime_footer&mt=8
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.8.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.8.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.8.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://client-s.gateway.messenger.live.com
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://clk.tradedoubler.com/click?p=245744&a=3064090&g=21863656
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24903118&epi=ch-de
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24952290&epi=dech
Source: {34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat.6.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&http
Source: {34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: {34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.8.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: auction[1].htm.8.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1620055092&rver
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1620055092&rver=7.0.6730.0&am
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://login.live.com/logout.srf?ct=1620055093&rver=7.0.6730.0&lc=1033&id=1184&lru=
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&rpsnv=13&ct=1620055092&rver=7.0.6730.0&w
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://login.skype.com/login/oauth/microsoft?client_id=738133
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com/#qt=mru
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com/?qt=allmyphotos;Aktuelle
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;Aktuelle
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;OneDrive-App
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com/about/en/download/
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com;Fotos
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com;OneDrive-App
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://outlook.com/
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://outlook.live.com/calendar
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://outlook.live.com/mail/deeplink/compose;Kalender
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
Source: {34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat.6.dr	String found in binary or memory: https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/de-ch/homepage/api/modules/cdnfetch"
Source: imagestore.dat.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB12jAN6.img?h=27&
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1gjiCF.img?h=368&amp
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://support.skype.com
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/en-us?"
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://twitter.com/
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://twitter.com/i/notifications;Ich
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-ss&ued=htt
Source: iab2Data[1].json.8.dr	String found in binary or memory: https://www.bidstack.com/privacy-policy/
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/
Source: {34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat.6.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
Source: {34BD59B0-AC6E-11EB-90E4-ECF4BB862DED}.dat.6.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehpz
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/modules/fetch"
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata"
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/coronareisen
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/regional
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/bezirksgericht-meilen-verurteilt-it-manager-wegen-
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/die-b%c3%a4der-%c3%b6ffnen-in-z%c3%bcrich-ihre-tor
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/hacker-kapern-urs-neuhausers-firma-mitten-in-der-n
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/live-1-mai-im-zeichen-von-corona-vereinzelt-aufgeh
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/arbeiter-und-polizei-%c3%bcberw%c3%a4ltigen-mutmasslichen-t%c3%
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/ein-fcz-befreiungsschlag-mit-einem-hauch-von-tr%c3%a4nengas/ar-
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/gericht-sagt-es-war-mord-ehemann-im-meilemer-prozess-verurteilt
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/hammer-und-kesseln-der-z%c3%bcrcher-1-mai-in-bilder/ar-BB1gg2h7
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/journalistenverb%c3%a4nde-kritisieren-z%c3%bcrcher-stadtpolizei
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/z%c3%bcrcher-polizei-setzt-gummischrot-gegen-fcz-fans-ein/ar-BB
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.msn.com?form=MY01O4&OCID=MY01O4
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_shop_de&utm
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.skype.com/
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://www.skype.com/de
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://www.skype.com/de/download-skype
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=
Source: de-ch[1].htm.8.dr	String found in binary or memory: https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
Source: iab2Data[1].json.8.dr	String found in binary or memory: https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
Source: iab2Data[1].json.8.dr	String found in binary or memory: https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html
Source: 52-478955-68ddb2ab[1].js.8.dr	String found in binary or memory: https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.3:49758 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match

File source: 6a9b0000.da.dll, type: SAMPLE

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match

File source: 6a9b0000.da.dll, type: SAMPLE

System Summary:

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Uses 32bit PE files

Source: 6a9b0000.da.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: 6a9b0000.da.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal52.troj.winDLL@13/125@9/3

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF1A6527D10E172B52.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: 6a9b0000.da.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6a9b0000.da.dll',#1

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\6a9b0000.da.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\6a9b0000.da.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\6a9b0000.da.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6a9b0000.da.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6a9b0000.da.dll,DllRegisterServer
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6536 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\6a9b0000.da.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\6a9b0000.da.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6a9b0000.da.dll,DllRegisterServer			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6a9b0000.da.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6536 CREDAT:17410 /prefetch:2			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE file has a high image base, often used for DLLs

Source: 6a9b0000.da.dll

Static PE information: Image base 0x6a9b0000 > 0x60000000

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Registers a DLL

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\6a9b0000.da.dll

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match

File source: 6a9b0000.da.dll, type: SAMPLE

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains medium sleeps (>= 30s)

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6a9b0000.da.dll',#1

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match

File source: 6a9b0000.da.dll, type: SAMPLE

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match

File source: 6a9b0000.da.dll, type: SAMPLE