Analysis Report 6ccd0000.bilper.dll

ID:	403751
Product:	CloudBasic
Start time:	11:36:28
Start date:	04.05.2021
Sample:	6ccd0000.bilper.dll
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	434b3d419af30403f6679f0578e9ed44
SHA1:	089b875bca3e06156cdf0166896b2f1a9f64de58
SHA256:	35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92
Filetype:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\www.msn[2].xml	ASCII text, with no line terminators	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\contextual.media[1].xml	ASCII text, with very long lines, with no line terminators	A495A0DD35608CA74628B75B5C846119	59B1AB60BEA6168FB143D859820A43EDC936B5A9	529F6731E065B5007A7817AD33301CDEC103B55218A197DC08A83B72E66A8AA5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{51398716-ACBC-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	288E484D0E0A79F38149118C06BABE47	0964ABDA9BBDCF02EC5AC49875430796811C81CA	072F71996DE7054D647D050353DFB93977A738BE1DE7E9B6132B3984A8C6089E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{51398718-ACBC-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	5C82944AC124E604661CEA5FB52A3099	0FDD9B300BB3F71D8F8B438E2EBD924B4639206D	425D728AABFC5FEEAEE3D6C64B9DEF471BCE27C4FECF3E4D0117B4BB7949E362
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	782EE599C942DE1CDD3D0B515DE22BD2	35A97738144428A141D9480D3B5A8569ACDF1834	87656B3D3F050A01FB6E3CBFD82C25074B9F78D28DF0DE3C8B45BD509362B59A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	1B21E2E2447DA002833E50A44682F6CD	DBC3A2AD19C324B606B747BCD960F021DD32A9CD	0DEE6656B3551769F0E337859BF5AC485522819C0560186B45B3B593A34AC937
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	FC41FE624EBD7B9514922F0086115B4F	E3E51FE998329EEEB6DF08C567EB794A56DC3391	284A77C014238430AE2DE3CE2E50EE878B5F8F595B167C6B6F023FC41EE82A0D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	EEDCD2E26B959D3A98E795875BA48360	92B955FA207FACF8B431A0C59C4C066BF9898EE2	EB3C88F809E9092596D2BC613B952F472DE5E5E3531DD1F8C0653E883CD3B28A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	E14F63EF5B11B9F8F6D5A3B5EC0E9F40	5BD93BCC872A92A3606D39AB8680455EB7636A1B	44BC13E758C72BD505F9A5D26C10ED7187715E95DCC756CFD58CC5B0402782FE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	5CDA5F5C2A27DC0593A0DEEA5D63A815	821EF7F1172C50827FD9B55803022A9CD0829CF4	DA99DE6C35C495B7A118A24EFE8D99C4170CEACA0FD39512A04E3896567C1C21
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	BEE429304D6241BAC482F1E1A493DF04	EA33CBFEFB71ECC9BC308AED9EC187FF7035963D	7AB201C3062EB60B77D58E3134D076C24777C0907B408F5E0AC05A363A056DD1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	E2B296FFC8AFA267C72C36C7A716BF87	0CAFF876BBA377C45E7198E6FE4F9DAE24D63558	5E83FA2516D31E791FFC9C20756007862652B6F7FD508146B7CA2B689ADC0ED3
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	39464A9615168CEB792B71D40D0645CA	1CA813B7B6C7B2D327CA1F81F9C8273C9786052F	BF084388C3CA8098A16EA0BA29198E51D1987EEC114789ED8E084E8113576F63
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	40A58C93FF40E60480B37466852DE8C6	BED5BE127686BFDDC53D1B1647840B1F207BDCF6	BC37A56C243216750B055D5443E621F00F84E90C0E95EF15A16F5FE818A4113D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\52-478955-68ddb2ab[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	7C41BB68E5BD26DEDF185AF1EFF5559C	6CA6B34101AF0C4DF59948433602A4891482C5B2	03F0FF3B5BC8A29DF664F6DDB1DCFA608E18972E1CDC04A17DCA4DC45A5348E3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\AAzjSw3[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	2DF6E53A33E3D7D2E401F9FD0B723221	C2E3B5A6FF363BBD31CC6E39CEEC10B67BBBB9E9	3484DE1DF304502392D694F16B843B7E1FF5C3F2FF88C6BCB30B195F34F8AEF3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB14EN7h[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3	A1ED4EB0C8FE2739CE3CB55E84DBD10F	7A185F8FF5FF1EC11744B44C8D7F8152F03540D5	17917B48CF2575A9EA5F845D8221BFBC2BA2C039B2F3916A3842ECF101758CCB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB14hq0P[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	01269B6BB16F7D4753894C9DC4E35D8C	B3EBFE430E1BBC0C951F6B7FB5662FEB69F53DEE	D3E92DB7FBE8DF1B9EA32892AD81853065AD2A68C80C50FB335363A5F24D227D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB15AQNm[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3	C701BB9A16E05B549DA89DF384ED874D	61F7574575B318BDBE0BADB5942387A65CAB213C	445339480FB2AE6C73FF3A11F9F9F3902588BFB8093D5CC8EF60AF8EF9C43B35
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1dCSOZ[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	5F25361D8730566E8A8C453E8CC1339D	CD0C5A8D20810511C42D2EB37381EA9213568EDD	7763287F5905D00A46BF4760FCF6C19E5BB0F234776BCAD174754BFBE304CF58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gbJwB[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	FEBBF3D1FB0095222441DA6D8A2AFD5B	2E7B45BEAC9D9ABCF8DE7CCEF40DA9D1A180F21D	E3A18B1CC053016756DEBA3AAB16DC8F382B4043BDBA63B7C40DC6FF33212C34
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gkGJb[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	8897926A415FC52A20D897549BDC2342	89069806087776482B430B3FE8A70F73CDC92511	F03B3C79BC72982C73A6DA9E275DBB2B2F663007BB06574FA28731C096EF90B7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gkSzr[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	18EAE260AC2B37354453D7E2CC2331A5	F5C77EF3E99EA7EEA2E32478472056D61144F1F0	1B46219EBDB7E13C3FE4C8783D11F0E03630370B3951B3429CBBD5E9546B30F0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gkXk3[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	ABEA00839C4B6973109E4261CE06FBCF	C09771BE80E7439EAF598D74F36DBA97EFD152E9	0802D8C9B04E52B5A11684DB306EB2508B891753CFCF19AF886979C43DA4A635
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gkZLA[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	FA20999894C37557ABB4F1460A2923BA	C38D6CD4E1882A8DAF759DAA236DCA2A0806471B	3622AEDDC95B4D5C9ED49B66EBB854AAEBE835FB3EE4B15C0209E5B9FBE735BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gkZod[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	8CB39F36F7157717F7D5A5B425E537E3	43A242B46F6C8E851DCB7DC0FDCAB46178DA36EA	9069847DAA9A052D9230565CF7F10705E2E0211C17B220DF0FF347419F871577
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gl6Gj[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	DF4DBDBA73B91D6DCDCA7B7F67430795	7BD59AC85B16D212DA9299A83EB2CCFECBFB8761	3A421177DF3920B44A97F805D26FF6CD8D5244DFE8AE766BFCF76E24ED87E1A9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gl8nk[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	B08F938098D9E44698A8A85EBD2B5C8B	05F01E4F3563843806CADA93036B22A8B43A9035	E2C3EFC4254758807949F6A08AC3BE0BC3C421FB803FDBDB466829905CCA8969
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gldCZ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	D19A4EB760AC5D6BA6A2404E93F09322	00F59E38B56230F9EC1074D3E6CC60DB140C598C	B7D1BBCF2CEAD3E70679530B6174439C73FE0B30760E471D5B6323A5CFEA1730
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB6Ma4a[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	6D4A6F49A9B752ED252A81E201B7DB38	765E36638581717C254DB61456060B5A3103863A	500064FB54947219AB4D34F963068E2DE52647CF74A03943A63DC5A51847F588
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BBOLLMj[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	389EDE7DC948BF40B43FD584D073E09A	38BBD243C4EFE9EC08196B8F6C73EAE7FC0FEB6C	310B239FF52F2F062FA08557B432137463F76AD581D02AC92F4C028A973AF598
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\a087b85d-b587-4286-b0ee-078d1c9a0535[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3	D935CD39075F90157D65A5A9082ED94E	51B465B473024C1FC2BC0DFE7CFC094B21BFC0E6	CA7F6E7B3A18A5F6A2165228825111D7F13945EC70DB0125C281C3E455E88380
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\a8a064[1].gif	GIF image data, version 89a, 28 x 28	3CC1C4952C8DC47B76BE62DC076CE3EB	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\aadcdc47-f267-4b70-bc4e-4fdd88f9ef0d[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3	E9E825E00F041F68940194D990C3D152	C0D692BED47D6345932A1E8B622D43E921BDC131	BE80D5211A90B4CA5E7D635C5657F8353514B9DB21709272938A1BA9290E3F71
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-2.1.1.min[1].js	ASCII text, with very long lines, with CRLF line terminators	9A094379D98C6458D480AD5A51C4AA27	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\location[1].js	ASCII text, with no line terminators	C4F67A4EFC37372559CD375AA74454A3	2B7303240D7CBEF2B7B9F3D22D306CC04CBFBE56	C72856B40493B0C4A9FC25F80A10DFBF268B23B30A07D18AF4783017F54165DE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\medianet[1].htm	HTML document, ASCII text, with very long lines	0694B49A61DCF48FD48E1CEEF1DA88FF	18A9069E2057DE9B8E83D1149926AE8AF8601602	976CF9461FDBD56B4F9C1000DFA0137A212D8A13AC377EEF16CAB911626F696F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\medianet[2].htm	HTML document, ASCII text, with very long lines	7786A40B5A07ABE12642DD7D85EB8941	6528E4327A9C7CF4520597F4E7AF95EDF6CB69E0	291DA39F830DDC647BBEF39BCC5C83F0CF741AFEDB675C58143B3F44D823D9FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\otFlat[1].json	ASCII text, with very long lines, with CRLF line terminators	A7049025D23AEC458F406F190D31D68C	450BC57E9C44FB45AD7DC826EB523E85B9E05944	101077328E77440ADEE7E27FC9A0A78DEB3EA880426DFFFDA70237CE413388A5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\17-361657-68ddb2ab[1].js	ASCII text, with very long lines, with no line terminators	7ADA9104CCDE3FDFB92233C8D389C582	4E5BA29703A7329EC3B63192DE30451272348E0D	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\2d-0e97d4-185735b[1].css	UTF-8 Unicode text, with very long lines	DF1D314E447BB8D3FFDA218389306E8F	EF706994A0807683901AD3D8E81A7F49E50689DE	70EB7CE2E6CBE8A06F08AA25924EC3A2FB9E9E21191CDABCAEC6BE95CFB462F7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AA6wTdK[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	91EE9ECB5C9196CBD18EE4E9C41F94B5	F829201477F63B908789BB895823E5A4D16ABBD7	2BA5AC02E5C6AE8D5BBD3D8C0CD5603A02A67E192394813514D151AE1D6988B6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AA7XCQ3[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	39A731ECC72F3534D3D6DCDF6A955356	FD41CA7E9E5BC622E56D5EBB52B5BF69AAE00B4D	44B36738314CF8973E3FE322854B200F90B1445DF09FCBB1D41B00E3CFB9FF1E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AAyuliQ[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	8BE25BB557B3A41867C301BE4A5E5CF0	0E61854C405F4827FC034698BB84D536B3D6A6F2	A7074994D0ED3600F3F7B6388C0D093A5DB7E619C1470148567B8AF88F4D4331
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB10MkbM[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	569B24D6D28091EA1F76257B76653A4E	21B929E4CD215212572753F22E2A534A699F34BE	85A236938E00293C63276F2E4949CD51DFF8F37DE95466AD1A571AC8954DB571
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1fV7TT[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	1F5E96EF855819B42F7D6A60DADF208C	B37C9BC31B12B9C6F017C98353DC0A34E7A3DB29	6BE2705D2AA6C0B59E7D280B8DC6464F3E9FB7A9857F4193B5941FD749DDD31F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1ftEY0[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	7FBE5C45678D25895F86E36149E83534	173D85747B8724B1C78ABB8223542C2D741F77A9	9E32BF7E8805F283D02E5976C2894072AC37687E3C7090552529C9F8EF4DB7C6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gj4Xc[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	94F45166BBA1C6FC797C1A6C8054F0B0	1FFBD8A7684C8478EF853846F0ABDCEA11C55202	01AF9D709D9403B94BF0C2366929966EFB9F88429B1FD471B170F9BD54819562
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gkSmD[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	F0BD71441DA3D2F0B7D4D3A738FDC290	AA8DB5B279660D226ADD6858B6EC3C831E3EED98	ECBC9F1413A56554275F635135138BE3129D62F33BD8C0995F13D2EFDB1586C2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gkVaQ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	4F1E29B6ED14AB059A88A2A019446184	E084A4387C2050E3F8F5B8B0C9D1E8E7896FEA19	35352BE1AD8D98F8BDB708BF78E9E925074D2A6EC2BA73F0D2A8092B889AA99F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gl13k[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3	0F7373B5B3094B6EFD9CCAEF97E7DDFF	9CADACC076D3AF0E05BAF7E8B4798B8FBE101B75	CA2C16AC4523E63307DE83A181762D11E1B6E9CD0B4A8F6DC06146E28E7C10AF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gl258[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	36C873F1D5EDE814BB77E9D19BB8F184	1883F48F4AB82A6B09615A7B1BC691D3D7C3BF73	056B57CC4241BC37FE5842BCE3DBB690A9A9DB502726280A952E8AEFFB3B4A45
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gl3Yj[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	96062F312D1CF6021BFE06A5BDECB195	84FE972D5EF7D3A76050F4CC4DC18C630FBF72BE	D23E14FE3EED58AD842509934DB965EBFB81F29494E9481F0583AADDDEC9C165
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gl8uZ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3	1AAA0DB9125990AC644FC0FEE27891EA	B03F7DCC2F2FBD15FBA55D33E2C5D0442C477F59	1256B5B4B43685934374285C894DA904ACCA658BD658BA0172AE7472B4F85BA2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1glbdN[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	31A53B52A60A15DDC5310FB8EDD5D200	16A9DA0A5A8B62FA6BCB4587611485B97FB39697	E05F2A118C93E65B141812342F6EC3F820B6B3ECBE460E02736B2795FD1C6231
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1gldiI[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	B1027E598EFF52CF432AA7B5474F7D5A	968DBE4AE3A16B3685DB6EEDD369F5687AAF3BFD	896B5E8D40169B79D2AA47BC926509DA39A3079ADE8BEB6E5F071E1446877C49
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB7hg4[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	A4F438CAD14E0E2CA9EEC23174BBD16A	41FC65053363E0EEE16DD286C60BEDE6698D96B3	9D9BCADE7A7F486C0C652C0632F9846FCFD3CC64FEF87E5C4412C677C854E389
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BBY7ARN[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	30801A14BDC1842F543DA129067EA9D8	1900A9E6E1FA79FE3DF5EC8B77A6A24BD9F5FD7F	70BB586490198437FFE06C1F44700A2171290B4D2F2F5B6F3E5037EAEBC968A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BBnYSFZ[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	CA188779452FF7790C6D312829EEE284	076DF7DE6D49A434BBCB5D88B88468255A739F53	D30AB7B54AA074DE5E221FE11531FD7528D9EEEAA870A3551F36CB652821292F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cfdbd9[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	FE5E6684967766FF6A8AC57500502910	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\checksync[1].htm	HTML document, ASCII text, with very long lines	972A2050A055B8116639921143B38E62	5897DD7D71C683E302BA4844F70B61473F2AB68F	39D8630B2A8A8B682ADCC81451E958DCD19FE16E36632A131CF355E678AFD440
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\checksync[2].htm	HTML document, ASCII text, with very long lines	972A2050A055B8116639921143B38E62	5897DD7D71C683E302BA4844F70B61473F2AB68F	39D8630B2A8A8B682ADCC81451E958DCD19FE16E36632A131CF355E678AFD440
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\de-ch[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	15BCB7BBE03E5ABCE3162F71DADD8D63	2EF0AB2CC332049F5C79A7E088BD877759E93993	5004E4E24FE7DCD410FE6274C514A5E49984353512A1FB0F962812065C6A381B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fcmain[1].js	HTML document, ASCII text, with very long lines, with no line terminators	0D23F2702230D784F4921BD93AB5C26A	7A629F5AB8AB7435BE94F7F4786AC91140D8AAED	CFBD7954C6C84944C2991A6E8775EA2B927F4FC2107258302FB9A32401D1217F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\iab2Data[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	D76FFE379391B1C7EE0773A842843B7E	772ED93B31A368AE8548D22E72DDE24BB6E3855C	D0EB78606C49FCD41E2032EC6CC6A985041587AAEE3AE15B6D3B693A924F08F2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1599143076228-3140[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 622x367, frames 3	F3180397D72506DB4850AE4E5ED18D2E	952C7BDAF0749E7185C18155DB47BFB8F49A1438	9EC0A7096E257207345CC6FA2DD1594666EBBDBF59A1D74841C3021E82B0C010
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\AAuTnto[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1472AF1857C95AC2B14A1FE6127AFC4E	D419586293B44B4824C41D48D341BD6770BAFC2C	67254D5EFB62D39EF98DD00D289731DE8072ED29F47C15E9E0ED3F9CEDB14942
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1bjIri[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	3B314000AFDDE971D621BDA8F157A7D1	0C47A815AFBBB8F7F56822CC435E9361B81EFEEC	591BD3A01A2D82A610AF02075CD8E7D127762CB70AC686DF3AF901DD1EE96299
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1cEP3G[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	18851868AB0A4685C26E2D4C2491B580	0B61A83E40981F65E8317F5C4A5C5087634B465F	C7F0A19554EC6EA6E3C9BD09F3C662C78DC1BF501EBB47287DED74D82AFD1F72
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1cG73h[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	D1495662336B0F1575134D32AF5D670A	EF841C80BB68056D4EF872C3815B33F147CA31A8	8AD6ADB61B38AFF497F2EEB25D22DB30F25DE67D97A61DC6B050BB40A09ACD76
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1gj6Xu[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	9065BD7E7EB0DE072365E09B6166F490	391BA5B576F6E68FBE3E3749245769C106A20143	2B11EAC9275DF720A554E41E17E8D0627EA71867B93630CE4A2A90B4CF15CBF5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1gkM5V[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	9B15042D7683E282A4FA7BB0A1A6E28D	967606360F604EC06801233F17059E0072FBF28E	538CB857CBC22349A8AD68D26F69F005B4322BF40967C545FF2E58AB2485B01F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1gkXm3[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	D1A87F3967A7E6D7AA42661A229EF9FD	602ED33683312E4B3ADCCC5757F287E62FC3CE5A	D68D7001A9ADF6526155ED0ED5A04A44788E250DE5C0395C3DEA77ECF4571C90
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1gl3CU[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	06BA7E0583794F9EAE56D08648185C77	D75255CA09B1BE38844B8F72FD5E640A7F33C546	F2D4D064CA3E91418CA6F1F3D36911CDC2EE0F6C6E773AB7D256D9744AA7B8EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1gl3fv[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	1EFA305CF4914AB5FF952B06FCC0673A	24A2F47B7DE02107F6732F2AAB2281BA6AC769E4	8FE76DD383F4C147B8BD8CCFF58DEAFBBF3A4501FD23EE796024486723268076
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1gl3iX[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	D78B890620E702F0725CAEDBDA73B1D2	331436848A642FA3F5D04A29EF39561913DFA8AB	583121F39C64315F9A88F70549341147036703A492FBC4DFF673CDB74CAD2013
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB1gl8q9[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	7C1B5696BE15D345433B2130DA1E2861	0D01C854AABFDD6EE91E1CB7A385644D0340A715	6C9E7FBAFBC67633A0CA570B5137C00337484093361CDA0841229CF67A785FA0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BB5kTiV[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	10ADF331F5D133B42D542F39E2A1390E	D0EEA0DEE8B46CB250E303BC1AA6C01EDFEF590C	AD4808FAC10A5F71AAC3B93BBB0D29D575CEFF5609CEC3886C079F542F455D33
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BBK9Ri5[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	3C1367514C52C7FA2A6B2322096AA4C1	25104E643189C1457A3916E38D7500A48FEEC77C	6FAD7471DE7E6CD862193B98452DED4E71F617CDC241AFBCF372235B89F925CC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BBUZVvV[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	16B34C1836A5FC244145527EC79361D4	18CB908457B380545D89D8A4D3F91CDABF3ADC78	DB797DF4F1E320C21BD6019E89E6CCC5569C5CED57E1D3BDD736F3B4A9371BC0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BBVuddh[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	636BACD8AA35BA805314755511D4CE04	9BB424A02481910CE3EE30ABDA54304D90D51CA9	157ED39615FC4B4BDB7E0D2CC541B3E0813A9C539D6615DB97420105AA6658E3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BBX2afX[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	4AAAEC9CA6F651BE6C54B005E92EA928	7296EC91AC01A8C127CD5B032A26BBC0B64E1451	90396DF05C94DD44E772B064FF77BC1E27B5025AB9C21CE748A717380D4620DD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BBih5H[1].png	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	F1AEB21B524DE2509415284BB45C9D1B	9C5D17A573FE2DC2ACB2729381BC777C9C8474A3	EFD678CBFA67BBD38DCF9BFBDBA90804EA2425B93F0A7447DACA21F9ECCCD458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\checksync[1].htm	HTML document, ASCII text, with very long lines	972A2050A055B8116639921143B38E62	5897DD7D71C683E302BA4844F70B61473F2AB68F	39D8630B2A8A8B682ADCC81451E958DCD19FE16E36632A131CF355E678AFD440
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\checksync[2].htm	HTML document, ASCII text, with very long lines	972A2050A055B8116639921143B38E62	5897DD7D71C683E302BA4844F70B61473F2AB68F	39D8630B2A8A8B682ADCC81451E958DCD19FE16E36632A131CF355E678AFD440
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\e151e5[1].gif	GIF image data, version 89a, 1 x 1	F8614595FBA50D96389708A4135776E4	D456164972B508172CEE9D1CC06D1EA35CA15C21	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\http___cdn.taboola.com_libtrc_static_thumbnails_705322f466ee4e70b10d73d39074748e[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	BAAA7E036D2C2AA17EA230A3CF709974	55D26D8847212159A01C47CB11A71367ED498671	92DAA66C6F1FB1F4D59DAC2797ACC31CC45299990F3E5AA591A2B2C22BEDB5DF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\http___cdn.taboola.com_libtrc_static_thumbnails_GETTY_IMAGES_SKP_1211840846__1v9WbJ7j[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	69C43E3E110A5B4DEE987026EB1CEA9A	E0BFFF4AA2501CEA94AB16503F2D731FCA8B41B6	42B06639214E357D3F5A3A465F9D008543BCE00BB5423DE9BCE62A1682101937
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\http___cdn.taboola.com_libtrc_static_thumbnails_bca509ed102719cf60fbcdf8739ff083[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	55165082C7C20CB8FDD6D030DECD305B	15F72CBCEFB3E3712F1161B587CF08FE931DB2D2	A6AFDD8D8015A111ECED231DC5C29F1B2780C4A96F722D68581158F265451AD9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\nrrV27271[1].js	ASCII text, with very long lines, with no line terminators	556E5A5EF97F07B9E3AE70826DA3A185	B0FE2F6AEC9B462E7935709A12E882E413560711	8FE78776FCEDC916C23B2FA803A38B4D1284B4A2F87E18F13C5B1BF1C0B80394
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\otTCF-ie[1].js	UTF-8 Unicode text, with very long lines, with CRLF line terminators	52F29FAC6C1D2B0BAC8FE5D0AA2F7A15	D66C777DA4B6D1FEE86180B2B45A3954AE7E0AED	E497A9E7A9620236A9A67F77D2CDA1CC9615F508A392ECCA53F63D2C8283DC0E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\4996b9[1].woff	Web Open Font Format, TrueType, length 45633, version 1.0	A92232F513DC07C229DDFA3DE4979FBA	EB6E465AE947709D5215269076F99766B53AE3D1	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\55a804ab-e5c6-4b97-9319-86263d365d28[1].json	ASCII text, with very long lines, with no line terminators	B2B036D0AFB84E48CDB782A34C34B9D5	DFC7C8BA62D71767F2A60AED568D915D1C9F82D6	DC51F0A9F93038659B0DB1B69B69FCFB00FB5911805F8B1E40591F9867FD566F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\AA8uJZv[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	FEA69BDE242FBE97CB1966B6A75FA739	A52A58FBFBD9EF210A03E29D50F91A6F9998376A	6A9ECAA08943642416B808852B6D28F2B785044A9C00513BB91BE85BEF3B1CD5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB19K9zb[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	63A29C11EE42CFEC2D92D61C26E6CA5A	A0845DFB3410246A427E6E2DA83695E927EDAC9F	E1E5FEE98156C70C698694F0238A98F00F8DC694CF30301A8F81E45E84FA5449
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1giL6z[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	9D598913DF1314FD8A2808CD897E3920	99577FDF9DB8FC925DE792B650CEB024614BC986	332E74C89514745264BE880F0E8A3435CA30895A9C4D8B6C17366A91F7230B6A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gjf9R[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	50130BD880A8CEB9225023DDC99F1C37	91B1DF0B101013645F74CE0C194D3B3CDE4E32A5	FAB96CF5CAADC387D4AC5E70E1B9A91F19BB58986AFDD88CCD63576FB3D9C395
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gjtRw[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	54E1EF4510251B1D65F7EC4EA970DCBD	81DE50BC413F570175D337027BF8B750D5CED744	CC891CF3E3F8C432528E01C6FF743EFC06A8D9D405EFBAC00262232BDF900EE6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gkGOZ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	BCD8435153AC4C95692594E5EEEDA881	96F80948EA3B4711E69D07D5019E56FA301675D9	697FE4B3E50631B0D1DE2DF5FEAC500950B584A6778B3AB2185EA63551535F0D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gkGPP[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	84F02DE36AF191C25604ED5A0100221F	892E977FFBF50A7E4EF2474B60FD698F39E6482D	76524FD7A948116A9D1E335137A3EE1E7DBC6820134E487A35303462B9DC876C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gkUDu[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	1CEBB96E1DED12B6D86949C2D75C86C0	A9CCD51D30DB2134A816A7C5AEFDCB81A3BBCF4E	B95582763475178E1D0C6652A6015C181688D1F295F9E36AD1D5EEC6E50E06A8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gkUFI[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	257F939192E47D263F7F47932128DD81	8E886684EC83EEF428BBF3AC641C993D2271324E	B2966EABDFFE3B96EE5F9887CE4F797ABCE7AF08185F3A6C953A0DC28C818860
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gkUfy[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	2EC0EA13D7BA800870FBDCC71E237241	2E2A92A29BDBE79567BB813D4D99A6228E2E6A6A	FB621C849BE4D39EDFE94DBE679D18C1EF892AC474F15E445A030CD49A7F4781
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gkVo6[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	FC4DAE6DE09F6A8326E6D54A78460C6D	257704D14FFDB9753EB57E3B004E57EA488B47B4	E4388C133D3F14DDEACD50E91D826D1F0B45A8FFA199DAA42BE05F683D713753
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1gl8nk[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	4418CF50F43A9FFC6DFD11F9BAB3C7C7	6B88871DE65AAC08DBBFA278F1279E92C422C0D5	B9A2F7DD60EE550077867B5658279BCF08209C9112AE86451404C335ED451D03
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB5kJAC[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	BDF21ABB832EDC1A63F1FF66220D7232	B399B4B86BA1375EED9A900C073949119274E6DC	A6C9F49CD98C137EC6C05E755401E3D1D937DB260C0EF9B6B269A7E3C0BD1810
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB7gRE[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	307888C0F03ED874ED5C1D0988888311	D6FB271D70665455A0928A93D2ABD9D9C0F4E309	D59C8ADBE1776B26EB3A85630198D841F1A1B813D02A6D458AF19E9AAD07B29F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BBPfCZL[1].png	GIF image data, version 89a, 50 x 50	59DAB7927838DE6A39856EED1495701B	A80734C857BFF8FF159C1879A041C6EA2329A1FA	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BBRUB0d[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	C090E4C7C513884E6B10030FCE2F2B37	2BE9AD7D8CE94A585F0EA58DBC0B0A9A9933E854	C18187F3EF7089F6EA948C35797228FC4DFD3F90DBD2E78E531C6D2A92740471
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\a5ea21[1].ico	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	84CC977D0EB148166481B01D8418E375	00E2461BCD67D7BA511DB230415000AEFBD30D2D	BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\auction[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	7D62E371821C3444907B1420829D4836	48B735E4CC1808F5D8674898AE4DC508454B73CF	8B273FDFD36871186B55031E755A07C466E05504061BE4AF63142C25C9EAFAC2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\de-ch[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	FC2C498A7452A8A497A99451832C6B43	A5FD8194FCEC7808152C06757A5A165C96D9FB54	C54629428A1DDEA5361B109EEDD2A3C59449D20540D1D55B4E7F8E2683890064
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fcmain[1].js	HTML document, ASCII text, with very long lines, with no line terminators	C6F98CF1CA52BE067CB7E0BABB2B7DDE	C6B93C578CDD433D92AC6FB5FCF56D805BD1787A	B28114B990EA1023AA888292488E8936E21A5CF3D78856B90D513C1BFA1ABF6F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\http___cdn.taboola.com_libtrc_static_thumbnails_0b1d4ccdd763949ef17fd57fbd2ddae6[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	F854E1BD5A302563A9548E5FC9C35318	8802AEF3960366825C546003E11D24F5E9568E26	4800BA476A4EC578AC1F86B70280869237296972D2D09A35581D694918E94140
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\http___cdn.taboola.com_libtrc_static_thumbnails_1e82b6ce08a43a6c5447835aefdf3367[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	54C7D0EDB3D1B4F1928F5942AD7934AA	13ED93CE9F7ADCCFECFECE9F02E2FF8DB756F049	32579899024DF835AC6A44862107B3380C9C0B7AB36FA011C29D7396401436D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\http___cdn.taboola.com_libtrc_static_thumbnails_25d3a15e34bf9f4ad528fc533b81d965[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3	13669EFA8264EDECAAAFA6ABD96F11CB	E53F990990B49C0A4EAEA0F54FBDD37B014D3B4B	DFC4C6D8DD3DFECD0D0EE618BA46FA1D321FD1632ADB8B51BCBBDFA5CDF1286B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\otBannerSdk[1].js	ASCII text, with very long lines, with CRLF line terminators	2E5F92E8C8983AA13AA99F443965BB7D	D80209C734F458ABA811737C49E0A1EAF75F9BCA	11D9CC951D602A168BD260809B0FA200D645409B6250BD8E8996882EBE3F5A9D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\otPcCenter[1].json	ASCII text, with very long lines, with CRLF line terminators	8EC5B25A65A667DB4AC3872793B7ACD2	6B67117F21B0EF4B08FE81EF482B888396BBB805	F6744A2452B9B3C019786704163C9E6B3C04F3677A7251751AEFD4E6A556B988
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\otSDKStub[1].js	ASCII text, with very long lines, with CRLF line terminators	82566994A83436F3BDD00843109068A7	6D28B53651DA278FAE9CFBCEE1B93506A4BCD4A4	450CFBC8F3F760485FBF12B16C2E4E1E9617F5A22354337968DD661D11FFAD1D
C:\Users\user\AppData\Local\Temp\~DF541F43C609FFB7E2.TMP	data	811F8E40E1DC6E39F81828E4A2BEEE78	ED6E8A9E2F6C0447BB27843057C3DAEF17D5B956	883E103C54EC16AB06F2B347F95139E99687E4FD3085402CED82390EFEA037CD
C:\Users\user\AppData\Local\Temp\~DF89FF7A3EA7A6DAC1.TMP	data	C7C0B91F9D48F708CD6AB228D5221511	B4986C17127DEA5567B8BB03984A61EE7DA663F4	D5EC6FA3CEFF232DD9BDCC919342590FB45E37D921B531AF29622B3C0FA21593

AV Detection:

Multi AV Scanner detection for submitted file

Source: 6ccd0000.bilper.dll

ReversingLabs: Detection: 55%

Machine Learning detection for sample

Source: 6ccd0000.bilper.dll

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: 6ccd0000.bilper.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49772 version: TLS 1.2

Networking:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.20.184.68 104.20.184.68
Source: Joe Sandbox View	IP Address: 87.248.118.23 87.248.118.23

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Found strings which match to known social media urls

Source: de-ch[1].htm.7.dr	String found in binary or memory: <a href="https://www.facebook.com/" target="_blank" data-piitxt="facebooklite" piiurl="https://www.facebook.com/"> equals www.facebook.com (Facebook)
Source: msapplication.xml0.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2808b386,0x01d740c9</date><accdate>0x2808b386,0x01d740c9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x2808b386,0x01d740c9</date><accdate>0x2808b386,0x01d740c9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x280d7891,0x01d740c9</date><accdate>0x280d7891,0x01d740c9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x280d7891,0x01d740c9</date><accdate>0x280fdbf6,0x01d740c9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x280fdbf6,0x01d740c9</date><accdate>0x280fdbf6,0x01d740c9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x280fdbf6,0x01d740c9</date><accdate>0x280fdbf6,0x01d740c9</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.7.dr	String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="https://www.bing.com" /><link rel="preconnect" href="//web.vortex.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="https://www.bing.com" /><link rel="dns-prefetch" href="//web.vortex.data.msn.com" /><link rel="canonical" href="https://www.msn.com/de-ch/" /><meta name="msapplication-TileColor" content="#224f7b"/><meta name="msapplication-TileImage" content="//static-global-s-msn-com.akamaized.net/hp-neu/sc/1f/08ced4.png"/><meta name="msapplication-config" content="none"/> <title>MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: glich.",errorFooterText:"Zu Twitter wechseln",taskLinks:"Benachrichtigungen|https://twitter.com/i/notifications;Ich|#;Abmelden|#"}],xbox:[{header:"Spotlight",content:"",footerText:"Alle anzeigen",footerUrl:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"},{header:"Meine tolle Wiedergabeliste",headerUrl:"https://aka.ms/qeqf5y",content:"",errorMessage:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"}],bingrewards:[{header:"Pr equals www.twitter.com (Twitter)
Source: de-ch[1].htm.7.dr	String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"&nbsp;&nbsp;&nbsp;Ref 2: "+e.html(t.clientSettings.sid||"000000")+"&nbsp;&nbsp;&nbsp;Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console||{}).timeStamp?console.timeStamp(n):(r.performance||{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 72em)",size3column:"(min-width: 52.313em) and (max-width: 71.99em)",size2column:"(min-width: 43.75em) and (max-width: 52.303em)",size2rowsize4column:"(min-width: 72em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 52.303em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 72em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 52.303em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="https://www.msn.com/de-ch"/><meta property="og:url" content="https://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.facebook.com (Facebook)
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.twitter.com (Twitter)
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: ter erneut.",viewInboxErrorMessage:"Wenn beim Anzeigen Ihres Posteingangs weiterhin ein Problem auftritt, besuchen Sie",taskLinks:"Verfassen|https://outlook.live.com/mail/deeplink/compose;Kalender|https://outlook.live.com/calendar",piiText:"Read Outlook Email",piiUrl:"http://www.hotmail.msn.com/pii/ReadOutlookEmail/"}],office:[{header:"Office",content:"Zeigen Sie Ihre zuletzt verwendeten Dokumente an oder erstellen Sie kostenlos mit Office Online ein neues.",footerText:"Anmelden",footerUrl:"[[signin]]",ssoAutoRefresh:!0,taskLinks:"Word Online|https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel Online|https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway|https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoint Online|https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site"},{header:"Aktuelle Dokumente",headerUrl:"https://onedrive.live.com/#qt=mru",content:"Wird geladen ...",noContent:"Dieser Ordner ist leer. Klicken Sie unten, um ein neues Dokument zu erstellen.",errorMessage:"Keine Verbindung mit Office Online m equals www.hotmail.com (Hotmail)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.msn.com

URLs found in memory or binary data

Source: de-ch[1].htm.7.dr	String found in binary or memory: http://ogp.me/ns#
Source: de-ch[1].htm.7.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: auction[1].htm.7.dr	String found in binary or memory: http://popup.taboola.com/german
Source: ~DF89FF7A3EA7A6DAC1.TMP.5.dr	String found in binary or memory: http://searchads.msn.net/.cfm?&&kp=1&
Source: msapplication.xml.5.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.5.dr	String found in binary or memory: http://www.google.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: http://www.hotmail.msn.com/pii/ReadOutlookEmail/
Source: msapplication.xml2.5.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.5.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.5.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.5.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.5.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.5.dr	String found in binary or memory: http://www.youtube.com/
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://amzn.to/2TTxhNg
Source: auction[1].htm.7.dr	String found in binary or memory: https://api.taboola.com/2.0/json/msn-ch-de-home/recommendations.notify-click?app.type=desktop&ap
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://apps.apple.com/ch/app/microsoft-news/id945416273?pt=80423&ct=prime_footer&mt=8
Source: auction[1].htm.7.dr	String found in binary or memory: https://beap.gemini.yahoo.com/mbclk?bv=1.0.0&es=MbNFDAAGIS8ybfi5QcIZys3hqmOjoHRPHMH9lPtWuMt6I6Qd
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: auction[1].htm.7.dr	String found in binary or memory: https://cdn.flurry.com/adTemplates/templates/htmls/clips.html"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://client-s.gateway.messenger.live.com
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://clk.tradedoubler.com/click?p=245744&a=3064090&g=21863656
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24903118&epi=ch-de
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692
Source: ~DF89FF7A3EA7A6DAC1.TMP.5.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&http
Source: ~DF89FF7A3EA7A6DAC1.TMP.5.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: ~DF89FF7A3EA7A6DAC1.TMP.5.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: auction[1].htm.7.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: auction[1].htm.7.dr	String found in binary or memory: https://ir2.beap.gemini.yahoo.com/mbcsc?bv=1.0.0&es=fQ7kdc4GIS.xVAQOzJHbN9AmCA4x1v5rjinx8DJo92hQ
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1620121041&rver
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1620121041&rver=7.0.6730.0&am
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/logout.srf?ct=1620121042&rver=7.0.6730.0&lc=1033&id=1184&lru=
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&rpsnv=13&ct=1620121041&rver=7.0.6730.0&w
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://login.skype.com/login/oauth/microsoft?client_id=738133
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/#qt=mru
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/?qt=allmyphotos;Aktuelle
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;Aktuelle
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;OneDrive-App
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/about/en/download/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com;Fotos
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com;OneDrive-App
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://outlook.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://outlook.live.com/calendar
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://outlook.live.com/mail/deeplink/compose;Kalender
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
Source: auction[1].htm.7.dr	String found in binary or memory: https://policies.oath.com/us/en/oath/privacy/index.html
Source: ~DF89FF7A3EA7A6DAC1.TMP.5.dr	String found in binary or memory: https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
Source: auction[1].htm.7.dr	String found in binary or memory: https://s.yimg.com/lo/api/res/1.2/BXjlWewXmZ47HeV5NPvUYA--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
Source: auction[1].htm.7.dr	String found in binary or memory: https://srtb.msn.com:443/notify/viewedg?rid=c1e9117e385f48b69e2586dc53f89581&r=infopane&i=2&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/de-ch/homepage/api/modules/cdnfetch"
Source: imagestore.dat.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB12jAN6.img?h=27&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1gl8q9.img?h=368&amp
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://support.skype.com
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/en-us?"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://twitter.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://twitter.com/i/notifications;Ich
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-ss&ued=htt
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.bidstack.com/privacy-policy/
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/
Source: ~DF89FF7A3EA7A6DAC1.TMP.5.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/modules/fetch"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/coronareisen
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/regional
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com?form=MY01O4&OCID=MY01O4
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_shop_de&utm
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.skype.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.skype.com/de
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.skype.com/de/download-skype
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49772 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 6ccd0000.bilper.dll, type: SAMPLE
Source: Yara match	File source: 3.2.regsvr32.exe.6ccd0000.1.unpack, type: UNPACKEDPE

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 6ccd0000.bilper.dll, type: SAMPLE
Source: Yara match	File source: 3.2.regsvr32.exe.6ccd0000.1.unpack, type: UNPACKEDPE

System Summary:

Contains functionality to call native functions

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_6CCD2385 NtQueryVirtualMemory,

3_2_6CCD2385

Detected potential crypto function

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_6CCD2164

3_2_6CCD2164

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Uses 32bit PE files

Source: 6ccd0000.bilper.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: 6ccd0000.bilper.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal60.troj.winDLL@13/121@10/4

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{51398716-ACBC-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF541F43C609FFB7E2.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: 6ccd0000.bilper.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6ccd0000.bilper.dll',#1

Sample is known by Antivirus

Source: 6ccd0000.bilper.dll

ReversingLabs: Detection: 55%

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\6ccd0000.bilper.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\6ccd0000.bilper.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\6ccd0000.bilper.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6ccd0000.bilper.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6ccd0000.bilper.dll,DllRegisterServer
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5684 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\6ccd0000.bilper.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\6ccd0000.bilper.dll			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6ccd0000.bilper.dll,DllRegisterServer			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6ccd0000.bilper.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5684 CREDAT:17410 /prefetch:2			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE file has a high image base, often used for DLLs

Source: 6ccd0000.bilper.dll

Static PE information: Image base 0x6ccd0000 > 0x60000000

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_6CCD1D0F LoadLibraryA,GetProcAddress,

3_2_6CCD1D0F

Registers a DLL

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\6ccd0000.bilper.dll

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6CCD2153 push ecx; ret		3_2_6CCD2163
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6CCD2100 push ecx; ret		3_2_6CCD2109

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 6ccd0000.bilper.dll, type: SAMPLE
Source: Yara match	File source: 3.2.regsvr32.exe.6ccd0000.1.unpack, type: UNPACKEDPE

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains medium sleeps (>= 30s)

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_6CCD1D0F LoadLibraryA,GetProcAddress,

3_2_6CCD1D0F

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\6ccd0000.bilper.dll',#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: regsvr32.exe, 00000003.00000002.918491208.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: regsvr32.exe, 00000003.00000002.918491208.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000003.00000002.918491208.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: regsvr32.exe, 00000003.00000002.918491208.00000000031B0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_6CCD1745 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

3_2_6CCD1745

Contains functionality to query windows version

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_6CCD10D2 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

3_2_6CCD10D2

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 6ccd0000.bilper.dll, type: SAMPLE
Source: Yara match	File source: 3.2.regsvr32.exe.6ccd0000.1.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 6ccd0000.bilper.dll, type: SAMPLE
Source: Yara match	File source: 3.2.regsvr32.exe.6ccd0000.1.unpack, type: UNPACKEDPE