Windows Analysis Report sign.exe

ID:	531556
Product:	CloudBasic
Start time:	23:13:55
Start date:	30.11.2021
Sample:	sign.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	5ce59cd58a34bc0530e398330013ee77
SHA1:	f3b3cf03801527c24f9059f475a9d87e5392dae9
SHA256:	950ad539dfc8e16c07d24dbb37ae19daa0b2f32164ba0cb3c81fa7e689f274e1
Filetype:	Win64 Dynamic Link Library (generic) (102004/3) 86.43%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\1IJD8WQ7\contextual.media[1].xml	ASCII text, with no line terminators	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\GQTX6NA7\www.msn[1].xml	ASCII text, with no line terminators	8611D0D20D3178F4D2E4091AAA9A2F9E	5BB555BF1CC8D41F7735E3239136882533FB08E4	310CDD2A90D177BD30F51D7A99622D16D018E9DFEDA07182C5D3FEFA561E6EA5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5D0C8C95-5276-11EC-90E9-ECF4BB862DED}.dat	Composite Document File V2 Document, Cannot read section info	0448BD796DA002A62EDBEEC16AC4E008	54763F6881476047D95F5E4FC76A4CDE91C0E8CE	96A673FCDB5EE50C99116618A57FBCC43C7ABBE915C19976C29B6F1ED3D456FC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5D0C8C97-5276-11EC-90E9-ECF4BB862DED}.dat	Composite Document File V2 Document, Cannot read section info	49DE9CDE623DB1669799F7C39C7448E5	DBA45D4CC03B38829DD2471D52B1FEED69B4F7E9	78DE8BBEE9950283D8281D8E37721D80674114051D4737202CDCC8C2E070E9A8
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	6F3381105853DA7D691DFAAD96EC611E	CAB0322B06E18C884D5C9143416D10E24C60354B	77BAA26E0B0AA6413D948ED77323CE68F0DC73B8247D16D8B32966A027D0AAFA
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	3E577365975D634A8309228B46DD79C2	37DCC2F841CEE6FDC87A7BD5743D625845DC7087	512A07578B91CB6FF40CB5B9DF2658BC024FDCC57D9C25209AF72D6CCE808BFF
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	FF4A6612F027946677C6EC98D7E28C9F	76D65124B1BED7A721154F5744CD901261D8E1F8	3CD66D0503A4CF26D0E1CCEE1D3333D04A2DF5B701BFDA5F61EBA3A203796C99
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	2308D39A88FC0FE449E753C93008157C	19056FA1DC4C95EBF632534E72488B30D271973B	038CA46CF9692EE75320AC791DFF848FACABDC82F8BDB0B80AEF75105A1B6ED4
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	B2022CB000A2A1026FE7FF5DE4F81975	3FD3DB671924273A8DB67E0217EFBD0C49022367	74208DA2953DA271620EF67FA3572620E24C68CF5B19BDCA356D34EA0BD0785D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	E4ACB4782953294DDC09AE6BFF167837	6EC45C778C3D7A7FBDDB46E09C6BBCADF529F681	742BFB7ECC9169907B237271EBCE112EEB25CE6CC1039A89765A59F72DE4F93C
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	346F26BACB6AD554AE554DA2522B3084	D14A43F568803680CD8DF4B0B265FD38A4154CC8	E7C9D626F3E5601FE1A3D1897C81A33391E156BB4A6CB93504446C1B70C010ED
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	A4F302BED151A8D48010D08E890F43E4	398C001D002B82F322ECFACDE5918F825DB1C06C	873D762DED6ADEBEE3C124B7077474FC5DA330C44D4F500018E157167F834D93
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	C3DF7CBCB7961019116752AC81EA7745	CA4636F2C5E5E26C57BD142177D72700EA92620B	354DDC958A52156EFB4023B64023A62777CD3A293729CA7D5A22CE05C948CB0B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	450B6CF4B1DB1390162F32E48E525073	BBFA2B5CF5F551B53FD24469C3821EFFA860F542	95B831AA66226B43BA89BB9D7D0D3443C3B64B4F763E1EB8F1A413D4643BEB2D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\2d-0e97d4-185735b[1].css	UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	24D71CC2CC17F9E0F7167D724347DBA4	4188B4EE11CFDC8EA05E7DA7F475F6A464951E27	4EF29E187222C5E2960E1E265C87AA7DA7268408C3383CC3274D97127F389B22
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\52-478955-68ddb2ab[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	E0EE2633FE41EB7DDC1CAE8022DFB4D2	943A97B03F6B3BE7053CB2EDE05E1E19839B3790	9B752E3E13C79007FC41FE147485990CED773DDEEE63D7409CC5DEB45062393F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAKp8YX[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	CD651A0EDF20BE87F85DB1216A6D96E5	A8C281820E066796DA45E78CE43C5DD17802869C	F1C5921D7FF944FB34B4864249A32142F97C29F181E068A919C4D67D89B90475
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AANf6qa[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	7ED73D785784B44CF3BD897AB475E5CF	47A753F5550D727F2FB5535AD77F5042E5F6D954	EEEA2FBC7695452F186059EC6668A2C8AE469975EBBAF5140B8AC40F642AC466
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAQBdIv[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	F4B452436A19591E7C0ED1A7916B9259	5BA326F2E57A89A106689E4EC00B23D30AAA9DBE	B13869EEC4400F3BDE2DE2F864E786ACC568D413FDA7FC619FC4AF87E6328B5D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARfBRG[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	C1E45168501706CBDC838A8BFE9D0F52	14CF81B2F4057347DC2318CFEC2ECFF70294B90F	E71AE4CB8730B60C9A0E4B13AA3A01C604DE19BBD791A32726B74134B4340930
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARff5P[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	4B2E20E0236E7BD67359D3C33EF578B7	1E61CE84D00DE8F553CEFB0253943032357E254A	0384A61AE2565C30F1E679097C917392E8470B785A40C5916648A429FC802896
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARg6mK[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	A966A70DB449330E4B74A83D5829FF88	9B8D023E00E7E0EB6B30BF6B95DC61085659663D	20228EEE89A1034A4C7D71A13BAFD5FAB441CD3CB4CB3210A6656228C897922C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARga9S[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	B5D515333705F3EBE29AE8019B7193B9	9B0998518BD36D61608304F7DE97AC6127B2271F	4D2AA5355B6B72EF5D737E58228B35D7EB7141C2D7E9BC84C384662AA66CBB2C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARgmtt[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	C237E4D84F2063C5D6D26414A8C7C007	A42170CF6A5DD4ED80B33B34526C2ABA07F08A88	57FBD448586935A557A3AAB27B14241DEC0434CEC644F798E1CA298F909B5B1B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARgoFZ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	92FFB9E404BC0D57B2C10BF83E806C24	969D35CEF6FA78DE1FA3C39C3BF1E57ACBBC187C	271F5610AE17651EFE2589D211C5856AB913FBF9FCC40D99BC299D989705CF4C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARgob3[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	64C850BFD17C1253292B56F42ADCDE53	45E4EFC6BEE91F34A81824D3ECAAEDC92C3FB178	54C7915000201FBD50F2043A733111F2C7D4D8E2BAD04F65C88EC924F9E96213
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARgou4[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	23C6A273C9257B93E919DBF348FF677A	B1701EB0D7BD259AA53B363D7612E24A272F7D5B	57D68A0482F4CE9B7B8AAE5D719058A8F42663297E3BF8D5B16D9FD739E424AB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARgvCZ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	E5501B4B6E4E6F81A03043CA935A5FDD	EDA4287F3D1AC5AAB8D2A855065A1232E4E68971	7410100B7D5FEF289FB91FDF0CA2CCA9415687A071A272EF596B00568FB4C280
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AARgwtm[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	F1DBE9E0F2A0C26D51CAB0EFBD074272	97A1FBC922B5DFA9F8843D035B13A3645BF4D147	02C7886C4830202864ACCAE438681B6D1A8165575FD6196FD5BC9EA503522A8D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1aXBV1[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	D858BE67BEA11BF5CEC1B2A6C1C1F395	6090B195BEF6AF1157654048EECEA81E2DCEC42A	FC7CF2E8592C8E63CFF72530DA560E3293EC2DE3732823DBAEB4464609EA0494
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1cEP3G[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	24F1589A12D948B741C2E5A0C4F19C2A	DC9BB00C5D063F25216CDABB77F5F01EA9F88325	619910A3140A45391D7D3CB50EC4B48F0B0C8A76DC029576127648C4BD4B128C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1cG73h[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	D1495662336B0F1575134D32AF5D670A	EF841C80BB68056D4EF872C3815B33F147CA31A8	8AD6ADB61B38AFF497F2EEB25D22DB30F25DE67D97A61DC6B050BB40A09ACD76
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1gyWh5[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	67E55E01B3746273C0D6440E0229464B	B0EFBEF2F457E3C497F77D9ACEFE845CD9446801	4441E3858AFDA9EA55051473DF78DD2F23BF21CAD83492CBFF9C032CEBA1F657
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1kMP0[1].png	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	1CD1232E6BF6A22BF415CB2C4C767D52	83BD3437ACC73448C669634483201E5B48BFA05C	1A9374FF802B1F5AE3D0A10D8C051C1EE4DC59CDE290F31E64A938E205592801
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBPfCZL[1].png	GIF image data, version 89a, 50 x 50	59DAB7927838DE6A39856EED1495701B	A80734C857BFF8FF159C1879A041C6EA2329A1FA	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBX2afX[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	4AAAEC9CA6F651BE6C54B005E92EA928	7296EC91AC01A8C127CD5B032A26BBC0B64E1451	90396DF05C94DD44E772B064FF77BC1E27B5025AB9C21CE748A717380D4620DD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\de-ch[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	DD317519A46A2ABC1C1C70A46431A856	D3D09DEF88B633E69039284299BB7D8C3CC0A1D7	C366C29C81BA6DEC4D3496B23666C1958F7E9949E03FB76AB82844477668061A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery-2.1.1.min[1].js	ASCII text, with very long lines, with CRLF line terminators	9A094379D98C6458D480AD5A51C4AA27	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\39ab3103-8560-4a55-bfc4-401f897cf6f2[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3	F7E694704782A95060AC87471F0AC7EA	F3925E2B2246A931CB81A96EE94331126DEDB909	DEEBF748D8EBEB50F9DFF0503606483CBD028D255A888E0006F219450AABCAAE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\5096d619-1503-4dc7-8fad-e2ece705fa8a[1].jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3	C611ADD2A8C6A087CB622C7715FD2031	2543F4F911BA4574194F082A05C6E6E3E06B47C7	9EA50620C4AE82363FF2573F20C415CCB12348AFBCB8C9FBD677BE1EBBC991A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAQCgDb[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	7EB2C6AFF772712CB5C5430050503581	E80334CA32FF05AD16B7D8E322200F8DF9BBE86D	C7FC141B8CB74F3BE9EDFC961162EF4A52EDDD0EC8068DAD4B197E9E000C6858
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARfMnc[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	79785D7A24A3D249F8381B863DC7F89A	1D67FA0D67532A1C2B4DE591B4B9D76A033E1A56	230483A0D2DB48D94B3745903F365441BEDE290118F01D1BF0C7F1E0F62BCACB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARfw7b[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	4B4588EDDD7A2E6517B7D0018DD82EE3	6487DFE0E42A95116835CED249175E6F3D5E95B4	366D03FA212EEE18E60835E02F07EB3D5C054BDE122E558C6F51F2133B36DB04
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARgAR8[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	0DB2EAC1CAC9DE8BF92A8BC75D0BA1B9	4D3EF2B432C0406140E8C54BA9DFCFB5F5C9A5BD	92F07215EEA270A2623DF537543D5C7408DC9D87150BD7FCCE3DA23DD4EDF98C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARgeRz[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	BAD3C19476CE93415D12639221988E38	CFD497C805306BA9B3CBCA43ACDD9BF949261ADA	DB3AD7A6F50D00BC4BE15F5F34CE88F079DC8E2AF490591E54BF6BD9520C1080
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARglz8[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	9501F6A9B750369850AA4E5F3B371D41	45563C3D919D0BFDDACF046A93C9F0C8D9B6CE96	CDDC3737824AF58BFC8D6605DA7709F7539CCC1A9B852836A3F4120DE3702BC4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARgnyF[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	72B545E1DD005F1ACD9EB051D4A60375	E629F9070C5041052AB5C21786DEF1678C506905	F45BB1F02D9B413B577B9DBDC94E7465551DB822E81B26DA54BC1425A42290B4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARgo1i[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	A316AAC43856FBE60E78DB0C63DD6A7A	9D4626A4F0C90A4AFBD09CC36C69EA8F9F259DB7	D5ADF3081EB4F63E839560FF5639154D8CE06CC5A11F0188EDB740C407EBC8BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AARgof8[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	537709AF81D98AFDECB94E6A0ECE97D9	15E976B3743A32DB816511CA54A52114C795022E	1AF446A7E421EE7F42CAD96C8E2E222E07FFFC7B4080ED5EC7D10BC773B46E9B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAuTnto[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1472AF1857C95AC2B14A1FE6127AFC4E	D419586293B44B4824C41D48D341BD6770BAFC2C	67254D5EFB62D39EF98DD00D289731DE8072ED29F47C15E9E0ED3F9CEDB14942
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB10MkbM[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	19B9391F3CA20AA5671834C668105A22	81C2522FC7C808683191D2469426DFC06100F574	3557A603145306F90828FF3EA70902A1822E8B117F4BDF39933A2A413A79399F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB7hg4[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	B6EA6C62BAEBF35525A53599C0D6F151	4FFEFB243AAEC286D37B855FBE33C790795B1896	71CC7A3782241824ACDC2D6759E455399957E3C7C9433A1712C3947E2890A4D4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB7hjL[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	F810C713C84F79DBB3D6E12EDBCD1A32	09B30AB856BFFDB6AABE09072AEF1F6663BA4B86	6E3B6C6646587CC2338801B3E3512F0C293DFF2F9540181A02C6A5C3FE1525A2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BBH3Kvo[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	FDC96E25125ACA9FAA9328286DF59A3C	AE96A116A24EC53C3D1E2F386435F6CE6B6B6F08	201E3277C624BCFDAF85CA20EE8BA8A22D8D3BFF44FDAD41FC23CB07AE0E9A40
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BBJrII1[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	815BC0B491D1C2229AA6AF07F213CAB5	E7F9F38CE6E310209CEC1F291D398AA499CFB64D	2705097C373E4DE9A34E02C575A3D86854FCDD08365DA79F93525E68F562917A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\cfdbd9[1].png	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced	FE5E6684967766FF6A8AC57500502910	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\de-ch[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	408DDD452219F77E388108945DE7D0FE	C34BAE1E2EBD5867CB735A5C9573E08C4787E8E7	197C124AD4B7DD42D6628B9BEFD54226CCDCD631ECFAEE6FB857195835F3B385
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon[1].ico	MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors	4123CE1E1732F202F60292941FF1487D	9F12B11BDE582DAE37CE8C160537D919C561C464	D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\iab2Data[1].json	UTF-8 Unicode text, with very long lines, with no line terminators	69E873EC1DB1AA38922F46E435785B61	0E17DD5D16C19D40847AEEEC9AF898BB7F228801	D90C45999873C12E05B6A850C7C5473E1CB3DA9BD087DB5F038F56ABD65F108C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\otSDKStub[1].js	ASCII text, with very long lines, with CRLF line terminators	0D2A3807FB77D862C97924D018C7B04C	9D17F3621001D08F7B98395AC571FC5F6CDA7FEF	75DE71E7FEAC92082AF2F49B7079C0B587B16A5E2BB4DABDA7E7EB66327402FB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\otTCF-ie[1].js	UTF-8 Unicode text, with very long lines, with CRLF line terminators	6E60674C04FFF923CE6E30A0CD4B1A04	D77ED2B9FA6DD82C7A5F740777CC38858D9CBDDD	48221F1DE0F509D6C365D9F4BA1D7DB8619E01C6BC4AC8462536836E582CDC66
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\px[1].gif	GIF image data, version 89a, 1 x 1	AD4B0F606E0F8465BC4C4C170B37E1A3	50B30FD5F87C85FE5CBA2635CB83316CA71250D7	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\17-361657-68ddb2ab[1].js	ASCII text, with very long lines, with no line terminators	7ADA9104CCDE3FDFB92233C8D389C582	4E5BA29703A7329EC3B63192DE30451272348E0D	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\55a804ab-e5c6-4b97-9319-86263d365d28[1].json	ASCII text, with very long lines, with no line terminators	073E1A67C16B7E2B0F240F20BAC53174	778663FBA0201814BE193EB38E4F9D8875F322ED	886E0D5D43DFB17D92EB8C5C80AB0671ED9DE247EC4AD9D71B358F32F7613287
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAKurDi[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	7AE49A4D7139A67C9EE57BDD7A90136F	B5AEC314998571ACE4597972DF25A10912D9DF37	2C9C0119193AFBE14524A2B56F923C55A687C01FC7213E19BFDFD139005A5949
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAMqFmF[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	DE563FA7F44557BF8AC02F9768813940	FE7DE6F67BFE9AA29185576095B9153346559B43	B9465D67666C6BAB5261BB57AE4FC52ED6C88E52D923210372A9692A928BDDE2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AAQby46[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	2F9F3CB5388BCD08347366720CE5D288	A39BAC27D57324389B7B65180D231A9030494616	8E87ACBF78E18EEF07524A2EDB0100BBBF77213CC16227046411F1EEBB6727F4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARdTbN[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	D74C8C969561B95FAEC33BC835D19E8D	A8BB118B3B3F8DA495F0FD1D4FC87026A6B5DF1A	EDDD20DBFD6ACCDCF246ED35D98FCFA7866BDAC9DD2D0B969D15F99C930411BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARfFmd[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	5A813693712E139DFF11D002B900A9C7	226FACC46413406942A0784C83DC4440DB31512B	31A14749AC00EB1F08B7EA72ABA9EAA9A9E9C2A3D4C5FCBEF1A93AEA774B3326
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARfQzY[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	D34ABE2441E1B7B575AB15B717271437	2CEA882F549D39CB5A8A16B2A7F7316808907A74	99132AE2F48EF285D42D106BC05E1F9B48CE4F2B8842B7A5DCF17E341911B2BC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARfTXl[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3	C8C75A48FB13E79EFF37DC5FCA3E909E	F38ED9D81AD840E13756252E47B998D08AA43554	74680B8399A938747FBA8411067241D066BC4E0C0D3E4D820EBA06211CCBE5DA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARftOL[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	1322CEAE0A886294B5AB54FDEAFC519D	0C6DCB80192D7391E84E321720E0F4150328FA13	6C0793D16E1074DE38D2734D5B43F4330865F81FC7C36BF5FD53F382BE2D55D2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARg1bv[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	6588215CA36A66164598DD990267AC8A	057A3D0A7840D15C897FF78A0A1C4AC5D2F9AAF5	903E3D674BF19C5D189F40D57E8DC3D960C3CC397AE0D78FAE3997EAF9C5E74A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARgo1H[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	2DC1CFBFA26E65667FC0DC598A0A27EA	1FC537197817CB1CFE573D17DEA6874617809A0C	33F319145615E1A78D46C798FC2EA1A2C1D7D2C33BF048942CA121060A12DC5A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARgr0v[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3	30FFBF664E19EA404273318CEB3A9AFF	B657331D27F2A4358BF12F0C7E4FE8B3439680F6	16E536A87C85AAD22C20031642ECD108D1EEA6A9A7179D6C2670798D7B6D3CD4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARgs6G[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	196729BE384A4FCBC6A05CE1DEB8F1B1	1B5780B01933EE1662C093DD82AF6391039F98A9	C01953A3B71374F9748DE8247A1D628565CB92EF7FA853F60DF0179A5B857677
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARgtdN[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	5E8D0CA8EAAE3F83E4CD74B23A54470D	5DC73AA99F575882BCCAD88933BC894035088B04	103C17996FB396624B5D59BE6DBB07223EB3B549A935ECBEA57F03B3BF924C4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARgvvY[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	3FF66EBD49E806C0946DD8CB61E6C58B	DE05302167A1E6940C34AA461F5F208EE4B626DF	B351CE4F28E9ED2A2E95A122F422B196465EA872C73016F2CE950B24B73A92B4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AARgz6q[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3	9F584FC2B9160E859DB0313257C51205	E73CA9F48808236C94CB8081794C2878B30ADED0	1C47FBCB241590C04D04F1B1F0DC867DB26F1A731054540242FD56E250691FAD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB1ftEY0[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	7FBE5C45678D25895F86E36149E83534	173D85747B8724B1C78ABB8223542C2D741F77A9	9E32BF7E8805F283D02E5976C2894072AC37687E3C7090552529C9F8EF4DB7C6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BB6Ma4a[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	C144BE9E6D1FA9A7DB6BD090D23F3453	203335FA5AD5E9D98771E6EA448E02EE5C0D91F3	FAC240D4CA688818C08A72C363168DC9B73CFED7B8858172F7AD994450A8D459
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\BBY7ARN[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	30801A14BDC1842F543DA129067EA9D8	1900A9E6E1FA79FE3DF5EC8B77A6A24BD9F5FD7F	70BB586490198437FFE06C1F44700A2171290B4D2F2F5B6F3E5037EAEBC968A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\a5ea21[1].ico	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	84CC977D0EB148166481B01D8418E375	00E2461BCD67D7BA511DB230415000AEFBD30D2D	BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\a8a064[1].gif	GIF image data, version 89a, 28 x 28	3CC1C4952C8DC47B76BE62DC076CE3EB	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\checksync[1].htm	HTML document, ASCII text, with very long lines	97AF3D10C38D4FF7892324286FB5F206	A4E2110389508828167E305973B9085D53FC1D99	20B1C732E004A7A854AF81BA523C14A4C7E8E52135E3C92D77AA6BD15675CCE9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\checksync[2].htm	HTML document, ASCII text, with very long lines	97AF3D10C38D4FF7892324286FB5F206	A4E2110389508828167E305973B9085D53FC1D99	20B1C732E004A7A854AF81BA523C14A4C7E8E52135E3C92D77AA6BD15675CCE9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\e151e5[1].gif	GIF image data, version 89a, 1 x 1	F8614595FBA50D96389708A4135776E4	D456164972B508172CEE9D1CC06D1EA35CA15C21	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\tag[1].js	ASCII text, with very long lines	DDFF3756F9EFD3A46CF3325875D813A1	05D238659959B28B786CCE43E9E55A728E69428E	E80C669818773959643790269ED9448F71BD45D27D61FAFD73BC44C0F40BAACD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\4996b9[1].woff	Web Open Font Format, TrueType, length 45633, version 1.0	A92232F513DC07C229DDFA3DE4979FBA	EB6E465AE947709D5215269076F99766B53AE3D1	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AANuZgF[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	93D77F5C5FFACEBA12A1ABFC6190B947	8001474A7342EBF760C66F1C30E48E32E00F2AF3	E6DA934C90931C6089ADB3D213DDD70C7104D0A182A98AB1C663CEDAE37F83A1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAPFmi4[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	6F93C3616FBC7B9E97E87E718DF27B14	33F4B22E6C3DC6E9A2BDE8BECC3FC20D2F90A1B3	DFCE8AE7B7C17FE90C55D7EE093936137DD0528FC4CC5BACDB5ED071FD2E312E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARbIzX[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	481D22706F070C0CA1E470A834D0529E	7B57BEFE589324D4DB16CC03166A53BBFE815E61	17B2688214933047EABD5A2034CDBAC6D9F7A9EDC87DA8970FDB462784F5E4D1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARfNgc[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	4499C289F1C2716CCF3996E924B841F1	8B7B0CE715A9ED3B47D71F104D15554AB09C239A	91F1E0EC36D12F96A36D3C1642837A301E326DF41931867849EB67C88EBF41F9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARg9pP[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	55EFB72782107E6AA94D271687079CDD	90B9B609DC3B43280C4EFA1309C0F2F9893A01D1	EF4DFCB0A1DB969E7F44C6021950B0B646E4B63F59E8D63EA1F118A09EA45B2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARgbQ8[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	C50F83CEFFC4CE787EA48E276D59D6BC	CCFCA2575FA30AADED8A62665777D5C1311FBD11	8BB540B6C6CCF3B42D41923AC8EEC592F2A59B5B6B0861318E10CE548E5CED6F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARgd7C[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	EEADE4DFBD567A61BCB39CB2BFD8EDFF	D0AE43E92225EA84B9E3F430B53985BDCA059EA4	862237C061F7D298AE27EF201EF66A1B1CB6D61B9A71E7A84C21F73ADD27E7E1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARgqt4[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	0B512A6896E9567696F1A04CEB9B04B1	CEFC4185A14ECBB79FA09E91F7D970D13EF4F285	415216A4E7C1BAB8A7FE7D49066B6B56E13D5756E1C1E58116C4416D15403B59
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARgrHg[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3	0C2A28FF838909893EC613AF85393D10	75633E8879DDB06A2C8F956FA9353331292B23F1	A37C5F2A3D3B5329FF012C757C6FFF3D17EAB30CA553B94BB144ED82AA33726A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARgw5H[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	C1CF81B29BBCDAC1040F0DE9139A9697	A16EADFF1E6EA5082D9AD878D3ED046CF6035265	97EDCB985A4146E654D4BAC56783BFBFC17021E2410E6159613C7DF535AFBEA1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARgyMO[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3	85872D49C5B78B114B524A90C8A8BDA2	CBDAE3B1B7E59E4A27FDEE6EA9B536D64BE802F3	33A33BF3C22B73E3AFB0030643CF30EF27398BCBBE8218143D4E822450095CB0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AARgyT7[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3	D284913817644E4DE0D64E81873FAC7D	7582B38C73AAD6E74C03FF5BF706A6E903D3A7FB	44E971BD897108A78790951F87BED5D77D14BAE577E68D140B617E513E28156B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\AAzb5EX[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	89E1141C659F2127DD80809F71326697	3262110C91000071FDBB0D33893EC1EC8026ADEC	98763AAD3E2B7507E7729711ACD2DACCBD56164FE6DDB10410047B212275C279
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB1gyTJJ[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3	4DF8DD6D0F07C93CF4BDAB709C312993	3D7987EF7E126936328E337FD3A8E06485C4BB2F	CF09AC32AAE02628FDF2FBDFC551BC13E68F2B3365E4EF52B36B35825624BFBD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BB7gRE[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	1FCA95AEED29D3219D0A53A78A041312	5A4661CCF1E9F6581F71FC429E599D81B8895297	4B0F37A05AB882DA679792D483B105FDD820639C390FC7636676424ECFD418B9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBF08Nm[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	709CE138925195022E59751FB914C09D	724582C228E7E6A1D0B9D131FFC9CCA180EBDBE8	EF7C5BAC0F3F1D11970E33250334875EC6B840BEC0A961BCA155EC96C7A80703
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BBVuddh[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	636BACD8AA35BA805314755511D4CE04	9BB424A02481910CE3EE30ABDA54304D90D51CA9	157ED39615FC4B4BDB7E0D2CC541B3E0813A9C539D6615DB97420105AA6658E3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\checksync[1].htm	HTML document, ASCII text, with very long lines	97AF3D10C38D4FF7892324286FB5F206	A4E2110389508828167E305973B9085D53FC1D99	20B1C732E004A7A854AF81BA523C14A4C7E8E52135E3C92D77AA6BD15675CCE9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\checksync[2].htm	HTML document, ASCII text, with very long lines	97AF3D10C38D4FF7892324286FB5F206	A4E2110389508828167E305973B9085D53FC1D99	20B1C732E004A7A854AF81BA523C14A4C7E8E52135E3C92D77AA6BD15675CCE9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\medianet[1].htm	HTML document, ASCII text, with very long lines	826D629147807B4124142409BE2BBE5D	EC73D30B79198D6A58820B4FD609BE35A395A3E8	C5A5372F59858CF2CCB572839412DA4974CD3C591748D6C8DE4E236DCA97B7BA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\medianet[2].htm	HTML document, ASCII text, with very long lines	6810E0A4516206A1D8E5C8818DDFCFDF	21C7FBD0F533ED69AEFEE8C4425C4949383B5144	DB436B10A4966BFDD10BE5BD48D8C7ADF278AD77DE2BCF71B2EBD5C9A0317D99
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nrrV52461[1].js	ASCII text, with very long lines, with no line terminators	9C4A60B2332E94D3BFF324BD8DF61A31	6245D60C273E175D3EC798CE8ABB65AD75F24E09	8C38115211EB4E291CE6F38629C8AEE0F882EBED06B66F3DB3D6587C1EBDF52F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otBannerSdk[1].js	UTF-8 Unicode text, with very long lines, with CRLF line terminators	56B5E93BFB078B9EEF2BA41DB521EA9B	A61A4949BCBCA6B8148CC6821D7CF88FBD90062F	B8603101616C7960752244D2EC66D2A845BBE0094B83E7CC2877880A3A93402D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otCommonStyles[1].css	ASCII text, with very long lines, with CRLF line terminators	E4F88E3AF211BD9EA203D23CB0B261D5	6067E95844B3E11A275ADD0B41D7AD3F00A426FD	E58322F14AC511762E2C74932104D7205440281520CF98E66F15B40AA8E60D05
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otFlat[1].json	ASCII text, with very long lines, with CRLF line terminators	0097436CBD4943F832AB9C81968CB6A0	4734EF2D8D859E6BFF2E4F3F7696BA979135062C	F330D3AE039F615FF31563E4174AAE9CEAD8E99E00297146143335F65199A7A9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otPcCenter[1].json	ASCII text, with very long lines, with CRLF line terminators	928BD4F058C3CE1FD20BE50FE74F1CD8	5CBF71DB356E50C3FFCB58E309439ED7EB1B892E	6048F2D571D6AE8F49E078A449EB84113D399DD5EA69FB5AC9C69241CD7BA945
C:\Users\user\AppData\Local\Temp\~DF13D9319CFEBB59CA.TMP	data	64EE1BAF4317E9499605C897600F1B48	D71E327141D3B4BCB5438640DD1A813F4BD1C464	3805AD0F688BA67DCD799A934AE706E5A05132ECD4D16657DE1438161E357FF7
C:\Users\user\AppData\Local\Temp\~DF485BA4CE75C65002.TMP	data	7E1212A13456E28F55C01D5619CD800B	9315F1EAE1320FD5C1132850C8B2E18AFBA8D5F0	B142B3F054BECDE1E0C9909DDBCFCE893502A3660BF91428A2DA818A7DF75A86

Compliance:

PE / OLE file has a valid certificate

Source: sign.dll

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.3:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.3:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.134:443 -> 192.168.2.3:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.134:443 -> 192.168.2.3:49816 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sign.dll

Static PE information: GUARD_CF, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Source:	Binary string: AppResolver.pdb source: sign.dll
Source:	Binary string: AppResolver.pdbGCTL source: sign.dll

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 172.67.69.19 172.67.69.19
Source: Joe Sandbox View	IP Address: 104.26.6.139 104.26.6.139

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815

Found strings which match to known social media urls

Source: de-ch[1].htm.7.dr	String found in binary or memory: <a href="https://www.facebook.com/" target="_blank" data-piitxt="facebooklite" piiurl="https://www.facebook.com/"> equals www.facebook.com (Facebook)
Source: msapplication.xml0.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x3872008d,0x01d7e683</date><accdate>0x388fcf10,0x01d7e683</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x3a0d4791,0x01d7e683</date><accdate>0x3a441b34,0x01d7e683</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.5.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x3a978fa1,0x01d7e683</date><accdate>0x3abdb334,0x01d7e683</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.7.dr	String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="https://www.bing.com" /><link rel="preconnect" href="//web.vortex.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="https://www.bing.com" /><link rel="dns-prefetch" href="//web.vortex.data.msn.com" /><link rel="canonical" href="https://www.msn.com/de-ch/" /><meta name="msapplication-TileColor" content="#224f7b"/><meta name="msapplication-TileImage" content="//static-global-s-msn-com.akamaized.net/hp-neu/sc/1f/08ced4.png"/><meta name="msapplication-config" content="none"/> <title>MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: glich.",errorFooterText:"Zu Twitter wechseln",taskLinks:"Benachrichtigungen|https://twitter.com/i/notifications;Ich|#;Abmelden|#"}],xbox:[{header:"Spotlight",content:"",footerText:"Alle anzeigen",footerUrl:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"},{header:"Meine tolle Wiedergabeliste",headerUrl:"https://aka.ms/qeqf5y",content:"",errorMessage:"",taskLinks:"me_groove_taskLinks_store|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play|https://aka.ms/Ixhi8e;me_groove_taskLinks_try|https://aka.ms/msvmj1"}],bingrewards:[{header:"Pr equals www.twitter.com (Twitter)
Source: de-ch[1].htm.7.dr	String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"&nbsp;&nbsp;&nbsp;Ref 2: "+e.html(t.clientSettings.sid||"000000")+"&nbsp;&nbsp;&nbsp;Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console||{}).timeStamp?console.timeStamp(n):(r.performance||{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 72em)",size3column:"(min-width: 52.313em) and (max-width: 71.99em)",size2column:"(min-width: 43.75em) and (max-width: 52.303em)",size2rowsize4column:"(min-width: 72em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 52.303em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 72em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 52.303em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="https://www.msn.com/de-ch"/><meta property="og:url" content="https://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.facebook.com (Facebook)
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.twitter.com (Twitter)
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: ter erneut.",viewInboxErrorMessage:"Wenn beim Anzeigen Ihres Posteingangs weiterhin ein Problem auftritt, besuchen Sie",taskLinks:"Verfassen|https://outlook.live.com/mail/deeplink/compose;Kalender|https://outlook.live.com/calendar",piiText:"Read Outlook Email",piiUrl:"http://www.hotmail.msn.com/pii/ReadOutlookEmail/"}],office:[{header:"Office",content:"Zeigen Sie Ihre zuletzt verwendeten Dokumente an oder erstellen Sie kostenlos mit Office Online ein neues.",footerText:"Anmelden",footerUrl:"[[signin]]",ssoAutoRefresh:!0,taskLinks:"Word Online|https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel Online|https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway|https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoint Online|https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site"},{header:"Aktuelle Dokumente",headerUrl:"https://onedrive.live.com/#qt=mru",content:"Wird geladen ...",noContent:"Dieser Ordner ist leer. Klicken Sie unten, um ein neues Dokument zu erstellen.",errorMessage:"Keine Verbindung mit Office Online m equals www.hotmail.com (Hotmail)

URLs found in memory or binary data

Source: de-ch[1].htm.7.dr	String found in binary or memory: http://ogp.me/ns#
Source: de-ch[1].htm.7.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: {5D0C8C97-5276-11EC-90E9-ECF4BB862DED}.dat.5.dr, ~DF13D9319CFEBB59CA.TMP.5.dr	String found in binary or memory: http://searchads.msn.net/.cfm?&&kp=1&
Source: imagestore.dat.7.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: msapplication.xml.5.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.5.dr	String found in binary or memory: http://www.google.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: http://www.hotmail.msn.com/pii/ReadOutlookEmail/
Source: msapplication.xml2.5.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.5.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.5.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.5.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.5.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.5.dr	String found in binary or memory: http://www.youtube.com/
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://amzn.to/2TTxhNg
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://apps.apple.com/ch/app/microsoft-news/id945416273?pt=80423&ct=prime_footer&mt=8
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/oneTrust/1.2/consent/55a804ab-e5c6-4b97-9319-86263d36
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://client-s.gateway.messenger.live.com
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=273363&a=3064090&g=24940322
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692
Source: ~DF13D9319CFEBB59CA.TMP.5.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&http
Source: {5D0C8C97-5276-11EC-90E9-ECF4BB862DED}.dat.5.dr, ~DF13D9319CFEBB59CA.TMP.5.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: {5D0C8C97-5276-11EC-90E9-ECF4BB862DED}.dat.5.dr, ~DF13D9319CFEBB59CA.TMP.5.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://doceree.com/.well-known/deviceStorage.json
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://doceree.com/us-privacy-policy/
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://evorra.com/product-privacy-policy/
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.7.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1638310489&rver
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1638310489&rver=7.0.6730.0&am
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/logout.srf?ct=1638310490&rver=7.0.6730.0&lc=1033&id=1184&lru=
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&rpsnv=13&ct=1638310489&rver=7.0.6730.0&w
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://login.skype.com/login/oauth/microsoft?client_id=738133
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://nextmillennium.io/privacy-policy/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/#qt=mru
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/?qt=allmyphotos;Aktuelle
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;Aktuelle
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;OneDrive-App
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com/about/en/download/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com;Fotos
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com;OneDrive-App
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://optimise-it.de/datenschutz
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://outlook.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://outlook.live.com/calendar
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://outlook.live.com/mail/deeplink/compose;Kalender
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
Source: {5D0C8C97-5276-11EC-90E9-ECF4BB862DED}.dat.5.dr, ~DF13D9319CFEBB59CA.TMP.5.dr	String found in binary or memory: https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://secure.adnxs.com/clktrb?id=764680&t=1
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://silvermob.com/privacy
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://smartyads.com/privacy-policy
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/de-ch/homepage/api/modules/cdnfetch"
Source: imagestore.dat.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AARgob3.img?h=368&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB12jAN6.img?h=27&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aXBV1.img?h=27&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://support.skype.com
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://twitter.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://twitter.com/i/notifications;Ich
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.bidstack.com/privacy-policy/
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.botman.ninja/privacy-policy
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
Source: imagestore.dat.7.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: imagestore.dat.7.dr	String found in binary or memory: https://www.google.com/favicon.ico~
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/
Source: ~DF13D9319CFEBB59CA.TMP.5.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/modules/fetch"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata"
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/coronareisen
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/politik/positives-signal-an-die-ganze-schweiz-z%c3%bcrcher-sag
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/regional
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/schweiz/stadtz%c3%bcrcher-sagen-ja-zu-%c3%b6ffentlichen-terras
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/20-kilo-marihuana-und-70-kilo-khat-am-flughafen-z%c3%bcrich-ent
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/der-schnee-machte-den-z%c3%bcrcher-trams-und-bussen-zu-schaffen
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/die-jungen-gr%c3%bcnen-sind-dem-kantonsrat-zu-wenig-radikal/ar-
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/hier-kommen-sie-in-stimmung/ar-AARgiK8?ocid=hplocalnews
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/n%c3%a4chtliche-ausfahrt-endet-mit-sechs-verletzten/ar-AARdLXJ?
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/nach-corona-stopp-stadtz%c3%bcrcher-bev%c3%b6lkerung-w%c3%a4chs
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/z%c3%bcrcher-kantonsrat-will-staatliche-kitas-mit-millionen-unt
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/sport/other/der-fcz-hat-die-leidenschaft-die-basel-und-yb-derzeit-fehlt/ar
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com/de-ch/sport?ocid=StripeOCID
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.msn.com?form=MY01O4&OCID=MY01O4
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.onlineumfragen.com/3index_2010_agb.cfm
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.queryclick.com/privacy-policy
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_shop_de&utm
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.skype.com/
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.skype.com/de
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.skype.com/de/download-skype
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.stroeer.de/ssp-datenschutz
Source: iab2Data[1].json.7.dr	String found in binary or memory: https://www.stroeer.de/werben-mit-stroeer/onlinewerbung/programmatic-data/sdi-datenschutz-b2c
Source: 52-478955-68ddb2ab[1].js.7.dr	String found in binary or memory: https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.tippsundtricks.co/gesundheit/stueck-seife-bettwasche/?utm_campaign=DECH-bedsoap&utm_
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.tippsundtricks.co/lifehacks/kochendes-wasser-auto/?utm_campaign=DECH-cardent&utm_sou
Source: de-ch[1].htm.7.dr	String found in binary or memory: https://www.tippsundtricks.co/saubermachen/reinige-dusche-spulmaschinentab/?utm_campaign=DECH-spulit

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.msn.com

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /tag?o=6208086025961472&upapi=true HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: btloader.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /px.gif?ch=1&e=0.8829098672686784 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ad-delivery.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ad.doubleclick.netConnection: Keep-Alive

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.3:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.3:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.69.19:443 -> 192.168.2.3:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.134:443 -> 192.168.2.3:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.134:443 -> 192.168.2.3:49816 version: TLS 1.2

System Summary:

Sample file is different than original file name gathered from version info

Source: sign.dll

Binary or memory string: OriginalFilenameAppResolver.dllj% vs sign.dll

Tries to load missing DLLs

Source: C:\Windows\System32\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

PE file has an executable .text section and no other executable section

Source: sign.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\sign.dll",#1

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\sign.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\sign.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\sign.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\sign.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\sign.dll,DllCanUnloadNow
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6504 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\sign.dll,DllGetActivationFactory
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\sign.dll,DllGetClassObject
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\sign.dll",#1			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\sign.dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\sign.dll,DllCanUnloadNow			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\sign.dll,DllGetActivationFactory			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\sign.dll,DllGetClassObject			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\sign.dll",#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6504 CREDAT:17410 /prefetch:2			Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF485BA4CE75C65002.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: clean4.winDLL@17/117@11/3

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE /OLE file has a valid certificate with Microsoft as Issuer

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

PE file has a high image base, often used for DLLs

Source: sign.dll

Static PE information: Image base 0x180000000 > 0x60000000

PE / OLE file has a valid certificate

Source: sign.dll

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: sign.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: sign.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: sign.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: sign.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: sign.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: sign.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sign.dll

Static PE information: GUARD_CF, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

PE file contains a debug data directory

Source: sign.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: AppResolver.pdb source: sign.dll
Source:	Binary string: AppResolver.pdbGCTL source: sign.dll

PE file contains a valid data directory to section mapping

Source: sign.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: sign.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: sign.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: sign.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: sign.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

PE file contains sections with non-standard names

Source: sign.dll

Static PE information: section name: .didat

Registers a DLL

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\sign.dll

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\sign.dll",#1

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: sign.dll

Binary or memory string: >AppResolver.AppLifecycleReconcilerShell_TrayWndMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy!Apppcshell\shell\appresolver\unifiedtilemodelreconciler\applifecyclereconciler.cppPeopleExperienceHostVS_ccv6fwk6gx0xp!App