Play interactive tour

Edit tour

Windows Analysis Report AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Overview

General Information

Sample Name:	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
Analysis ID:	435218
MD5:	7145a179b496fc5fe19dc9b7745e2deb
SHA1:	db6434602ca9b8939a468defb9cef89d4ca93d12
SHA256:	8e23c6df003309ef656835eab65a8263c88ac0c277ffdbd5307eefdecb23872a
Infos:
Most interesting Screenshot:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Detected potential unwanted application

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe (PID: 7004 cmdline: 'C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe' MD5: 7145A179B496FC5FE19DC9B7745E2DEB)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Show sources

Source: w.nanweng.cn

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Virustotal: Detection: 74%	Perma Link
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Metadefender: Detection: 22%	Perma Link
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	ReversingLabs: Detection: 79%

Machine Learning detection for sample

Show sources

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Joe Sandbox ML: detected

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Static PE information: certificate valid
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49781 version: TLS 1.2

Source: global traffic

HTTP traffic detected: POST /qy/ov HTTP/1.1Host: w.nanweng.cn Content-Length: 190 Connection:closeAccept-Language: zh-cnCache-Conbtrol:no-cacheContent-Type:application/x-www-form-urlencodedData Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 33 31 30 35 35 33 37 61 35 66 38 32 64 65 31 39 64 64 39 65 33 30 66 34 37 35 66 37 33 61 65 64 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 32 32 32 33 26 73 69 64 3d 31 36 30 38 31 26 76 65 72 3d 36 2e 30 2e 30 2e 36 30 33 26 76 6d 3d 31 31 26 74 6d 3d 31 35 36 39 37 33 34 33 32 33 26 74 79 70 65 3d 32 30 26 73 69 67 3d 33 43 38 37 46 41 31 37 39 35 42 30 43 37 33 45 30 44 36 36 30 44 45 36 42 37 33 32 41 30 43 30 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=3105537a5f82de19dd9e30f475f73aed&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=2223&sid=16081&ver=6.0.0.603&vm=11&tm=1569734323&type=20&sig=3C87FA1795B0C73E0D660DE6B732A0C0

Source: Joe Sandbox View	IP Address: 104.20.185.68 104.20.185.68
Source: Joe Sandbox View	IP Address: 87.248.118.23 87.248.118.23

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cnData Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 67 45 69 45 69 59 53 48 41 49 79 4d 7a 45 52 49 67 45 45 48 43 63 6f 49 51 49 78 4c 43 49 43 4a 41 45 71 47 43 49 47 42 77 41 69 41 51 51 54 4a 69 38 6d 45 53 63 6f 49 52 38 78 4c 7a 34 43 4a 41 49 69 57 43 59 2d 4f 6c 6f 79 50 79 35 59 4a 44 77 69 57 79 51 2d 4d 51 59 79 45 54 30 47 4d 54 38 75 58 6a 45 73 4a 6c 34 79 41 51 68 59 4a 53 38 39 42 79 59 47 4f 51 63 79 41 69 49 59 49 67 55 6c 47 7a 45 6f 49 6c 30 6d 50 7a 49 63 4a 43 38 75 47 43 49 46 4a 56 73 69 41 51 51 63 4a 79 67 68 57 67 6f 38 4f 67 49 6b 41 69 49 52 4a 6a 38 71 57 69 55 2d 4a 6c 67 79 50 7a 30 47 4a 43 38 68 41 44 45 2d 4c 6c 34 78 4c 44 70 65 4d 54 38 6d 48 44 45 42 4f 6c 67 6c 50 44 4a 59 4a 6c 6b 74 42 7a 45 6f 49 68 67 69 42 54 45 48 43 41 49 69 58 53 49 42 4d 68 34 6d 4b 46 38 63 4a 77 45 79 48 43 59 53 49 68 67 69 42 54 45 66 49 67 45 45 48 43 63 6f 49 56 30 4b 50 44 6f 43 4a 41 49 69 41 69 63 6f 49 56 30 4a 41 69 4a 64 4a 6a 4e 62 49 41 3d 3d Data Ascii: js=DhIhAwgjKRsxKCJdJgEiEiYSHAIyMzERIgEEHCcoIQIxLCICJAEqGCIGBwAiAQQTJi8mEScoIR8xLz4CJAIiWCY-OloyPy5YJDwiWyQ-MQYyET0GMT8uXjEsJl4yAQhYJS89ByYGOQcyAiIYIgUlGzEoIl0mPzIcJC8uGCIFJVsiAQQcJyghWgo8OgIkAiIRJj8qWiU-JlgyPz0GJC8hADE-Ll4xLDpeMT8mHDEBOlglPDJYJlktBzEoIhgiBTEHCAIiXSIBMh4mKF8cJwEyHCYSIhgiBTEfIgEEHCcoIV0KPDoCJAIiAicoIV0JAiJdJjNbIA==
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cnData Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}
Source: global traffic	HTTP traffic detected: POST /qy/gl HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 331Host: w.nanweng.cn
Source: global traffic	HTTP traffic detected: POST /qy/rq HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 469Host: w.nanweng.cn

Source: de-ch[1].htm.0.dr	String found in binary or memory: <a href="https://www.facebook.com/" target="_blank" data-piitxt="facebooklite" piiurl="https://www.facebook.com/"> equals www.facebook.com (Facebook)
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: 0http://www.hotmail.msn.com/pii/ReadOutlookEmail/ equals www.hotmail.com (Hotmail)
Source: de-ch[1].htm.0.dr	String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="https://www.bing.com" /><link rel="preconnect" href="//web.vortex.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="https://www.bing.com" /><link rel="dns-prefetch" href="//web.vortex.data.msn.com" /><link rel="canonical" href="https://www.msn.com/de-ch/" /><meta name="msapplication-TileColor" content="#224f7b"/><meta name="msapplication-TileImage" content="//static-global-s-msn-com.akamaized.net/hp-neu/sc/1f/08ced4.png"/><meta name="msapplication-config" content="none"/> <title>MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: glich.",errorFooterText:"Zu Twitter wechseln",taskLinks:"Benachrichtigungen\|https://twitter.com/i/notifications;Ich\|#;Abmelden\|#"}],xbox:[{header:"Spotlight",content:"",footerText:"Alle anzeigen",footerUrl:"",taskLinks:"me_groove_taskLinks_store\|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play\|https://aka.ms/Ixhi8e;me_groove_taskLinks_try\|https://aka.ms/msvmj1"},{header:"Meine tolle Wiedergabeliste",headerUrl:"https://aka.ms/qeqf5y",content:"",errorMessage:"",taskLinks:"me_groove_taskLinks_store\|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play\|https://aka.ms/Ixhi8e;me_groove_taskLinks_try\|https://aka.ms/msvmj1"}],bingrewards:[{header:"Pr equals www.twitter.com (Twitter)
Source: de-ch[1].htm.0.dr	String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"   Ref 2: "+e.html(t.clientSettings.sid\|\|"000000")+"   Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console\|\|{}).timeStamp?console.timeStamp(n):(r.performance\|\|{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 72em)",size3column:"(min-width: 52.313em) and (max-width: 71.99em)",size2column:"(min-width: 43.75em) and (max-width: 52.303em)",size2rowsize4column:"(min-width: 72em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 52.303em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 72em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 52.303em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="https://www.msn.com/de-ch"/><meta property="og:url" content="https://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://www.facebook.com/msnchL\ equals www.facebook.com (Facebook)
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.facebook.com (Facebook)
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.twitter.com (Twitter)
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: ter erneut.",viewInboxErrorMessage:"Wenn beim Anzeigen Ihres Posteingangs weiterhin ein Problem auftritt, besuchen Sie",taskLinks:"Verfassen\|https://outlook.live.com/mail/deeplink/compose;Kalender\|https://outlook.live.com/calendar",piiText:"Read Outlook Email",piiUrl:"http://www.hotmail.msn.com/pii/ReadOutlookEmail/"}],office:[{header:"Office",content:"Zeigen Sie Ihre zuletzt verwendeten Dokumente an oder erstellen Sie kostenlos mit Office Online ein neues.",footerText:"Anmelden",footerUrl:"[[signin]]",ssoAutoRefresh:!0,taskLinks:"Word Online\|https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel Online\|https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway\|https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoint Online\|https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site"},{header:"Aktuelle Dokumente",headerUrl:"https://onedrive.live.com/#qt=mru",content:"Wird geladen ...",noContent:"Dieser Ordner ist leer. Klicken Sie unten, um ein neues Dokument zu erstellen.",errorMessage:"Keine Verbindung mit Office Online m equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: w.nanweng.cn

Source: unknown

HTTP traffic detected: POST /qy/png HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0)Content-Length: 13Host: w.nanweng.cn

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748793860.0000000007332000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748771439.0000000007338000.00000004.00000001.sdmp	String found in binary or memory: http://hblg.media.net/nerrping.php
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748793860.0000000007332000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748793860.0000000007332000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: de-ch[1].htm.0.dr	String found in binary or memory: http://ogp.me/ns#
Source: de-ch[1].htm.0.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: auction[1].htm.0.dr	String found in binary or memory: http://popup.taboola.com/german
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695430668.0000000006387000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695931909.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696080911.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com;
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696144048.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comK
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comavaq
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comc
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695931909.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comd
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comk-s
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696144048.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comr-t
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coms-m
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.702348761.0000000006382000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.700256163.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.700214817.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.701756378.0000000006382000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.701080282.00000000063A3000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.701055917.0000000006382000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.707560749.0000000006383000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersR
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.707560749.0000000006383000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersi
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.708803778.000000000636E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.708803778.000000000636E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.commn
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694251158.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.693787661.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/sw
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694546165.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694655949.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl9
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694546165.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnm
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694251158.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnmM
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694546165.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnno
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694546165.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnsw
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.704732919.0000000006386000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.c
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.704348945.0000000006382000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.704470230.0000000006382000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm.
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.704470230.0000000006382000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/v
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: http://www.hotmail.msn.com/pii/ReadOutlookEmail/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.700354047.0000000006382000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.707020067.0000000006383000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.9
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.691299653.0000000006F01000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehphttp://www.msn.com/de-ch/?ocid=iehp$
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695822036.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn.
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695822036.000000000637E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnd
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.743860219.0000000004A6B000.00000004.00000001.sdmp	String found in binary or memory: https://ad.doubleclick.net/ddm/activity/src=6952136;type=store0;cat=jsll;u58=
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://aka.ms/qeqf5y
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.774568200.000000000AECB000.00000004.00000001.sdmp	String found in binary or memory: https://aka.ms/qeqf5ypreviousArrowTitlePROCESSCHECKPOINTjsll-schemaMappingVIRTUALEVENTJOINmeControlB
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://amzn.to/2TTxhNg
Source: auction[1].htm.0.dr	String found in binary or memory: https://api.taboola.com/2.0/json/msn-ch-de-home/recommendations.notify-click?app.type=desktop&ap
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://apps.apple.com/ch/app/microsoft-news/id945416273?pt=80423&ct=prime_footer&mt=8
Source: auction[1].htm.0.dr	String found in binary or memory: https://beap.gemini.yahoo.com/mbclk?bv=1.0.0&es=2JojwucGIS8j9L6EYJ20jM.eOoyPez111zspb.7y8R0QhqOq
Source: auction[1].htm.0.dr	String found in binary or memory: https://beap.gemini.yahoo.com/mbclk?bv=1.0.0&es=696hVfQGIS9zXA4jWn5xMhDdZtm4WrdQuVr2xIBVfaKTRmZt
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.750634445.000000000A83A000.00000004.00000001.sdmp	String found in binary or memory: https://c21lg-a.media.net
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748850803.0000000007241000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.cookielaw.org/logos/static/ot_logo.png
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748850803.0000000007241000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.0.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.0.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.0.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: auction[1].htm.0.dr	String found in binary or memory: https://cdn.flurry.com/adTemplates/templates/htmls/clips.html"
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.772828181.0000000004A73000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://client-s.gateway.messenger.live.com
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://clk.tradedoubler.com/click?p=245744&a=3064090&g=21863656
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24903118&epi=ch-de
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24952290&epi=dech
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.750634445.000000000A83A000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/dtp.js?
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.731563120.000000000F212000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/dtp.js?https://lg3.media.net/nerrping.php
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&http
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.0.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748771439.0000000007338000.00000004.00000001.sdmp	String found in binary or memory: https://hblg.media.net/nerrping.php
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://hotmailproxy.betaplace.com/pm/v1.0/getheaders.aspx
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://hotmailproxy.msn.com/pm/v1.0/getheaders.aspx
Source: auction[1].htm.0.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: auction[1].htm.0.dr	String found in binary or memory: https://ir2.beap.gemini.yahoo.com/mbcsc?bv=1.0.0&es=Is5Zb70GIS9tDawwICjdd7DNRvVSylzITRWirrBBl6Jq
Source: auction[1].htm.0.dr	String found in binary or memory: https://ir2.beap.gemini.yahoo.com/mbcsc?bv=1.0.0&es=bXyun80GIS9a8ZoR3amLDMP4ByViKYft8crROf3jumMm
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://iurl-a.akamaihd.net/ybntag?t.split
Source: rtbsmpubs[1].js0.0.dr	String found in binary or memory: https://iurl.media.net/dfp/ybntag?&cid=8CU157172&crid=722878611&size=300x250&requrl=$
Source: rtbsmpubs[1].js.0.dr	String found in binary or memory: https://iurl.media.net/dfp/ybntag?&cid=8CU157172&crid=858412214&size=300x250&requrl=$
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748834247.0000000007239000.00000004.00000001.sdmp	String found in binary or memory: https://lg3-a.akamaihd.net/nerrping.php
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net/bping.php?
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net/bqi.php
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net/flping.php?pid=8POU9IV3U&prid=8PRVV7640
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.731065618.000000000F2DB000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net/flping.php?pid=8POU9IV3U&prid=8PRVV7640https://c21lg-d.media.net/log?logid=kfk
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net/log?logid=kfk&evtid=popup
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net/nerrping.php
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://lg3.media.net/rtblog.php
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1623825040&rver
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1623825040&rver=7.0.6730.0&am
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://login.live.com/logout.srf?ct=1623825041&rver=7.0.6730.0&lc=1033&id=1184&lru=
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&rpsnv=13&ct=1623825040&rver=7.0.6730.0&w
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://login.skype.com/login/oauth/microsoft?client_id=738133
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://mem.gfx.ms/meversion/?partner=msn&market=de-ch"
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://navvy.media.net
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com/#qt=mru
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.774568200.000000000AECB000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/#qt=mruRufen
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com/?qt=allmyphotos;Aktuelle
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;Aktuelle
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;OneDrive-App
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com/about/en/download/
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com;Fotos
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com;OneDrive-App
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://outlook.com/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://outlook.live.com/calendar
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.live.com/mail/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://outlook.live.com/mail/deeplink/compose;Kalender
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.715634109.000000000BB93000.00000004.00000001.sdmp	String found in binary or memory: https://petrol.o
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.730171495.0000000002C3A000.00000004.00000001.sdmp	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
Source: auction[1].htm.0.dr	String found in binary or memory: https://policies.oath.com/us/en/oath/privacy/index.html
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748850803.0000000007241000.00000004.00000001.sdmp	String found in binary or memory: https://privacyportal.onetrust.com/request/v1/consentreceipts
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://redirect.viglink.com/?key=29045bc04c786d46d362906f803b13a2&u=https://ebay.comp
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://redirect.viglink.com?key=29045bc04c786d46d362906f803b13a2&u=https://amazon.com
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	String found in binary or memory: https://s.mnet-ad.net
Source: auction[1].htm.0.dr	String found in binary or memory: https://s.yimg.com/lo/api/res/1.2/4ZESs6Q5ib.T5INTDEWXYA--~A/Zmk9ZmlsbDt3PTMxMTtoPTMzMzthcHBpZD1nZW1
Source: auction[1].htm.0.dr	String found in binary or memory: https://s.yimg.com/lo/api/res/1.2/Fo5Jex2Ns8JTjiH3G9.SGA--~A/Zmk9ZmlsbDt3PTMxMTtoPTMzMzthcHBpZD1nZW1
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
Source: auction[1].htm.0.dr	String found in binary or memory: https://srtb.msn.com:443/notify/viewedg?rid=50882175e06343329570d6e0394eb3af&r=infopane&i=1&
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/de-ch/homepage/api/modules/cdnfetch"
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.749976450.0000000004D86000.00000004.00000001.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directi
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAL5rO9.img?h=368&
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB12jAN6.img?h=27&
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aXITZ.img?h=27&
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://support.skype.com
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.743860219.0000000004A6B000.00000004.00000001.sdmp	String found in binary or memory: https://support.skype.comStart
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.730241937.0000000002C15000.00000004.00000001.sdmp	String found in binary or memory: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://twitter.com/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://twitter.com/i/notifications;Ich
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.774568200.000000000AECB000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.comserverImpressionGuidrefreshDeferredModulesnumItemsSearchResultsCANCELSUBSCRIPTION
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.708837644.00000000063A3000.00000004.00000001.sdmp	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.723237190.000000000461E000.00000004.00000001.sdmp	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?ver=
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.708572604.00000000063C8000.00000004.00000001.sdmp	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1t
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-ss&ued=htt
Source: iab2Data[1].json.0.dr	String found in binary or memory: https://www.bidstack.com/privacy-policy/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	String found in binary or memory: https://www.booking.com/index.nl.html?aid=1274296&Selected_currency=USD;lang=en;label=MSN-US-logo
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.723661812.000000000B1E1000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otBannerSdk
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.751136401.0000000004DEB000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/otSDKStub.js
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.717691081.000000000AEEE000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.718269531.0000000004D31000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.717691081.000000000AEEE000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp4
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.784270057.000000000DA33000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehphttps://www.msn.com/de-ch/?ocid=iehp
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.784270057.000000000DA33000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehphttps://www.msn.com/de-ch/?ocid=iehphttps://www.msn.com/de-ch/?o
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/modules/fetch"
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata"
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.784044422.000000000D9F5000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/https://www.msn.com/de-ch/https://www.msn.com/de-ch/
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/coronareisen
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/regional
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/bank%c3%bcberfall-am-z%c3%bcrcher-r%c3%b6merhofpla
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/die-stadtz%c3%bcrcher-kesb-hat-im-letzten-jahr-meh
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/ein-privatdetektiv-versteckt-einen-gps-sender-in-e
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/erkl%c3%a4rt-z%c3%bcrcher-stadtratswahlen-2022-die
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/frauenstreiktag-mehrere-tausend-frauen-marschierte
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/keine-frau-aber-einer-der-f%c3%bcr-das-klima-in-de
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/lohndeckel-f%c3%bcr-kader%c3%a4rzte-und-weniger-bo
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/bewaffneter-raub-auf-bankfiliale-am-r%c3%b6merhof/ar-AAL4B6u?oc
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/gemeindeversammlung-abgesagt-wegen-grossaufmarsch-von-jugendlic
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/mann-%c3%bcberf%c3%a4llt-z%c3%bcrcher-kiosk-und-stellt-sich-der
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.msn.com/de-ch/sport?ocid=StripeOCID
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_shop_de&utm
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.skype.com/
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.743860219.0000000004A6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://www.skype.com/de
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://www.skype.com/de/download-skype
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=
Source: de-ch[1].htm.0.dr	String found in binary or memory: https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
Source: iab2Data[1].json.0.dr	String found in binary or memory: https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
Source: iab2Data[1].json.0.dr	String found in binary or memory: https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html
Source: 52-478955-68ddb2ab[1].js.0.dr	String found in binary or memory: https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin

Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779

Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49781 version: TLS 1.2

System Summary:

Detected potential unwanted application

Show sources

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

PE Siganture Subject Chain: CN="Anhui Shabake Network Technology Co., Ltd.", OU=è¿è¥, O="Anhui Shabake Network Technology Co., Ltd.", L=Ma'anshan, S=Anhui, C=CN, SERIALNUMBER=91320804MA1MKN9Q0G, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=Ma'anshan, OID.1.3.6.1.4.1.311.60.2.1.2=Anhui, OID.1.3.6.1.4.1.311.60.2.1.3=CN

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Static PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000000.684233336.000000000059E000.00000008.00020000.sdmp	Binary or memory string: OriginalFilenameSEMzf vs AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Binary or memory string: OriginalFilenameSEMzf vs AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Section loaded: uianimation.dll	Jump to behavior

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Static PE information: Section: UPX1 ZLIB complexity 0.991089903438

Source: classification engine

Classification label: mal76.spyw.winEXE@1/49@13/4

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File created: C:\Users\user\AppData\Roaming\GlobalMgr.db

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Mutant created: \Sessions\1\BaseNamedObjects\ATL:MemData03EAAdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File created: C:\Users\user\AppData\Local\Temp\~DF77FCC8E34EAD227A.TMP

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Virustotal: Detection: 74%
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Metadefender: Detection: 22%
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	ReversingLabs: Detection: 79%

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File read: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File written: C:\ProgramData\roundinfo.ini

Jump to behavior

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Static PE information: certificate valid
Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Static PE information: certificate valid

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Memory allocated: 4000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Memory allocated: 6D00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Memory allocated: 6E80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Memory allocated: 6EA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Memory allocated: 6EE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Memory allocated: 6F20000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File opened: PhysicalDrive0

Jump to behavior

Source: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.731781259.000000000F1C1000.00000004.00000001.sdmp

Binary or memory string: mnetTdmnetCIDmnetActmnet_hvmnet_dn3

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\default\Secure Preferences

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	DLL Side-Loading1	Masquerading1	OS Credential Dumping1	Query Registry1	Remote Services	Data from Local System1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion4	LSASS Memory	Security Software Discovery31	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion4	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol13	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing11	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery31	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	75%	Virustotal		Browse
AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	23%	Metadefender		Browse
AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	79%	ReversingLabs	Win32.Adware.Qjwmonkey
AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	100%	Avira	ADWARE/Qjwmonkey.Gen
AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Link
tls13.taboola.map.fastly.net	1%	Virustotal	Browse
w.nanweng.cn	7%	Virustotal	Browse
edge.gycpi.b.yahoodns.net	0%	Virustotal	Browse
img.img-taboola.com	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?	0%	Avira URL Cloud	safe
https://onedrive.live.com;Fotos	0%	Avira URL Cloud	safe
http://www.galapagosdesign.c	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.comk-s	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.carterandcone.comc	0%	URL Reputation	safe
http://www.carterandcone.comc	0%	URL Reputation	safe
http://www.carterandcone.comc	0%	URL Reputation	safe
http://www.carterandcone.coms-m	0%	Avira URL Cloud	safe
http://w.nanweng.cn/qy/gl	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnmM	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnl9	0%	Avira URL Cloud	safe
http://www.carterandcone.comavaq	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cnd	0%	Avira URL Cloud	safe
https://s.mnet-ad.net	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnsw	0%	Avira URL Cloud	safe
http://www.monotype.9	0%	Avira URL Cloud	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://onedrive.live.com;OneDrive-App	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn.	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm.	0%	Avira URL Cloud	safe
http://w.nanweng.cn/qy/png	0%	Avira URL Cloud	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
https://support.skype.comStart	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
contextual.media.net	23.211.6.95	true	false		high
tls13.taboola.map.fastly.net	151.101.1.44	true	false	1%, Virustotal, Browse	unknown
hblg.media.net	23.211.6.95	true	false		high
w.nanweng.cn	47.102.38.15	true	true	7%, Virustotal, Browse	unknown
lg3.media.net	23.211.6.95	true	false		high
geolocation.onetrust.com	104.20.185.68	true	false		high
edge.gycpi.b.yahoodns.net	87.248.118.23	true	false	0%, Virustotal, Browse	unknown
s.yimg.com	unknown	unknown	false		high
web.vortex.data.msn.com	unknown	unknown	false		high
www.msn.com	unknown	unknown	false		high
srtb.msn.com	unknown	unknown	false		high
img.img-taboola.com	unknown	unknown	false	2%, Virustotal, Browse	unknown
cvision.media.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://w.nanweng.cn/qy/gl	true	Avira URL Cloud: safe	unknown
http://w.nanweng.cn/qy/png	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://redirect.viglink.com/?key=29045bc04c786d46d362906f803b13a2&u=https://ebay.comp	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/frauenstreiktag-mehrere-tausend-frauen-marschierte	de-ch[1].htm.0.dr	false		high
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.730241937.0000000002C15000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172	de-ch[1].htm.0.dr	false		high
https://www.msn.com/de-ch/nachrichten/coronareisen	de-ch[1].htm.0.dr	false		high
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	false		high
https://onedrive.live.com;Fotos	52-478955-68ddb2ab[1].js.0.dr	false	Avira URL Cloud: safe	low
https://www.msn.com/de-ch/sport?ocid=StripeOCID	de-ch[1].htm.0.dr	false		high
https://hotmailproxy.msn.com/pm/v1.0/getheaders.aspx	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn	de-ch[1].htm.0.dr	false		high
http://www.fontbureau.com/designers	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.702348761.0000000006382000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.700256163.00000000063A3000.00000004.00000001.sdmp	false		high
https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel	52-478955-68ddb2ab[1].js.0.dr	false		high
https://lg3.media.net/nerrping.php	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false		high
http://ogp.me/ns/fb#	de-ch[1].htm.0.dr	false		high
https://iurl.media.net/dfp/ybntag?&cid=8CU157172&crid=858412214&size=300x250&requrl=$	rtbsmpubs[1].js.0.dr	false		high
https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-ss&ued=htt	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	false		high
https://hblg.media.net/nerrping.php	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748771439.0000000007338000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.c	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.704732919.0000000006386000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/lohndeckel-f%c3%bcr-kader%c3%a4rzte-und-weniger-bo	de-ch[1].htm.0.dr	false		high
https://outlook.live.com/mail/deeplink/compose;Kalender	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://beap.gemini.yahoo.com/mbclk?bv=1.0.0&es=696hVfQGIS9zXA4jWn5xMhDdZtm4WrdQuVr2xIBVfaKTRmZt	auction[1].htm.0.dr	false		high
https://contextual.media.net/dtp.js?	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false		high
https://twitter.com	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	false		high
https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002	de-ch[1].htm.0.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/die-stadtz%c3%bcrcher-kesb-hat-im-letzten-jahr-meh	de-ch[1].htm.0.dr	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://lg3.media.net	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false		high
https://web.vortex.data.msn.com/collect/v1	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.708837644.00000000063A3000.00000004.00000001.sdmp	false		high
https://web.vortex.data.msn.com/collect/v1/t.gif?ver=	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.723237190.000000000461E000.00000004.00000001.sdmp	false		high
http://www.zhongyicts.com.cn	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695822036.000000000637E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.skype.com/	de-ch[1].htm.0.dr	false		high
https://sp.booking.com/index.html?aid=1589774&label=travelnavlink	de-ch[1].htm.0.dr	false		high
http://www.carterandcone.comk-s	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://hblg.media.net/nerrping.php	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748771439.0000000007338000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.704348945.0000000006382000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ad.doubleclick.net/ddm/activity/src=6952136;type=store0;cat=jsll;u58=	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.743860219.0000000004A6B000.00000004.00000001.sdmp	false		high
https://www.msn.com/de-ch/?ocid=iehp4	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.717691081.000000000AEEE000.00000004.00000001.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/regional	de-ch[1].htm.0.dr	false		high
http://www.carterandcone.comd	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695931909.000000000637E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comc	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coms-m	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/?qt=allmyphotos;Aktuelle	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://www.msn.com/de-ch/news/other/mann-%c3%bcberf%c3%a4llt-z%c3%bcrcher-kiosk-und-stellt-sich-der	de-ch[1].htm.0.dr	false		high
https://lg3.media.net/bqi.php	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false		high
https://srtb.msn.com:443/notify/viewedg?rid=50882175e06343329570d6e0394eb3af&r=infopane&i=1&	auction[1].htm.0.dr	false		high
https://contextual.media.net/dtp.js?https://lg3.media.net/nerrping.php	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.731563120.000000000F212000.00000004.00000001.sdmp	false		high
https://amzn.to/2TTxhNg	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	false		high
https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://client-s.gateway.messenger.live.com	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.772828181.0000000004A73000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://www.msn.com/de-ch/	de-ch[1].htm.0.dr	false		high
https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site	52-478955-68ddb2ab[1].js.0.dr	false		high
https://iurl.media.net/dfp/ybntag?&cid=8CU157172&crid=722878611&size=300x250&requrl=$	rtbsmpubs[1].js0.0.dr	false		high
https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river	de-ch[1].htm.0.dr	false		high
https://www.msn.com/de-ch	de-ch[1].htm.0.dr	false		high
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m	de-ch[1].htm.0.dr	false		high
https://lg3.media.net/bping.php?	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false		high
https://twitter.com/i/notifications;Ich	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa	de-ch[1].htm.0.dr	false		high
https://www.msn.com/de-ch/?ocid=iehphttps://www.msn.com/de-ch/?ocid=iehphttps://www.msn.com/de-ch/?o	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.784270057.000000000DA33000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cnmM	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694251158.00000000063A3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/bank%c3%bcberfall-am-z%c3%bcrcher-r%c3%b6merhofpla	de-ch[1].htm.0.dr	false		high
http://www.founder.com.cn/cnl9	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694655949.00000000063A3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.701080282.00000000063A3000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.701055917.0000000006382000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comavaq	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cnd	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695822036.000000000637E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin	52-478955-68ddb2ab[1].js.0.dr	false		high
https://lg3.media.net/flping.php?pid=8POU9IV3U&prid=8PRVV7640	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false		high
https://lg3.media.net/flping.php?pid=8POU9IV3U&prid=8PRVV7640https://c21lg-d.media.net/log?logid=kfk	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.731065618.000000000F2DB000.00000004.00000001.sdmp	false		high
https://web.vortex.data.msn.com/collect/v1t	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.708572604.00000000063C8000.00000004.00000001.sdmp	false		high
https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	false		high
http://ogp.me/ns#	de-ch[1].htm.0.dr	false		high
https://s.mnet-ad.net	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://lg3.media.net/rtblog.php	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.734354299.000000000BCC5000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cnsw	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.694546165.00000000063A3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/?qt=mru;OneDrive-App	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://www.skype.com/de	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.743860219.0000000004A6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://www.booking.com/index.nl.html?aid=1274296&Selected_currency=USD;lang=en;label=MSN-US-logo	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	false		high
https://outlook.live.com/mail/	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp	false		high
http://www.monotype.9	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.707020067.0000000006383000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me	de-ch[1].htm.0.dr	false		high
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.689040095.0000000006311000.00000004.00000001.sdmp, de-ch[1].htm.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.skype.com/de/download-skype	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/ein-privatdetektiv-versteckt-einen-gps-sender-in-e	de-ch[1].htm.0.dr	false		high
https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header	de-ch[1].htm.0.dr	false		high
http://www.hotmail.msn.com/pii/ReadOutlookEmail/	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false		high
https://onedrive.live.com;OneDrive-App	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.709110879.000000000BB6B000.00000004.00000001.sdmp, 52-478955-68ddb2ab[1].js.0.dr	false	Avira URL Cloud: safe	low
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&	de-ch[1].htm.0.dr	false		high
http://www.zhongyicts.com.cn.	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	55a804ab-e5c6-4b97-9319-86263d365d28[1].json.0.dr	false		high
http://www.galapagosdesign.com/staff/dennis.htm.	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.704470230.0000000006382000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.748850803.0000000007241000.00000004.00000001.sdmp	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1	52-478955-68ddb2ab[1].js.0.dr	false		high
http://www.carterandcone.com	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.696063652.000000000637E000.00000004.00000001.sdmp, AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.695931909.000000000637E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway	52-478955-68ddb2ab[1].js.0.dr	false		high
https://s.yimg.com/lo/api/res/1.2/4ZESs6Q5ib.T5INTDEWXYA--~A/Zmk9ZmlsbDt3PTMxMTtoPTMzMzthcHBpZD1nZW1	auction[1].htm.0.dr	false		high
https://support.skype.comStart	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.743860219.0000000004A6B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otBannerSdk	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, 00000000.00000003.723661812.000000000B1E1000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.185.68	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
87.248.118.23	edge.gycpi.b.yahoodns.net	United Kingdom	203220	YAHOO-DEBDE	false
47.102.38.15	w.nanweng.cn	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
151.101.1.44	tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	435218
Start date:	16.06.2021
Start time:	08:29:28
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.spyw.winEXE@1/49@13/4
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.113.196.254, 52.147.198.201, 13.107.3.254, 23.211.6.115, 13.107.246.254, 40.88.32.150, 184.24.20.248, 204.79.197.203, 80.67.82.240, 80.67.82.209, 104.42.151.234, 20.82.210.154, 65.55.44.109, 20.54.7.98, 40.112.88.60, 20.54.104.15, 23.211.6.95, 80.67.82.235, 80.67.82.211, 20.50.102.62, 20.54.26.129 Excluded domains from analysis (whitelisted): s-ring.msedge.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e11290.dspg.akamaiedge.net, teams-9999.teams-msedge.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, go.microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, a-0003.a-msedge.net, ris-prod.trafficmanager.net, cvision.media.net.edgekey.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, www-msn-com.a-0003.a-msedge.net, a1999.dscg2.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, s-ring.s-9999.s-msedge.net, t-ring.msedge.net, web.vortex.data.trafficmanager.net, e607.d.akamaiedge.net, web.vortex.data.microsoft.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, t-9999.t-msedge.net, s-9999.s-msedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, static-global-s-msn-com.akamaized.net, teams-ring.teams-9999.teams-msedge.net, teams-ring.msedge.net, t-ring.t-9999.t-msedge.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Execution Graph export aborted for target AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe, PID 7004 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:30:40	API Interceptor	3x Sleep call for process: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.20.185.68	YiIS9HvO21.dll	Get hash	malicious	Browse
	1hIvIzTHG5.dll	Get hash	malicious	Browse
	xl7FJ4h7YS.dll	Get hash	malicious	Browse
	xDxD5fLpPC.dll	Get hash	malicious	Browse
	YiIS9HvO21.dll	Get hash	malicious	Browse
	AQvfg6cfsH.dll	Get hash	malicious	Browse
	ciPe3thWYs.dll	Get hash	malicious	Browse
	Gyy7RiM9li.dll	Get hash	malicious	Browse
	ZidEUS6p28.dll	Get hash	malicious	Browse
	KbflZxAKaI.dll	Get hash	malicious	Browse
	vOMwtcyyhp.dll	Get hash	malicious	Browse
	qLr3D0MijC.dll	Get hash	malicious	Browse
	GepoMLes3O.dll	Get hash	malicious	Browse
	Gyy7RiM9li.dll	Get hash	malicious	Browse
	ZidEUS6p28.dll	Get hash	malicious	Browse
	7cagti5try.dll	Get hash	malicious	Browse
	I6if5EHUpo.dll	Get hash	malicious	Browse
	FPVBnUhlyK.dll	Get hash	malicious	Browse
	W0KYBwuhXV.dll	Get hash	malicious	Browse
	NVuZ2JfHQu.dll	Get hash	malicious	Browse
87.248.118.23	http://www.prophecyhour.com	Get hash	malicious	Browse	us.i1.yimg.com/us.yimg.com/i/yg/img/i/us/ui/join.gif
	http://www.forestforum.co.uk/showthread.php?t=47811&page=19	Get hash	malicious	Browse	yui.yahooapis.com/2.9.0/build/animation/animation-min.js?v=4110
	http://ducvinhqb.com/service.html	Get hash	malicious	Browse	us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo4.gif

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
contextual.media.net	HETZ.dll	Get hash	malicious	Browse	23.211.6.95
	HETZ.dll	Get hash	malicious	Browse	23.211.6.95
	YiIS9HvO21.dll	Get hash	malicious	Browse	104.76.200.23
	1hIvIzTHG5.dll	Get hash	malicious	Browse	104.76.200.23
	xl7FJ4h7YS.dll	Get hash	malicious	Browse	104.76.200.23
	xDxD5fLpPC.dll	Get hash	malicious	Browse	104.76.200.23
	YiIS9HvO21.dll	Get hash	malicious	Browse	104.76.200.23
	AQvfg6cfsH.dll	Get hash	malicious	Browse	104.76.200.23
	1hIvIzTHG5.dll	Get hash	malicious	Browse	104.76.200.23
	0WX1X0cxwl.dll	Get hash	malicious	Browse	104.76.200.23
	34EH2vRFeU.dll	Get hash	malicious	Browse	104.76.200.23
	xl7FJ4h7YS.dll	Get hash	malicious	Browse	104.76.200.23
	ciPe3thWYs.dll	Get hash	malicious	Browse	104.76.200.23
	wD6XXcjb2g.dll	Get hash	malicious	Browse	104.76.200.23
	Gyy7RiM9li.dll	Get hash	malicious	Browse	104.76.200.23
	ZidEUS6p28.dll	Get hash	malicious	Browse	104.76.200.23
	wD6XXcjb2g.dll	Get hash	malicious	Browse	104.76.200.23
	KbflZxAKaI.dll	Get hash	malicious	Browse	104.76.200.23
	vOMwtcyyhp.dll	Get hash	malicious	Browse	104.76.200.23
	qLr3D0MijC.dll	Get hash	malicious	Browse	92.122.146.68
tls13.taboola.map.fastly.net	HETZ.dll	Get hash	malicious	Browse	151.101.1.44
	HETZ.dll	Get hash	malicious	Browse	151.101.1.44
	1hIvIzTHG5.dll	Get hash	malicious	Browse	151.101.1.44
	xl7FJ4h7YS.dll	Get hash	malicious	Browse	151.101.1.44
	1hIvIzTHG5.dll	Get hash	malicious	Browse	151.101.1.44
	34EH2vRFeU.dll	Get hash	malicious	Browse	151.101.1.44
	xl7FJ4h7YS.dll	Get hash	malicious	Browse	151.101.1.44
	ciPe3thWYs.dll	Get hash	malicious	Browse	151.101.1.44
	wD6XXcjb2g.dll	Get hash	malicious	Browse	151.101.1.44
	KbflZxAKaI.dll	Get hash	malicious	Browse	151.101.1.44
	vOMwtcyyhp.dll	Get hash	malicious	Browse	151.101.1.44
	GepoMLes3O.dll	Get hash	malicious	Browse	151.101.1.44
	7CQbs2Vl49.dll	Get hash	malicious	Browse	151.101.1.44
	FPVBnUhlyK.dll	Get hash	malicious	Browse	151.101.1.44
	iOXplu4vUa.dll	Get hash	malicious	Browse	151.101.1.44
	W0KYBwuhXV.dll	Get hash	malicious	Browse	151.101.1.44
	NVuZ2JfHQu.dll	Get hash	malicious	Browse	151.101.1.44
	NVuZ2JfHQu.dll	Get hash	malicious	Browse	151.101.1.44
	T1ILPFy741.dll	Get hash	malicious	Browse	151.101.1.44
	YoumWoF23r.dll	Get hash	malicious	Browse	151.101.1.44

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	UM6rAJhKEq.exe	Get hash	malicious	Browse	47.117.70.170
	mAGs0IsoB7.exe	Get hash	malicious	Browse	47.117.70.170
	KuMTnLOuSZ.exe	Get hash	malicious	Browse	47.117.70.170
	o5ZGIQwDed.exe	Get hash	malicious	Browse	47.117.70.170
	UM6rAJhKEq.exe	Get hash	malicious	Browse	106.15.48.27
	mAGs0IsoB7.exe	Get hash	malicious	Browse	106.15.48.27
	IJ9cCBb4Tv.exe	Get hash	malicious	Browse	106.15.48.27
	KuMTnLOuSZ.exe	Get hash	malicious	Browse	106.15.48.27
	o5ZGIQwDed.exe	Get hash	malicious	Browse	106.15.48.27
	17mqa66sU6.exe	Get hash	malicious	Browse	47.117.76.6
	FjzWYXTUop.exe	Get hash	malicious	Browse	139.224.193.172
	czmPR2gmQI.exe	Get hash	malicious	Browse	121.40.19.56
	6K6EBFC653	Get hash	malicious	Browse	101.201.199.196
	MedMooc.exe	Get hash	malicious	Browse	120.27.25.246
	#U8c37#U6b4c#U97e9#U6587#U8f93#U5165#U6cd5(Google Korean Input)_011589485.exe	Get hash	malicious	Browse	60.205.177.239
	tgb4.exe	Get hash	malicious	Browse	39.98.88.43
	testtotesnotrealname.exe	Get hash	malicious	Browse	47.102.143.195
	xiaoan_3.0.apk	Get hash	malicious	Browse	203.119.214.123
	h5plugin_1.1.apk	Get hash	malicious	Browse	47.104.217.248
	98b537971f7b5b5331c4b1ce0079633c.apk	Get hash	malicious	Browse	115.29.160.1
YAHOO-DEBDE	1hIvIzTHG5.dll	Get hash	malicious	Browse	87.248.118.22
	34EH2vRFeU.dll	Get hash	malicious	Browse	87.248.118.23
	xl7FJ4h7YS.dll	Get hash	malicious	Browse	87.248.118.23
	ciPe3thWYs.dll	Get hash	malicious	Browse	87.248.118.22
	wD6XXcjb2g.dll	Get hash	malicious	Browse	87.248.118.23
	KbflZxAKaI.dll	Get hash	malicious	Browse	87.248.118.22
	vOMwtcyyhp.dll	Get hash	malicious	Browse	87.248.118.23
	GepoMLes3O.dll	Get hash	malicious	Browse	87.248.118.23
	7CQbs2Vl49.dll	Get hash	malicious	Browse	87.248.118.22
	iOXplu4vUa.dll	Get hash	malicious	Browse	87.248.118.22
	7cagti5try.dll	Get hash	malicious	Browse	87.248.118.22
	FPVBnUhlyK.dll	Get hash	malicious	Browse	87.248.118.22
	W0KYBwuhXV.dll	Get hash	malicious	Browse	87.248.118.23
	NVuZ2JfHQu.dll	Get hash	malicious	Browse	87.248.118.22
	NVuZ2JfHQu.dll	Get hash	malicious	Browse	87.248.118.22
	YoumWoF23r.dll	Get hash	malicious	Browse	87.248.118.22
	7#U1d05.html	Get hash	malicious	Browse	87.248.118.23
	xwebpic10.ocx	Get hash	malicious	Browse	87.248.118.23
	xwebpic10.ocx	Get hash	malicious	Browse	87.248.118.23
	1EFNborqwh.dll	Get hash	malicious	Browse	87.248.118.22
CLOUDFLARENETUS	PO-006 dtd-15.06.2021.exe	Get hash	malicious	Browse	104.21.15.48
	#U65b0#U8a02#U55ae_WJO-001.pdf.exe	Get hash	malicious	Browse	104.21.19.200
	Zalando_mail_14.exe	Get hash	malicious	Browse	104.21.19.200
	6334-Hanglung.com.html	Get hash	malicious	Browse	104.16.18.94
	SecuriteInfo.com.W32.AIDetect.malware1.3553.exe	Get hash	malicious	Browse	172.67.206.104
	TscZlF3lqk.exe	Get hash	malicious	Browse	104.21.69.75
	8ti0qjm60b.exe	Get hash	malicious	Browse	172.67.137.101
	arm_crypt.exe	Get hash	malicious	Browse	172.67.188.10
	yfr02XrveJ.exe	Get hash	malicious	Browse	172.67.129.162
	ePThje5TvU.exe	Get hash	malicious	Browse	1.0.0.1
	PO#006611.doc.exe	Get hash	malicious	Browse	23.227.38.74
	ccbf1853c703609eda36bc07ab8eb2faf692153b56ecf.exe	Get hash	malicious	Browse	104.21.10.13
	Minutes of Meeting.exe	Get hash	malicious	Browse	104.21.19.200
	Consigment Details_pdf.exe	Get hash	malicious	Browse	104.21.19.200
	newr.exe	Get hash	malicious	Browse	162.159.133.233
	VM_5823_05_24_2-2.html	Get hash	malicious	Browse	104.18.11.207
	bigfish.exe	Get hash	malicious	Browse	104.21.19.200
	INQUIRY for IFM 20207.xlsx	Get hash	malicious	Browse	172.67.158.246
	WGOc4eHYqX.exe	Get hash	malicious	Browse	104.18.193.20
	Citibank Payment Advice.xlsx	Get hash	malicious	Browse	162.159.134.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	Agenda1.docx	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	7#U1d05.html	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	tender-2038988342.xlsm	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	file_55743.xlsb	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	zxlPLHX1Fx.xlsb	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	newr.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	SwiftDocument.HTML	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	3uOVAaXGdV.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	sentence-1711450431.xlsm	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	SecuriteInfo.com.BackDoor.Rat.281.18292.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	AZ2066 Elektronische Zustellung.pdf.js	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	AZ2066 Elektronische Zustellung.pdf.js	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	L1GMUV4MyG.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	Install.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	Install.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	RFQ No3756368.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	IFS PO#268731 RFQ NEW IFS PO#268731.exe	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	hG6FzLXtsf.xls	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	documentation_71202.xlsb	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44
	invoice_sh.html	Get hash	malicious	Browse	104.20.185.68 87.248.118.23 151.101.1.44

Dropped Files

No context

Created / dropped Files

C:\ProgramData\roundinfo.ini Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.345350936622436
Encrypted:	false
SSDEEP:	3:SIUTjeboSD4Vy:SpP0oSD4Vy
MD5:	3AB06B6DF4EBB37DFFE3C18CF45A6714
SHA1:	098A6060700C42EED986CC30BDAE5BD64D4A6CCB
SHA-256:	1AB564078DA943CAD5CBF2D16F6E01AAE250405DB8AAC5CFE42AA9D1450A3C87
SHA-512:	FA2DC3E7BA12DC7F4115C57B2525A402E559439DD3EA5DA598612756080BCB132EDF50E7E692EFD90A076E7E5B0E1A3A0E413CB0453D47FDE5341E0CC362E04A
Malicious:	false
Reputation:	low
Preview:	[info]..time=2021-6-16..round=1..install=0..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\contextual.media[1].xml Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2876
Entropy (8bit):	4.883050421907684
Encrypted:	false
SSDEEP:	48:1lmlmlmlm9m9am9m9sm9mqmqmqmqqmqmTmTqmTmTYQmTYQTY2ydm2ydm2ydm2ydx:LYYY88a88s8JJJJqJ00q00YQ0YQTfyde
MD5:	350B2AC809C47D50A40F6B8904D4B165
SHA1:	86C5CA0716A4539E44567CFD7EAF571EDAF9A4E5
SHA-256:	1744A981CAD669F722D210FFE22B0A45EA51E66ACD134203F08123FC31CB0982
SHA-512:	C3F945F8E3406CF9BD897896EE8BBECF2A75D7B23E785DF0D4994F5694916D4D55045D903C155FB2E61985E297E68A52CD8ED70D27C9E7CBE4280D85E38BCCBB
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root><root></root><root><item name="HBCM_BIDS" value="{}" ltime="996656160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="996656160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="996656160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="996656160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="997596160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="997596160" htime="30892665" /><item name="mntest" value="mntest" ltime="997596160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="997596160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="997596160" htime="30892665" /><item name="mntest" value="mntest" ltime="1004626160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="997596160" htime="30892665" /></root><root><item name="HBCM_BIDS" value="{}" ltime="1009626160" h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\2d-0e97d4-185735b[1].css Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	239028
Entropy (8bit):	5.308717262113067
Encrypted:	false
SSDEEP:	3072:jaPMUzTAHEkm8OUdvUvYZkru/rpjp4tQH:ja0UzTAHLOUdvNZkru/rpjp4tQH
MD5:	698D988CE30A0D869084532DD6C4F50E
SHA1:	CF9D92343C223D28ED3B3609F3F03B779384BF78
SHA-256:	B2E436E0FFE3BB69BC6EC9192C617699C9530C490F23C115AC32CB28208F49BA
SHA-512:	6BECF19B6F075A448FD173EDFEF42BAA4FF5CECEA953340751DF2658E07D7FB997A4F2B3F38558879194721893518FA95CC222CDB2D6F9F738851B6B45CAD8BB
Malicious:	false
Reputation:	low
Preview:	@charset "UTF-8";div.adcontainer iframe[width='1']{display:none}span.nativead{font-weight:600;font-size:1.1rem;line-height:1.364}div:not(.ip) span.nativead{color:#333}.todaymodule .smalla span.nativead,.todaystripe .smalla span.nativead{bottom:2rem;display:block;position:absolute}.todaymodule .smalla a.nativead .title,.todaystripe .smalla a.nativead .title{max-height:4.7rem}.todaymodule .smalla a.nativead .caption,.todaystripe .smalla a.nativead .caption{padding:0;position:relative;margin-left:11.2rem}.todaymodule .mediuma span.nativead,.todaystripe .mediuma span.nativead{bottom:1.3rem}.ip a.nativead span:not(.title):not(.adslabel),.mip a.nativead span:not(.title):not(.adslabel){display:block;vertical-align:top;color:#a0a0a0}.ip a.nativead .caption span.nativead,.mip a.nativead .caption span.nativead{display:block;margin:.9rem 0 .1rem}.ip a.nativead .caption span.sourcename,.mip a.nativead .caption span.sourcename{margin:.5rem 0 .1rem;max-width:100%}.todaymodule.mediuminfopanehero .ip_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\9613c9ec-f6af-436d-aaf0-fc59d3035efd[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	downloaded
Size (bytes):	80732
Entropy (8bit):	7.973756711786
Encrypted:	false
SSDEEP:	1536:7MtfpdaZvFiG8vxUzZGIZcvrQTBOxm0yA8mlSjgcwKPd5xK71kqYUZ40SLZ8wx:7MXdM9N8cZGIaTSB0WAi6ed5xQf40SLz
MD5:	036F4C97AB11EC74EAD1952474B305D6
SHA1:	23C2D0E0793FB3DEA2C4FEC96B8FCA9F25278560
SHA-256:	BCD6F5D05FC27EEEC8F4F026208247EFB1BA17BB9629852947BBC89A029A4414
SHA-512:	9CB4D2CB2A05FA33DE9EA2C03AF07EC0424F097623D3AF7397AD677B8AEA4D925D78616EE2339539FF99EB76E7F715657D1DA85269884541E001146DBE47DBFB
Malicious:	false
Reputation:	low
IE Cache URL:	https://cvision.media.net/new/300x300/2/235/74/82/9613c9ec-f6af-436d-aaf0-fc59d3035efd.jpg?v=9
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................I...........................!..1."A.Q.#2a.Bq..$3..R.%4....Cbr.&6DS.cs......................................C.........................!..1."A.Q2aq..#..BR.....$3b.....%&4C.6r.............?.;=...Q{......W..C.a/...K6^U.'.,j)B..3...'..S.....2.._..............%.]m.k..S..9c.<.\h..k.J...Y.^P...2...<..."i..n..r....J...>w;.......G..e..;k............t....y....-.l..sG$..}...O....._.B.....q.;.6...S......g..]@,.......7>....Tz..K.9.t...w.vzi..'c.zI..Tt^.M.6....`\|....mE5.E....V.5Q......V.....h.FE..Zvf%...6.i......+.U.m..E..~....}..9...u..O....:..1......?..fK..p.....Q.;4"yd.,.K..y.G...+....%.UJ..9ZX39.S*.R..i.X.r..F[..W...3.........MU5.u..-5(.1R...Y^!MT....$m..1\|.E[~..,....x..T........u.+X.O..,i\.qa.}...%..d...?Od..f.X.1.4.X...W!..@...g...Y5....{..S...w1..:_..+5..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BBnYSFZ[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	7.4464066014795485
Encrypted:	false
SSDEEP:	12:6v/7oFyvunVNrddHWjrT0rTKQIxOiYeJbW8Ll1:RFyiDrqTSQxLYeBW8Lz
MD5:	991DB6ED4A1C71F86F244EEA7BBAD67F
SHA1:	D30FDEDFA2E1A2DB0A70E4213931063F9F16E73D
SHA-256:	372F26F466B6BF69B9D981CB4942FE33301AAA25BE416DDE9E69CF5426CD2556
SHA-512:	252D9F26FA440D79BA358B010E77E4B5B61C45F5564A6655C87436002B4B7CB63497E6B5EEB55F8787626DA8A32C5FCEF977468F7B48B59D19DE34EA768B2941
Malicious:	false
Reputation:	moderate, very likely benign file
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx......Q..?WE..P...)h...."".....?a.....55.4.....EECDZ.A.%M0.A.%....<../..z.}.s..>..<.y_.....6../S.z.....(..s9:....b.`2.X..l6..X...F..N..x<.r...j...........<>..D"A......-.~...M .`2.`.Z...r1.N..b.v;..Z.z..R,.I&...A:.......~?....NG.Vc.X..4.M......Ta.....l&.....,...F...v....j."....zI.R.&....r.zi..a.rY..f3.\N6Qt?......U..5..R.VI..D"...,.^O..p....._>q.....!.\|....K.w....J_.x.=...1y~..C{.<F...>..:\|...g.\|....8..?.....;.yM.f@..<.....u..kv.L.5n.....m.M...O....V.G.Q......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\a8a064[1].gif Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	GIF image data, version 89a, 28 x 28
Category:	downloaded
Size (bytes):	16360
Entropy (8bit):	7.019403238999426
Encrypted:	false
SSDEEP:	384:g2SEiHys4AeP/6ygbkUZp72i+ccys4AeP/6ygbkUZaoGBm:g2Tjs4Ae36kOpqi+c/s4Ae36kOaoGm
MD5:	3CC1C4952C8DC47B76BE62DC076CE3EB
SHA1:	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979
SHA-256:	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
SHA-512:	5CC1E6F9DACA9CEAB56BD2ECEEB7A523272A664FE8EE4BB0ADA5AF983BA98DBA8ECF3848390DF65DA929A954AC211FF87CE4DBFDC11F5DF0C6E3FEA8A5740EF7
Malicious:	false
Reputation:	high, very likely benign file
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Preview:	GIF89a.......dbd...........lnl.........trt..................!..NETSCAPE2.0.....!.......,..........+..I..8...`(.di.h..l.p,..(.........5H.....!.......,.........dbd...........lnl......dfd....................../..I..8...`(.di.h..l..e.....Q... ..-.3...r...!.......,.........dbd..............tvt...........................*P.I..8...`(.di.h.v.....A<.. ......pH,.A..!.......,.........dbd........\|~\|......trt...ljl.........dfd......................................................B`%.di.h..l.p,.t]S......^..hD..F. .L..tJ.Z..l.080y..ag+...b.H...!.......,.........dbd.............ljl.............dfd........lnl..............................................B.$.di.h..l.p.'J#............9..Eq.l:..tJ......E.B...#.....N...!.......,.........dbd...........tvt.....ljl.......dfd.........\|~\|.............................................D.$.di.h..l.NC.....C...0..)Q..t...L:..tJ.....T..%...@.UH...z.n.....!.......,.........dbd..............lnl.........ljl......dfd...........trt...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\checksync[1].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302761373207805
Encrypted:	false
SSDEEP:	384:RIAGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOLQWwY4RXrqt:Q86qhbS2RxF3OsLQWwY4RXrqt
MD5:	A1EF805AA91F780CDF0CF4E76C6BF832
SHA1:	483C3961ADDAC604C7F5A0FEEBE50B31D895A259
SHA-256:	F5AF1444ED12476886A3594A5E696CADD4BFC46EA90A66C08F875E9750C93778
SHA-512:	FB14B11759D9CEDC224627908D91D7C1CF27D213FE1350883AD5F3EAA8D9D681346143B86708F63ECD1377D614CE348212AA0E9C8C6EB1B7DA539F1554F7C895
Malicious:	false
Reputation:	low
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\de-ch[1].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	426932
Entropy (8bit):	5.445162355156937
Encrypted:	false
SSDEEP:	3072:PJbJUsxx+96kf8fsovH4M+PnRweBjTpgCNjrkOMNQg9tLnKIiEdfdLU:PJbVO97wCSOrEdf+
MD5:	46CA272B7A21B4E6C77D0FA92330D042
SHA1:	154337CA85E27EC68D60F5881B8E7106F4DA060B
SHA-256:	7BCC5F6E6908B31123F1CF1B10794787C4625DDF9EA1FC6CB2B1A76FF4AA63E7
SHA-512:	CB10C91EC810FE55766C259F15BABBBF25DAC6BAFDC069B046FE7D75203F6991005C257D3C18F5486D095448BF8FA00453780E41400988FD95D3D43DEC30B5AB
Malicious:	false
Preview:	<!DOCTYPE html><html prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#" lang="de-CH" class="hiperf" dir="ltr" >..<head data-info="v:20210613_21772534;a:50882175-e063-4332-9570-d6e0394eb3af;cn:5;az:{did:951b20c4cd6d42d29795c846b4755d88, rid: 5, sn: neurope-prod-hp, dt: 2021-06-06T00:27:54.6823191Z, bt: 2021-06-13T21:32:26.5848809Z};ddpi:1;dpio:;dpi:1;dg:tmx.pc.ms.ie10plus;th:start;PageName:startPage;m:de-ch;cb:;l:de-ch;mu:de-ch;ud:{cid:,vk:homepage,n:,l:de-ch,ck:};xd:BBqgbZW;ovc:f;al:;fxd:f;xdpub:2021-06-14 10:00:39Z;xdmap:2021-06-16 06:29:55Z;axd:;f:msnallexpusers,muidflt17cf,muidflt19cf,muidflt298cf,startedge2cf,complianceedge1cf,moneyhp1cf,bingcollabhp1cf,bingcollabhp3cf,starthz1cf,audexhz3cf,onetrustpoplive,1s-bing-news,vebudumu04302020,bbh20200521msncf,msnsports4cf,prg-1sw-clarity,is-uiprc,1s-winblis,1s-winblisp1,prg-adspeek,prg-entdsh,prg-entdash,1s-feedcachectl;userOptOut:false;userOptOutOptions:" data-js="{"dpi":1.0,"ddpi":1.0,"dpio":null,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\e151e5[1].gif Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.122191481864228
Encrypted:	false
SSDEEP:	3:CUTxls/1h/:7lU/
MD5:	F8614595FBA50D96389708A4135776E4
SHA1:	D456164972B508172CEE9D1CC06D1EA35CA15C21
SHA-256:	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
SHA-512:	299A7712B27C726C681E42A8246F8116205133DBE15D549F8419049DF3FCFDAB143E9A29212A2615F73E31A1EF34D1F6CE0EC093ECEAD037083FA40A075819D2
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\http___cdn.taboola.com_libtrc_static_thumbnails_f421cafcbd1bae3e4dfb04069c71753a[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	19127
Entropy (8bit):	7.971727330550156
Encrypted:	false
SSDEEP:	384:/QotVY29ER6YLzOVSmSaa/qsLvmJ3JXvU91fqpO/KQySzut:/M298tL6VSmg6vvUrLlCt
MD5:	7F0050881CEF932410C026603B6C8D4F
SHA1:	B69CAF984EFEEA22A129E05D6DD03D9BD9398ADB
SHA-256:	0134069D0FC2BE9ACB307BBFA8189BB0E3FBDA505A9EBA5CFF770FABD26846AD
SHA-512:	5979AE2CE087B013D38F9BB449894AFC1368555A707DF1271AA1EDB74EC01A9C091BF75DF581E6D37CE634D27B19B29781CF7F44ED1F37DE82AB3BD4B44D5B42
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2Ff421cafcbd1bae3e4dfb04069c71753a.jpg
Preview:	......JFIF..........................................."......".$...$.6&&6>424>LDDL_Z_\|\|.......................%.....%8#)##)#82<1.1<2YF>>FYgVRVg}pp}............7...............4.................................................................n.!.... @....... @...... x. @.........,..G...... @....... @K.....n.....`@......... @......K..^..E...vc7.a...(.. p@....J.B....(.>.;...=...]...x.......... p@........~..].}.v.h.e..}....K.......K...!..@. .....k68....Cu....4...J.@..pp@..@...D..$Q..^...._..f....w....2A8$........%..$FH..<..S.b.\.U..Y....M..A...+vI.J%........`..D$.1...r\.].....p.VN...Vn..u.......M....9............N5Z..z......z..N.p...X..s..Z....<..{......-1.889..'...)...z......2..Y...i.v<......-.%.S.9..^..{.7.<..J..g.b9....a..n..e{..z;.._.?..\|.c..Vn.].%..;/5.4.S..F{.x.>s..;y..!i.Kny........E.tu.D...^.A...Y...7^..E..>`.......JC.........._.[b"......r..............l.8....[.w...Jc...=7.3...t...n...+.U.Z=..M;:..x).W.N..,....k[UX`.....V..!e@uc.b.FM..._N...../.<.7._.V..S.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-2.1.1.min[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	84249
Entropy (8bit):	5.369991369254365
Encrypted:	false
SSDEEP:	1536:DPEkjP+iADIOr/NEe876nmBu3HvF38NdTuJO1z6/A4TqAub0R4ULvguEhjzXpa9r:oNM2Jiz6oAFKP5a98HrY
MD5:	9A094379D98C6458D480AD5A51C4AA27
SHA1:	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E
SHA-256:	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
SHA-512:	4BBB1CCB1C9712ACE14220D79A16CAD01B56A4175A0DD837A90CA4D6EC262EBF0FC20E6FA1E19DB593F3D593DDD90CFDFFE492EF17A356A1756F27F90376B650
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquery-2.1.1.min.js
Preview:	/! jQuery v2.1.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,funct

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\medianet[1].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	396526
Entropy (8bit):	5.487806331736343
Encrypted:	false
SSDEEP:	6144:zKHk+yxBq+vb0DnmWynGhI8JgW3wCu1blanHsU91I7:Vq+vwDmnGe8JgPxVKF1I7
MD5:	02BC2E5D5AE377A216893142D1E84B6F
SHA1:	DF9292F61B54116ACC8CE180DD087A39708AA729
SHA-256:	0A0926BEE9AF78ED7C14CBB5D5CB619FC6BA00E664FDFF6945452FC54A0868C6
SHA-512:	304C8A4BD2E03B27BEE9010E5FA170CA1B7CBFCDA55D8455C5AD98D07F67E7B841B3F8A7F454CDC8E2C3215F60134BA49421E08FB7F90DAD080060A4AD9AE24D
Malicious:	false
IE Cache URL:	https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\medianet[2].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	396526
Entropy (8bit):	5.487829638936123
Encrypted:	false
SSDEEP:	6144:zKHk+yxBq+vb0DnmWynGhI8JgW3wCu1bBanHsU91I7:Vq+vwDmnGe8JgPxVeF1I7
MD5:	3B7543E633448C62202B94A3DE56C5BA
SHA1:	D9315337681B236528FBE1CA851F830AC4E8CBA3
SHA-256:	0623BA42B2C3990085B1D56C2AB7A5C67490A1AD100DEA593E45CFFD5B042831
SHA-512:	5492EE5FD4DA452A05F2E06817C623E9A149DDAF460CB5112D6C194F12C8BAE86FCEE1C334DBC7D58FD8BFD67C3CD04AB127524D27F123198B02207EC8D45B42
Malicious:	false
IE Cache URL:	https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\otBannerSdk[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	374818
Entropy (8bit):	5.338137698375348
Encrypted:	false
SSDEEP:	3072:axBt4stoUf3MiPnDxOFvxYyTcwY+OiHeNUQW2SzDZTpl1L:NUfbPnDxOFvxYyY+Oi+yQW2CDZTn1L
MD5:	2E5F92E8C8983AA13AA99F443965BB7D
SHA1:	D80209C734F458ABA811737C49E0A1EAF75F9BCA
SHA-256:	11D9CC951D602A168BD260809B0FA200D645409B6250BD8E8996882EBE3F5A9D
SHA-512:	A699BEC040B1089286F9F258343E012EC2466877CC3C9D3DFEF9D00591C88F976B44D9795E243C7804B62FDC431267E1117C2D42D4B73B7E879AEFB1256C644B
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otBannerSdk.js
Preview:	/** .. * onetrust-banner-sdk.. * v6.13.0.. * by OneTrust LLC.. * Copyright 2021 .. */..!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)t.hasOwnProperty(o)&&(e[o]=t[o])})(e,t)};var r=function(){return(r=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function a(s,i,l,a){return new(l=l\|\|Promise)(function(e,t){function o(e){try{r(a.next(e))}catch(e){t(e)}}function n(e){try{r(a.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new l(function(e){e(t.value)}).then(o,n)}r((a=a.apply(s,i\|\|[])).next())})}function d(o,n){var r,s,i,e,l={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\4996b9[1].woff Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	Web Open Font Format, TrueType, length 45633, version 1.0
Category:	downloaded
Size (bytes):	45633
Entropy (8bit):	6.523183274214988
Encrypted:	false
SSDEEP:	768:GiE2wcDeO5t68PKACfgVEwZfaDDxLQ0+nSEClr1X/7BXq/SH0Cl7dA7Q/B0WkAfO:82/DeO5M8PKASCZSvxQ0+TCPXtUSHF7c
MD5:	A92232F513DC07C229DDFA3DE4979FBA
SHA1:	EB6E465AE947709D5215269076F99766B53AE3D1
SHA-256:	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
SHA-512:	32A33CC9D6F2F1C962174F6CC636053A4BFA29A287AF72B2E2825D8FA6336850C902AB3F4C07FB4BF0158353EBBD36C0D367A5E358D9840D70B90B93DB2AE32D
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Preview:	wOFF.......A...........................,....OS/2...p...`...`B.Y.cmap.............G.glyf.......,...,0..Hhead.......6...6....hhea...,...$...$....hmtx............($LKloca...`...f...f....maxp...P... ... ....name............IU..post....... ... ............I.A_.<........... ........d........................^...q.d.Z.................................................................3.......3.....f..............................HL .@...U...f.........................................\.d.\.d...d.e.d.Z.d.b.d.4.d.=.d.Y.d.c.d.].d.b.d.I.d.b.d.f.d._.d.^.d.(.d.b.d.^.d.b.d.b.d...d...d._.d._.d...d...d.P.d.0.d.b.d.b.d.P.d.u.d.c.d.^.d._.d.q.d._.d.d.d.b.d._.d._.d.b.d.a.d.b.d.a.d.b.d...d...d.^.d.^.d.`.d.[.d...d...d.$.d.p.d...d...d.^.d._.d.T.d...d.b.d.b.d.b.d.i.d.d.d...d...d...d.7.d.^.d.X.d.].d.).d.l.d.l.d.b.d.b.d.,.d.,.d.b.d.b.d...d...d...d.7.d.b.d.1.d.b.d.b.d...d...d...d...d...d.A.d...d...d.(.d.`.d...d...d.^.d.r.d.f.d.,.d.b.d...d.b.d._.d.q.d...d...d.b.d.b.d.b.d.b.d...d.r.d.I.d._.d.b.d.b.d.b.d.V.d.Z.d.b.d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\55a804ab-e5c6-4b97-9319-86263d365d28[1].json Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2939
Entropy (8bit):	4.794189660497687
Encrypted:	false
SSDEEP:	48:Y9vlgmDHF6Bjb40UMRBrvdiZv5Gh8aZa6AyYAcHHPk5JKIcFerZjSaSZjfumjVT4:OymDwb40zrvdip5GHZa6AymshjUjVjx4
MD5:	B2B036D0AFB84E48CDB782A34C34B9D5
SHA1:	DFC7C8BA62D71767F2A60AED568D915D1C9F82D6
SHA-256:	DC51F0A9F93038659B0DB1B69B69FCFB00FB5911805F8B1E40591F9867FD566F
SHA-512:	C2AAAF7BC1DF73018D92ABD994AF3C0041DCCE883C10F4F4E17685CD349B3AF320BBA29718F98CFF6CC24BE4BDD5360E1D3327AFFBF0C87622AE7CBAB677CF22
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json
Preview:	{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"LOCAL","Version":"6.4.0","OptanonDataJSON":"55a804ab-e5c6-4b97-9319-86263d365d28","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","RuleSet":[{"Id":"6f0cca92-2dda-4588-a757-0e009f333603","Name":"Global","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","sc","br","bs","sd","bt","sg","bv","sh","bw","by","sj","bz","sl","sn","so","ca","sr","ss","cc","st","cd","sv","cf","cg","sx","ch","sy","ci","sz","ck","cl","cm","cn","co","tc","cr","td","cu","tf","tg","cv","th","cw","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","us","ec","eg","eh","uy","uz","va","er","vc","et","ve","vg","vi","vn","vu","fj","fk","fm","fo","wf","ga","ws","gd","ge","gg","gh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\59993cc2-d670-45d2-b9ff-5e84fffa46c8[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	downloaded
Size (bytes):	85577
Entropy (8bit):	7.9779845506804365
Encrypted:	false
SSDEEP:	1536:fx3um4BB5l7BUbhS5YGB6AUL8ZFeFyd4QPFCnHzkY28mIx0y4WXBN3IL+YXrypUj:f85lQhS5kLciyqwFCHBJxt4mhIL7ypW7
MD5:	BE73BDD8E09646E68653EA1263C3B4AF
SHA1:	70DEE19369341DD6FF5192559EF551F95E995027
SHA-256:	471DF599C719864DA8C5613CD9A3B0E3EBE002DB7B45C476F28100E0D0485ACA
SHA-512:	A30E38F3C3BB1E0BAB4711FF46F42A9ED986723108DA07AA0DD4328872C55911AB6817D21066AC138EEC26BD1D884BC20A2F98113744C6284156820F7FE705D8
Malicious:	false
IE Cache URL:	https://cvision.media.net/new/300x300/3/238/215/201/59993cc2-d670-45d2-b9ff-5e84fffa46c8.jpg?v=9
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................H............................!.1.."A.Qa.#2q...B.$3R....b...r..%&CSs.4.....................................A.........................!...1A.".Qaq.#2.B....R...$3b..C...S&cr............?..c.we->7...<.....P..r..Q..o.D.'s..q...C.^..b=..w....D...h......N....:...V..(...7.[u.Z%G..I.q......e~...Y,7..'um.m....O.5....k..{......A..G...R.........N...6;......:..@..N.....u...t.}....}g.O..=..~[......g.......w.8)...;...........!.V.....}......nAF.rF....?....66..x....O.......Q..u......?.........m..I;..6....._....N.p@.........?. .c......0...z....<s._......m.........ZX...........<.........}y$n@.]{l..o.;../..c.........7....Bb.K+*.............~.4.G.=l..O.~....vw.X.m.D..o.........Nx.O...<...<y.n....A>.n....7...o.)D}....o....l.CZ......_..Y..$.6..o....1...b.H.(~.;...V..y(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1cEP3G[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1088
Entropy (8bit):	7.81915680849984
Encrypted:	false
SSDEEP:	24:FCGPRm4XxHvhNBb6W3bc763IU6+peaq90IUkiRPfoc:/pXBvkW3bc7k1FqWIUkSfB
MD5:	24F1589A12D948B741C2E5A0C4F19C2A
SHA1:	DC9BB00C5D063F25216CDABB77F5F01EA9F88325
SHA-256:	619910A3140A45391D7D3CB50EC4B48F0B0C8A76DC029576127648C4BD4B128C
SHA-512:	5D7A17B05E1FD1BC02823EC2719D30BC27A9FA03BCFFE30F3419990E440845842F18797C9071C037417776641AB2CDB86F1F6CD790D70481B3F863451D3249EE
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+......IDATx...]..U.....d..6YwW(.UV\.v.>.>..`.K}X).i..Tj...C..RD. ..AEXP.............]).vQ../$.%.l2.....dH&.YiOr93.....~..u.S...5........J.&..;.JN..z....2..;q.4..I .....c!....2;J........l(......?.m+......V...g3.0..............C..GB.$..M.....jl.M..~6?.........../a%...;....E.by.J..1.$...".&.DX..W..jh.....=...aK...[.#....].. ....:Q....X.........uk.6.0...e7..RZ..@@H..k........#......[..C.-.AbC.fK.(a.<.^p.j`...._>{<....`.........%.L...q.G...).2oc{....vQ...N5..%m-ky19..F.S....&..../..F......y.(.8.1..>?Zr......Q.`.e.\|0.&m.E....=[aN..r.+....2B/f8.v..n...N..=........i.^....s&..Hr.z.....M......:........EF.....0.. .N.x............N.pO.#2...df=...Fa..B#2yU....O.;.g....b.}ct.&.7x..t.Y..yg....]..){.,.v.F.e.ZF.z..Ur+..^..].#.]....~..}..{g.W0?....&....6n....p\.=.]..X...F.]...\s5OK.3Wb.#.M/fT...:^.M}...:t.......!..g......0t.h..8..4cB....px..............1.!...}=...Qb$W.*..."............V....!.y......<H

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1cG73h[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1131
Entropy (8bit):	7.767634475904567
Encrypted:	false
SSDEEP:	24:lGH0pUewXx5mbpLxMkes8rZDN+HFlCwUntvB:JCY9xr4rZDEFC
MD5:	D1495662336B0F1575134D32AF5D670A
SHA1:	EF841C80BB68056D4EF872C3815B33F147CA31A8
SHA-256:	8AD6ADB61B38AFF497F2EEB25D22DB30F25DE67D97A61DC6B050BB40A09ACD76
SHA-512:	964EE15CDC096A75B03F04E532F3AA5DCBCB622DE5E4B7E765FB4DE58FF93F12C1B49A647DA945B38A647233256F90FB71E699F65EE289C8B5857A73A7E6AAC6
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+......IDATx..U=l.E.~3;w{..#].Dg!.SD...p...E....PEJ.......B4.RE. :h..B.0.-$.D"Q 8.(.;.r.{3...d...G......7o..9....vQ.+...Q......."!#I......x\|...\...& .T6..~......Mr.d.....K..&..}.m.c.....`.`....AAA..,.F.?.v..Zk;...G...r7!..z......^K...z.........y...._..E..S....!$...0...u.-.Yp...@;;;%BQa.j..A.<)..k..N.....9.?..]t.Y.`....o....[.~~..u.sX.L..tN..m1...u...........Ic....,7..(..&...t.Ka.]..,.T..g.."...W......q....:+t.?6....A..}...3h.BM/.......<.~..A.`m...:.....H...7.....{.....$... AL..^-...?5FA7'q..8jue........?A...v..0...aS.:.0.%.%"......[.=a......X..j..<725.C..@.\. ..`.._....'...=....+.Sz.{......JK.A...C\|{.\|r.$.=Y.#5.K6.!........d.G...{......$.-D.z..{...@.!d.e...&..o...$Y...v.1.....w..(U...iyWg.$...\>..].N...L.n=.[.....QeVe..&h...`;=.w.e9..}a=.......(.A&..#.jM~4.1.sH.%...h...Z2".........RP....&.3................a..&.I...y.m...XJK..'...a......!.d.......Tf.yLo8.+.+...KcZ.....\|K..T....vd....cH.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cfdbd9[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	740
Entropy (8bit):	7.552939906140702
Encrypted:	false
SSDEEP:	12:6v/70MpfkExg1J0T5F1NRlYx1TEdLh8vJ542irJQ5nnXZkCaOj0cMgL17jXGW:HMuXk5RwTTEovn0AXZMitL9aW
MD5:	FE5E6684967766FF6A8AC57500502910
SHA1:	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B
SHA-256:	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
SHA-512:	AF9F1BABF872CBF76FC8C6B497E70F07DF1677BB17A92F54DC837BC2158423B5BF1480FF20553927ECA2E3F57D5E23341E88573A1823F3774BFF8871746FFA51
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/cfdbd9.png
Preview:	.PNG........IHDR................U....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.07/21/16.~y....<IDATH..;k.Q....;.;..&..#...4..2.....V,...X..~.{..\|.Cj......B$.%.nb....c1...w.YV....=g.............!..&.$.mI...I.$M.F3.}W,e.%..x.,..c..0.V....W.=0.uv.X...C....3`....s.....c..............2]E0.....M...^i...[..]5.&...g.z5]H....gf....I....u....:uy.8"....5...0.....z.............o.t...G.."....3.H....Y....3..G....v..T....a.&K......,T.\.[..E......?........D........M..9...ek..kP.A.`2.....k...D.}.\...V%.\..vIM..3.t....8.S.P..........9.....yI.<...9.....R.e.!`..-@........+.a..x..0.....Y.m.1..N.I...V.'..;.V..a.3.U....,.1c.-.J<..q.m-1...d.A..d.`.4.k..i.......SL.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\checksync[1].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302761373207805
Encrypted:	false
SSDEEP:	384:RIAGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOLQWwY4RXrqt:Q86qhbS2RxF3OsLQWwY4RXrqt
MD5:	A1EF805AA91F780CDF0CF4E76C6BF832
SHA1:	483C3961ADDAC604C7F5A0FEEBE50B31D895A259
SHA-256:	F5AF1444ED12476886A3594A5E696CADD4BFC46EA90A66C08F875E9750C93778
SHA-512:	FB14B11759D9CEDC224627908D91D7C1CF27D213FE1350883AD5F3EAA8D9D681346143B86708F63ECD1377D614CE348212AA0E9C8C6EB1B7DA539F1554F7C895
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fcmain[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	38851
Entropy (8bit):	5.060093229850658
Encrypted:	false
SSDEEP:	768:yo1avJ4u3uPP18W94FlDZi0xGAIiOgYXf9wOBEZn3SQN3GFl295od0lD0sF:yAQJ4ueF8WmFXBkAIiOgYXf9wOBEZn3D
MD5:	7A4700BC3F207AFFF097B152097755F8
SHA1:	2B1F4E3C6D1D997D3FF05A6215B04A81B08DAD48
SHA-256:	53C8538EADEA27D5091F458327D7824DFFFF57B2E61EA0FEB54CECB582AECA9C
SHA-512:	FF949DA7DD0637CE2CFC927587D27F952FE9E4C0A07C8E9BB6153F967D0B94FFD2A8DF41A262AF5732E5ADDAC4D91A63AEC4FEE8C20050C5C7D07B964C162A62
Malicious:	false
IE Cache URL:	https://contextual.media.net/803288796/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3D%3D&crid=858412214&size=306x271&cc=CH&https=1&vif=2&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&nse=5&vi=1623825057816636356&ugd=4&rtbs=1&nb=1
Preview:	;window._mNDetails.initAd({"vi":"1623825057816636356","s":{"_mNL2":{"size":"306x271","viComp":"1623824900117859970","hideAdUnitABP":true,"abpl":"3","custHt":"","setL3100":"1"},"lhp":{"l2wsip":"2886781335","l2ac":"","sethcsd":"set!N16\|3949"},"_mNe":{"pid":"8PO8WH2OT","requrl":"https://www.msn.com/de-ch/?ocid=iehp#mnetcrid=858412214#"},"_md":[],"ac":{"content":"<!DOCTYPE HTML PUBLIC \"-\/\/W3C\/\/DTD HTML 4.01 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/html4\/loose.dtd\">\r\n<html xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\r\n<head><meta http-equiv=\"x-dns-prefetch-control\" content=\"on\"><style type=\"text\/css\">body{background-color: transparent;}<\/style><meta name=\"tids\" content=\"a='800072941' b='803767816' c='msn.com' d='entity type'\" \/><script type=\"text\/javascript\">try{window.locHash = (parent._mNDetails && parent._mNDetails.getLocHash && parent._mNDetails.getLocHash(\"858412214\",\"1623825057816636356\")) \|\| (parent._mNDetails[\"locHash\"] && par

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fcmain[2].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	39264
Entropy (8bit):	5.050922601234252
Encrypted:	false
SSDEEP:	768:T1avU4u3uPPiW94olw0RIgSwUbEYXf9wOBEZn3SQN3GFl295oEsl2stg:ZQU4ueyWmouSIgSpbEYXf9wOBEZn3SQX
MD5:	F2D3E72DD8D962A6A3363C4898A265CE
SHA1:	5CA0DC43A0F6246841438B2722C766C87D3BEDF3
SHA-256:	9121F86EC72A8E2F4197AE723743924A2B24C525EB48B4EADB9B319D5C2E52B9
SHA-512:	B86E8B9DF04F481DCC83DF7AE664450C400DB02E185F7D6D0BB25EF5D9FC65783F286589B3730D0AA5A50F13C7D63DF22AE7A35199C5596F4A7ECCBCE5BA4A6E
Malicious:	false
IE Cache URL:	https://contextual.media.net/803288796/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3D%3D&crid=722878611&size=306x271&cc=CH&https=1&vif=2&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&nse=5&vi=1623825057214936950&ugd=4&rtbs=1&nb=1
Preview:	;window._mNDetails.initAd({"vi":"1623825057214936950","s":{"_mNL2":{"size":"306x271","viComp":"1623824483864026776","hideAdUnitABP":true,"abpl":"3","custHt":"","setL3100":"1"},"lhp":{"l2wsip":"2887305229","l2ac":"","sethcsd":"set!N16\|3949"},"_mNe":{"pid":"8PO641UYD","requrl":"https://www.msn.com/de-ch/?ocid=iehp#mnetcrid=722878611#"},"_md":[],"ac":{"content":"<!DOCTYPE HTML PUBLIC \"-\/\/W3C\/\/DTD HTML 4.01 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/html4\/loose.dtd\">\r\n<html xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\r\n<head><meta http-equiv=\"x-dns-prefetch-control\" content=\"on\"><style type=\"text\/css\">body{background-color: transparent;}<\/style><meta name=\"tids\" content=\"a='800072941' b='803767816' c='msn.com' d='entity type'\" \/><script type=\"text\/javascript\">try{window.locHash = (parent._mNDetails && parent._mNDetails.getLocHash && parent._mNDetails.getLocHash(\"722878611\",\"1623825057214936950\")) \|\| (parent._mNDetails[\"locHash\"] && par

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\otFlat[1].json Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	12282
Entropy (8bit):	5.246783630735545
Encrypted:	false
SSDEEP:	192:SZ1Nfybp4gtNs5FYdGDaRBYw6Q3OEB+q5OdjM/w4lYLp5bMqEb5PenUpoQuQJYQj:WNejbnNP85csXfn/BoH6iAHyPtJJAk
MD5:	A7049025D23AEC458F406F190D31D68C
SHA1:	450BC57E9C44FB45AD7DC826EB523E85B9E05944
SHA-256:	101077328E77440ADEE7E27FC9A0A78DEB3EA880426DFFFDA70237CE413388A5
SHA-512:	EFBEFAF0D02828F7DBD070317BFDF442CAE516011D596319AE0AF90FC4C4BD9FF945AB6E6E0FF9C737D54E05855414386492D95ABFC610E7DE2E99725CB1A906
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/assets/otFlat.json
Preview:	.. {.. "name": "otFlat",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCIgcm9sZT0iZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciI+PGRpdiBjbGFzcz0ib3Qtc2RrLXJvdyI+PGRpdiBpZD0ib25ldHJ1c3QtZ3JvdXAtY29udGFpbmVyIiBjbGFzcz0ib3Qtc2RrLWVpZ2h0IG90LXNkay1jb2x1bW5zIj48ZGl2IGNsYXNzPSJiYW5uZXJfbG9nbyI+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtcG9saWN5Ij48aDMgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gzPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+ZGVzY3JpcHRpb248L3A+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwLXBhcmVudCIgY2xhc3M9Im90LXNkay10aHJlZSBvdC1zZGstY29sdW1ucyI+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwIj48YnV0dG9uIGlkPSJvbmV0cnVzdC1wYy1idG4taGFuZGxlciI+Y2h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\otPcCenter[1].json Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	47714
Entropy (8bit):	5.565687858735718
Encrypted:	false
SSDEEP:	768:4zg/3JXE9ZSqN76pW1lzZzic18+JHoQthI:4zCBceUdZzic18+5xI
MD5:	8EC5B25A65A667DB4AC3872793B7ACD2
SHA1:	6B67117F21B0EF4B08FE81EF482B888396BBB805
SHA-256:	F6744A2452B9B3C019786704163C9E6B3C04F3677A7251751AEFD4E6A556B988
SHA-512:	1EDC5702B55E20F5257B23BCFCC5728C4FD0DEB194D4AADA577EE0A6254F3A99B6D1AEDAAAC7064841BDE5EE8164578CC98F63B188C1A284E81594BCC0F20868
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/assets/v2/otPcCenter.json
Preview:	.. {.. "name": "otPcCenter",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImRpYWxvZyIgYXJpYS1sYWJlbGxlZGJ5PSJvdC1wYy10aXRsZSI+PCEtLSBDbG9zZSBCdXR0b24gLS0+PGRpdiBjbGFzcz0ib3QtcGMtaGVhZGVyIj48IS0tIExvZ28gVGFnIC0tPjxkaXYgY2xhc3M9Im90LXBjLWxvZ28iIHJvbGU9ImltZyIgYXJpYS1sYWJlbD0iQ29tcGFueSBMb2dvIj48L2Rpdj48YnV0dG9uIGlkPSJjbG9zZS1wYy1idG4taGFuZGxlciIgY2xhc3M9Im90LWNsb3NlLWljb24iIGFyaWEtbGFiZWw9IkNsb3NlIj48L2J1dHRvbj48L2Rpdj48IS0tIENsb3NlIEJ1dHRvbiAtLT48ZGl2IGlkPSJvdC1wYy1jb250ZW50IiBjbGFzcz0ib3QtcGMtc2Nyb2xsYmFyIj48aDMgaWQ9Im90LXBjLXRpdGxlIj5Zb3VyIFByaXZhY3k8L2gzPjxkaXYgaWQ9Im90LXBjLWRlc2MiPjwvZGl2PjxidXR0b24gaWQ9ImFjY2VwdC1yZWNvbW1lbmRlZC1idG4taGFuZGxlciI+QWxsb3cgYWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1599143105792-2178[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	97964
Entropy (8bit):	7.977739426984512
Encrypted:	false
SSDEEP:	1536:J8z5C8Z/Ugcsxp0Ig/9DO2278VhWksC2QGL3FvuR+UVi9FR+z511D4bGD+t0laeX:J8z5j1oISDL2QVhWJCcL3FJFR+N11E9G
MD5:	7AB6C8962F5E0E49DA37C6D4855627D1
SHA1:	186570C3B910CC7FF464134327403B648C6B6748
SHA-256:	48EDE7C36B44623F65C6B225A69F4F2B040C06CF7B98D9DFB523C4ECAA20E5F8
SHA-512:	F928E20A7DEDEC78E4EACA692F6BB633E42319BAAECD12E3E16CFF96A33C9F59C0FBD1072AF91D7AD061292C2279C980DB19E713C5CE6849CE0B84C554B5D95E
Malicious:	false
IE Cache URL:	https://s.yimg.com/lo/api/res/1.2/Fo5Jex2Ns8JTjiH3G9.SGA--~A/Zmk9ZmlsbDt3PTMxMTtoPTMzMzthcHBpZD1nZW1pbmk7cT0xMDA-/https://s.yimg.com/av/ads/1599143105792-2178.jpg
Preview:	......JFIF.............C....................................................................C.......................................................................M.7..............................................I........................!...1."AQ..aq#2....B.$...3R....4Cb..Sr...%5DT....................................C......................!1..AQ.aq."........2....#BR.3b.Cr..$S...4..............?.......^e.%X.E.4...D..6...5NA.....P.......O.=p..T.5W%Op;..Rv.......KL.t.....Cf..].s..9.......'...W.DR.X..X...;.r..l..........u..s.(L.......Ag....O7Ui.$...".i..z....}.x....s{.....Z.7-.... z....Edp.2..1.?2lC...H........z~.N@.....Q.....B\nQX-oj...'...UD..58M.%#,......g.pV.B.6....M..-H.\|.xYJ..[....b..k.xe.=%..YQ4........g...Y..NWF.<1.'..4..MJ.C...$..F`.:.zi.J..[....RF........7N.$i$frF...E.T....U.C....\...\.l.jP.uv.6...............e....H.$..8..!.X.b.......I`..#.r]D.....\|...Wb.....k~D..6..Vg..w..iQ.V.<,."......P......{.......m..k...s..h.u..a.[.-.&..#.3-..F...K5\.....Y[..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1606410250517-476[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	66750
Entropy (8bit):	7.967478025667552
Encrypted:	false
SSDEEP:	1536:P+m1kGhk6LOG3F9OJcHTdZdzyxvUvjC0Sod:RJfOjGwBwjC0SY
MD5:	CA2A8C2AAB796F885875341C8085CB4E
SHA1:	52D0F8AF761B3BE5332C0AC80BB386772C8C551A
SHA-256:	186D88391D2397358005538F88961141FD0C18CD49229D512D6DA8B012EFC761
SHA-512:	E170EF3A6461532BD1CC696240F61D04C22D1CCEA3EC9129CC01C639C5E6237E152F55D08487BA6F2DDDD2E0506D98B9882E20C69943B37AA91A46EF88B49F33
Malicious:	false
IE Cache URL:	https://s.yimg.com/lo/api/res/1.2/4ZESs6Q5ib.T5INTDEWXYA--~A/Zmk9ZmlsbDt3PTMxMTtoPTMzMzthcHBpZD1nZW1pbmk7cT0xMDA-/https://s.yimg.com/av/ads/1606410250517-476.jpg
Preview:	......JFIF.............C....................................................................C.......................................................................M.7..............................................m..........................!..1A.."Qa.#2q.....3.....$BRb...%4..&578Cr..'(9DSuvx..)6HVw.EFGITXcdefh.............................................j..........................!1..AQ."aq...2.....#...$%356BRruv..&47Ubt.......9CDESTV......Fcs.....'(ewx................?..N...F........f.............`.E\.:...m.........^..{t.la.k..>Okr4..x..;.p...PF1.$r....By#..S...p.....'=..1.A.#...q?..lf.....&...<nN...z<\|.E... .d.....'5..P7..v.. Ot`r..q.\|..h.................:@......'.G.?...@..8.*O.o.......\|\|.:s..Lo...sKl...H....6\|.#w.@...Ox...LG.c......T.T.....u....Dj=@.{...........}\|q.....s..`-...XZ..'F......%}....c..a...S...x....R.I~'.j....t.0}\|.21.Rz1:7........V..i...{.J..\..JG+..C..i....p...#.A.o...].....K.:~.....J.G....yJ;2..QXU...!r......_A.z.......g...j_.z.'.j./..}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\17-361657-68ddb2ab[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.066474690445609
Encrypted:	false
SSDEEP:	24:HWwAaHZRRIYfOeXPmMHUKq6GGiqIlQCQ6cQflgKioUInJaqzrQJ:HWwAabuYfO8HTq0xB6XfyNoUiJaD
MD5:	7ADA9104CCDE3FDFB92233C8D389C582
SHA1:	4E5BA29703A7329EC3B63192DE30451272348E0D
SHA-256:	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
SHA-512:	2967FBCE4E1C6A69058FDE4C3DC2E269557F7FAD71146F3CCD6FC9085A439B7D067D5D1F8BD2C7EC9124B7E760FBC7F25F30DF21F9B3F61D1443EC3C214E3FFF
Malicious:	false
Preview:	define("meOffice",["jquery","jqBehavior","mediator","refreshModules","headData","webStorage","window"],function(n,t,i,r,u,f,e){function o(t,o){function v(n){var r=e.localStorage,i,t,u;if(r&&r.deferLoadedItems)for(i=r.deferLoadedItems.split(","),t=0,u=i.length;t<u;t++)if(i[t]&&i[t].indexOf(n)!==-1){f.removeItem(i[t]);break}}function a(){var i=t.find("section li time");i.each(function(){var t=new Date(n(this).attr("datetime"));t&&n(this).html(t.toLocaleString())})}function p(){c=t.find("[data-module-id]").eq(0);c.length&&(h=c.data("moduleId"),h&&(l="moduleRefreshed-"+h,i.sub(l,a)))}function y(){i.unsub(o.eventName,y);r(s).done(function(){a();p()})}var s,c,h,l;return u.signedin\|\|(t.hasClass("office")?v("meOffice"):t.hasClass("onenote")&&v("meOneNote")),{setup:function(){s=t.find("[data-module-deferred-hover], [data-module-deferred]").not("[data-sso-dependent]");s.length&&s.data("module-deferred-hover")&&s.html("<p class='meloading'><\/p>");i.sub(o.eventName,y)},teardown:function(){h&&i.un

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\AAL5rO9[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	37499
Entropy (8bit):	7.8860578688145475
Encrypted:	false
SSDEEP:	768:IaJHNLbLY+s7SrYBvhhFBJXtvhDVrCy4/lxBxcfVg5O:IadNLbSSrYRFBVhh1+0g5O
MD5:	620F6D733D32F7C3E430ED5413871F4A
SHA1:	C8A33A1B29FC80936CEA07BC7B9108F82ADE6E71
SHA-256:	D164E6FF6402136B51CF0C9033CB6C8BFC943A1517F13FC39CF5B9AD396BB9DB
SHA-512:	D6E608F119506386F882E568544C0D8C57CA6B8C09D3201AF5A2FA39D8FC8EDA907E839295306D10250761D48224E59FC53A498EBAB3FED6890C36836CFCD5E6
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAL5rO9.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..bI.!.$.N...Y.$.....L.T.(./5....o^...Y#I.ya..I......M;.#.by5H..".P.S..M'f...66..=:S........1L.@>.z....Tc...H..;..VPz7jRm &IV9..I..n9........0.g.........I...4=@......f.$......0..J......RU9@...4(..9...}~.......2.$.^..b...s...e$"....x.....i..Nh.'?J..........',H."2gg...:V..CA}.8.o..%.).&9.E#....f.....l...O...&..b.L.........N}l...6..I...u4..p..........}.:.`"<.`....:b.. ..b..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BBPfCZL[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	downloaded
Size (bytes):	2313
Entropy (8bit):	7.594679301225926
Encrypted:	false
SSDEEP:	48:5Zvh21Zt5SkY33fS+PuSsgSrrVi7X3ZgMjkCqBn9VKg3dPnRd:vkrrS333q+PagKk7X3ZgaI9kMpRd
MD5:	59DAB7927838DE6A39856EED1495701B
SHA1:	A80734C857BFF8FF159C1879A041C6EA2329A1FA
SHA-256:	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
SHA-512:	7D3FB1A5CC782E3C5047A6C5F14BF26DD39B8974962550193464B84A9B83B4C42FB38B19BD0CEF8247B78E3674F0C26F499DAFCF9AF780710221259D2625DB86
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	GIF89a2.2.....7..;..?..C..I..H..<..9.....8..F..7..E..@..C..@..6..9..8..J..z.G..>..?..A..6..>..8..:..A..=..B..4..B..D..=..K..=..@..<..:..3~.B..D.....,\|.4..2..6..:..J..;..G....Fl..1}.4..R.....Y..E..>..9..5..X..A..2..P..J../\|.9.....T.+Z.....+..<.Fq.Gn..V..;..7.Lr..W..C..<.Fp.]......A.....0{.L..E..H..@.....3..3..O..M..K....#[.3i..D..>........I....<n..;..Z..1..G..8..E....Hu..1..>..T..a.Fs..C..8..0}....;..6..t.Ft..5.Bi..:.x...E.....'z^~.......[....8`..........;..@..B.....7.....<.................F.....6...........>..?.n......g.......s...)a.Cm....'a.0Z..7....3f..<.:e.....@.q.....Ds..B....!P.n...J............Li..=......F.....B.....:r....w..\|..........`..[}.g...J.Ms..K.Ft.....'..>..........Ry.Nv.n..]..Bl........S..;....Dj.....=.....O.y.......6..J.......)V..g..5.......!..NETSCAPE2.0.....!...d...,....2.2........3.`..9.(\|.d.C .wH.(."D...(D.....d.Y......<.(PP.F...dL.@.&.28..$1S....TP......>...L..!T.X!.(..@a..IsgM..\|..Jc(Q.+.......2.:.)y2.J......W,..eW2.!....!....C.....d...zeh....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\BBih5H[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	835
Entropy (8bit):	7.675892111492914
Encrypted:	false
SSDEEP:	12:6v/7eorYebkI7N8EWhref+IdamL6pZvzKOH3X+tLNUAV6W9ONhTKnLw2x2lZgmAu:iYekvatqlKOXXS9V6W9uzRcQ9bL
MD5:	F79F56222F8B1B951A00A306C8AFA5C4
SHA1:	9FE78220A6811338E68FE7A2D65DC3B7FB5302BD
SHA-256:	2EF60D23400424838CD3B53021CFD903AA330168BDCC0A2AACFC7185832C00A9
SHA-512:	2172E9FCAB0547423F941BDB338D25528081F454857CA20A2D984C246CBF403341AC3689A748CECC1401B125E2138CFB61A9BF95F05D70329FB0BF504AFF9028
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u=true&n=true&w=30&h=30
Preview:	.PNG........IHDR.............;0......pHYs..........+......IDATx..MHTQ....,...#..i....-.. J.6...iQd...p........D.6.e...>6AE.FJa.IA.b5ji..;>....\|..-<.s.}......&90I6%..6........o.-!'..!...Z<+^D...7..q:............Gx..5........&...6.{.4NBh.._Av....<..;`=<..D..5.[.g.4..Y+\|.......X...M....=..4.0.4....6.......x.....3......e0b.....k.Fa..@-.....=...c\|.8....4?../.o.g@=....ho.&...3$6.V....Ds .f.T..-...G\.7.z....h.&..^....bE...c...].0..!.Y.i.EU9t.$L...%ra.....I........L.l..uUyO. .%..F..s...kmW#~....2v.L~...N{3...i.U........E.g}.l...b]..%g.^7r.9.t...)...N.....a.4.....^'......-.f.A-..(LV..:} .~.O@.....g......\|`....".#..I.......@...u.>.{xD\|....`:.0.U...v9.u......c2C4)..,.u.a5....d.i....q....4.9.-.ip...C..:..g..h.N.B..+.U.w.......a.g...[.G.8.xZ<....:2nw:3ne,\|.oa...G.J1...c.&.N.Ox..6.............IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\checksync[1].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302761373207805
Encrypted:	false
SSDEEP:	384:RIAGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOLQWwY4RXrqt:Q86qhbS2RxF3OsLQWwY4RXrqt
MD5:	A1EF805AA91F780CDF0CF4E76C6BF832
SHA1:	483C3961ADDAC604C7F5A0FEEBE50B31D895A259
SHA-256:	F5AF1444ED12476886A3594A5E696CADD4BFC46EA90A66C08F875E9750C93778
SHA-512:	FB14B11759D9CEDC224627908D91D7C1CF27D213FE1350883AD5F3EAA8D9D681346143B86708F63ECD1377D614CE348212AA0E9C8C6EB1B7DA539F1554F7C895
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\http___cdn.taboola.com_libtrc_static_thumbnails_5b4a08af220009430c218ebd269e267d[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	27091
Entropy (8bit):	7.975637886026453
Encrypted:	false
SSDEEP:	768:W7+PjBC9JhTb/LdnpjHXLfqdbXt9LoL8OfamN/6:W7+Ps1pDLC5dpW8Pay
MD5:	2E6CC51E4DA15E35DEF66CF710063378
SHA1:	0DF56843A6A3F291146A2D4622AC5C506CB62520
SHA-256:	CD048CC006268D20A04721687ABF62BB02CE9738BB89A93F6263023D693AC765
SHA-512:	B3AC20FD3DAE77A420388C121DB5850142F144F3F235B366D4C5DAE3BC6051F8D439996E4F1891CF17D2992FC19416DD17BB0783DD5AE98AB75E9F3882C52304
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F5b4a08af220009430c218ebd269e267d.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T......7...."..........6...................................................................Fb-.=.',h.....W#A..8C....7Z...)..t...j.hj.W...Lx....}.]..gGIhL.\...I2....[....p........h..4..[........"T..t.G....2.../u2S..p......w.9I.....N...l....ys....6.&.."..p....76.../8..~4.?hE...F...h...Ov....w?'.^J........H..k... ...D...E3...$....KRY.Y.m...h}\6....e&.y.o..E..;P...zi.....I@...z...9......#{.a.zJ.-......7&E.z&C....'..,B..............\|.C......[.......i.=`...?U)....!..[.....z...r.1...Zn....^9[.X-.=.b.g.VZ.e+....Y..wG\..@.z..f.G.Q.e-..~-k$6..+.Cy#$.Kh....UA/E.N...[HEL..MQeH.3......=}q..c........{!Xb...#.....S...ve'...E.h..x.5.......=@..83...{z:.D.Hl.......?fr....9.fX.!.O.s{...e.Zen..p[..t..V.gC.......bT.5..^...Z.;\.n..L..F.6X..ATzJ./f.....4Fo~h...r..T.m.^...f..l ..-`.U...g.n~....pts.......Y.K...1@...>.\.u)..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\http___cdn.taboola.com_libtrc_static_thumbnails_ac739830a013baf1e00778fe327f0a5a[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	30832
Entropy (8bit):	7.975215358753244
Encrypted:	false
SSDEEP:	768:2GzgPNO/QvvoKbNkBbLxVlziEMeEUkwMtKaeSp0vM:2GU0Q1CBbgdw0heS3
MD5:	A5EABA6F3B5DAB533C8693F23FB1C7CF
SHA1:	8301CD80AF6946A8E6432DBB767DCD4560A191AE
SHA-256:	10A26709BB63EFB6CD5A45BF6F6308D471E496DA92DBA2E8AE78787625B635FB
SHA-512:	B8E79E7DB44D869D6ECDDB106792B014765079807DF298C6E98C52BE459B97595DBA5E0B2681049391209A4AE55629FED9941EF0B32ACCCFFB1AD9EC335605A7
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2Fac739830a013baf1e00778fe327f0a5a.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T.............................+......+&.%#%.&D5//5DNB>BN_UU_wqw.........7...............5....................................................................xJ\k%.....E...Rs#..qy.w.zo.6..b.Z.\|:G.........P0....Nx.J..dzb`s.F..Jo.7.....,.....U.........H..B....HMQ.\K...N......l<vI'....K.Y....D&$...aA..dE...C.)............."....K(JB.....LL\|`.'.Sj.0..m.........@\3#..@....Jz..L\|DbN..P.9............y.L...I.........ie.....0.L.Ds...f<....."S"S.#.3Q...T`..d:zg.r..BFz..1.&0<2"<>5%.H..$.0.0i...DC.p..TK.~.F....f&...a.'...$.%~K.G.j..dr.g..z..Y.X....j+.^....."Z...1.1..Q @.^.. .V.......Eh..b...L.@%,.00....././k..;b..".4......4\\|E/I.).,.(.....7.:.9.L6?.a&...,.. .*...K.NL@".3lM........6..z.}....F....?B.X.........c.:.lj..3kc.x.d.X..i..I.Ty..k.4E..i;6$.`.3.3...6Z.b..i.H....`........2.;.....aL.mf.Yf-......@.H.+.c`..\|..RLO./NW.JIU-........Y..b"..1k.=.>....zb.......9sZ.!...cs.}.I..Z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\location[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	182
Entropy (8bit):	4.685293041881485
Encrypted:	false
SSDEEP:	3:LUfGC48HlHJ2R4OE9HQnpK9fQ8I5CMnRMRU8x4RiiP22/90+apWyRHfHO:nCf4R5ElWpKWjvRMmhLP2saVO
MD5:	C4F67A4EFC37372559CD375AA74454A3
SHA1:	2B7303240D7CBEF2B7B9F3D22D306CC04CBFBE56
SHA-256:	C72856B40493B0C4A9FC25F80A10DFBF268B23B30A07D18AF4783017F54165DE
SHA-512:	1EE4D2C1ED8044128DCDCDB97DC8680886AD0EC06C856F2449B67A6B0B9D7DE0A5EA2BBA54EB405AB129DD0247E605B68DC11CEB6A074E6CF088A73948AF2481
Malicious:	false
IE Cache URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	jsonFeed({"country":"CH","state":"ZH","stateName":"Zurich","zipcode":"8152","timezone":"Europe/Zurich","latitude":"47.43000","longitude":"8.57180","city":"Zurich","continent":"EU"});

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\nrrV12042[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	89629
Entropy (8bit):	5.421484819903432
Encrypted:	false
SSDEEP:	1536:tXVnCuukXGs7RiUGZFVgc5dJoH/BU5AJ8puaHRa0Uv1BYYL0E5Kfy4ar8u19oKL:tXtiX/dJIxkunDv5KfyZ1
MD5:	BF7A6A5AAEE4175C020FF8565D421406
SHA1:	06289E049D42CD87ADE5FD222033D8668F0BD2DF
SHA-256:	6C7FBD213E8FB6D06203AE0B5D44B11C831D221713336478A152F417E4AA9BD6
SHA-512:	001F349870097D36B08499C765324CFC57EA07DDF1631E5D936A5E4269AA9234A5C820CA6ACE5D7C705697E5CB932EF89E1CCC9A63FB4959A467BE98C4468B79
Malicious:	false
IE Cache URL:	https://contextual.media.net/48/nrrV12042.js
Preview:	var _mNRequire,_mNDefine;!function(){"use strict";var c={},u={};function a(e){return"function"==typeof e}_mNRequire=function e(t,r){var n,i,o=[];for(i in t)t.hasOwnProperty(i)&&("object"!=typeof(n=t[i])&&void 0!==n?(void 0!==c[n]\|\|(c[n]=e(u[n].deps,u[n].callback)),o.push(c[n])):o.push(n));return a(r)?r.apply(this,o):o},_mNDefine=function(e,t,r){if(a(t)&&(r=t,t=[]),void 0===(n=e)\|\|""===n\|\|null===n\|\|(n=t,"[object Array]"!==Object.prototype.toString.call(n))\|\|!a(r))return!1;var n;u[e]={deps:t,callback:r}}}();_mNDefine("modulefactory",[],function(){"use strict";var r={},e={},o={},i={},t={},n={},a={},c={},d={};function l(r){var e=!0,o={};try{o=_mNRequire([r])[0]}catch(r){e=!1}return o.isResolved=function(){return e},o}return r=l("conversionpixelcontroller"),e=l("browserhinter"),o=l("kwdClickTargetModifier"),i=l("hover"),t=l("mraidDelayedLogging"),n=l("macrokeywords"),a=l("tcfdatamanager"),c=l("l3-reporting-observer-adapter"),d=l("editorial_blocking"),{conversionPixelController:r,browserHint

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\otTCF-ie[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	102879
Entropy (8bit):	5.311489377663803
Encrypted:	false
SSDEEP:	768:ONkWT0m7r8N1qpPVsjvB6z4Yj3RCjnugKtLEdT8xJORONTMC5GkkJ0XcJGk58:8kunecpuj5QRCjnrKxJg0TMC5ZW8
MD5:	52F29FAC6C1D2B0BAC8FE5D0AA2F7A15
SHA1:	D66C777DA4B6D1FEE86180B2B45A3954AE7E0AED
SHA-256:	E497A9E7A9620236A9A67F77D2CDA1CC9615F508A392ECCA53F63D2C8283DC0E
SHA-512:	DF33C49B063AEFD719B47F9335A4A7CE38FA391B2ADF5ACFD0C3FE891A5D0ADDF1C3295E6FF44EE08E729F96E0D526FFD773DC272E57C3B247696B79EE1168BA
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otTCF-ie.js
Preview:	!function(){"use strict";var c="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e,t){return e(t={exports:{}},t.exports),t.exports}function n(e){return e&&e.Math==Math&&e}function p(e){try{return!!e()}catch(e){return!0}}function E(e,t){return{enumerable:!(1&e),configurable:!(2&e),writable:!(4&e),value:t}}function o(e){return w.call(e).slice(8,-1)}function u(e){if(null==e)throw TypeError("Can't call method on "+e);return e}function l(e){return I(u(e))}function f(e){return"object"==typeof e?null!==e:"function"==typeof e}function i(e,t){if(!f(e))return e;var n,r;if(t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;if("function"==typeof(n=e.valueOf)&&!f(r=n.call(e)))return r;if(!t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;throw TypeError("Can't convert object to primitive value")}function y(e,t){retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\rtbsmpubs[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3967
Entropy (8bit):	5.527128513378911
Encrypted:	false
SSDEEP:	96:qLrMSx2U9msn7ie4lTXeWfbhb3DapuMVwvxo:qXMGz9mq6kWNb3mpdwvxo
MD5:	A5C1726005CCD71B2237E342A8214A94
SHA1:	232803396244E94AC9DD62A42099827419FEF294
SHA-256:	16632E64D5E6716673D7F29752F59977562DA7D9815E6B03583D3C183A8DFD4D
SHA-512:	3939FF421465D17DF3BD925A4C723E80255C163EBE97BAFB24EAF96A2C50EFE5584C341B305CE2DB78894BCEB7FE0AE248D8DBF63BBD2723225C96AB8658F3D3
Malicious:	false
IE Cache URL:	https://contextual.media.net/rtbsmpubs.php?&gdpr=0&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HBI57XIG&region=nv&ptrid=8PR68Q253&requestString=976531914*4%7C300x250%7C8CU157172%7C722878611%7C&crid=976531914&sd=2&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&bl=1&rt=5&dn=https://contextual.media.net&https=1&act=headerBid&prvReqId=106335505468034901623825087146&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.2176998180183614&ndec=1&scrsize=1280x1024&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A284%2C%22vh%22%3A271%2C%22ph%22%3A271%7D&itype=HB-CM&cc=CH&rc=ZH&ct=GLATTBRUGG&bt=1&gcp=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid3S0
Preview:	window.hbCMBidxc.rtbsheaderBid3S0({"pinfo":{"4":{"adCodeType":"BANNER","adFormat":"html","ae":false}},"meta":{"auction_id":"61475594747297111_2066307279","region":"nydc","vcfl":false,"serverId":"c10-mowx-prod-3","apid":1,"prvReqId":"106335505468034901623825087146","mowxLogs":{"SD":null,"PC":1,"SPRIG":0,"UCC":4,"lr_seg_cnt":0,"GCID":0,"IAB2":0,"vsGap":null},"sp":{"ivt":3,"source":0,"to":3,"fst":0,"cst":0,"isReq":3},"int_id":"HM","pageCat":{"iab2":"623"},"vls":0,"mp_seg":[17212,15607,15610,15630,15634]},"tl":{"976531914":{"bl":{"4":{"metainfo":{"responseTime":30,"experiment":{"ssProfile":0,"sfl":false,"md_rp":1,"ssBucket":0,"bfl":-100,"clt":0,"fl_rl":1},"rstb":true,"ab":"0","crid":"976531914","mowxLogs":{"g_uid_sent":[],"BCN_BF":null,"bsBucket":0,"ssProfile":0,"BCE":null,"lr":0,"BCI":null,"g_one_uid_sent":"None","uid_sent":0,"yhs_enabled":null,"SC":0,"lr_seg_deal":0,"BCT":null,"yhs_target_bidders":null,"BCN_YHS":null,"BCW":null,"bsProfile":0,"ssBucket":0,"TAF":0,"g_uid_cvrg":null,"suppl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\52-478955-68ddb2ab[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	395746
Entropy (8bit):	5.323860911130654
Encrypted:	false
SSDEEP:	6144:DlY9M/wSg/jgyYdw4467hmnidlWPqIjHSja5CraGgxO0Dvq4FcG6IuNK:eW/fcnidlWPqIjHd0aVtHcGBt
MD5:	202BD577BC0720A6CA764168F8E96DCC
SHA1:	582FCB4FB3C03D591FD3AA5ACBCE0ED59EAF221F
SHA-256:	B84A5192BE8CF7156A0E40C30DCA8AD37D553734D6FAA5999D20D5FE6D5B9966
SHA-512:	9FDE9DEDA5CC6C143A32D7B4B08AC905952F2DE3C986797821D306787EB891580D997AEB8B927ED7878462BA47DF2E88402683B72D3946EDFCC0B9AE2E8F9697
Malicious:	false
Preview:	var awa,behaviorKey,Perf,globalLeft,Gemini,Telemetry,utils,data,MSANTracker,deferredCanary,g_ashsC,g_hsSetup,canary;window._perfMarker&&window._perfMarker("TimeToJsBundleExecutionStart");define("jqBehavior",["jquery","viewport"],function(n){return function(t,i,r){function u(n){var t=n.length;return t>1?function(){for(var i=0;i<t;i++)n[i]()}:t?n[0]:f}function f(){}if(typeof t!="function")throw"Behavior constructor must be a function";if(i&&typeof i!="object")throw"Defaults must be an object or null";if(r&&typeof r!="object")throw"Exclude must be an object or null";return r=r\|\|{},function(f,e,o){function c(n){n&&(typeof n.setup=="function"&&l.push(n.setup),typeof n.teardown=="function"&&a.push(n.teardown),typeof n.update=="function"&&v.push(n.update))}var h;if(o&&typeof o!="object")throw"Options must be an object or null";var s=n.extend(!0,{},i,o),l=[],a=[],v=[],y=!0;if(r.query){if(typeof f!="string")throw"Selector must be a string";c(t(f,s))}else h=n(f,e),r.each?c(t(h,s)):(y=h.length>0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\AAL5Bag[1].jpg Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	37857
Entropy (8bit):	7.946921061193609
Encrypted:	false
SSDEEP:	768:IkTMyq+juMxXQIrT+CwsrQixRNbnItceQT0UvutOWYk3aACp6VOMTuzsfyIvybCd:IkDq+qUXQIrTWsEiDNbItceQuotgaACQ
MD5:	7DF61421750BB52C084C8096AE602670
SHA1:	70880EFD7F16F8DF00123751134563E8D20BE1EB
SHA-256:	E9B9264069D32A3050826F7F5BB002A45DDBD08F845B19C289AEB4A19D537971
SHA-512:	AD3189CBCF1ED408632703038725B1888D2DB5A1E28B7B42F832561A070AD4AD6ECE0E14CCDE239CB37A74974CD7F593E3F45BCC31E2A277290826E9B7C5DC5C
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAL5Bag.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=464&y=207
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.... \|.......;..X.K.r.GR[.u.k].@.^+zk...\.j`k.....a.F..R._..Y.=..D8x.~.E.:}.R.;$E...5.h.]ZQ.%4...ma.6G..<...u.MtU&-....].t.Ppm.-u...3yx.dg5G1...Vd9......GS..1r.z.C@.....&(.(..........$.bh...D.s{p....)..(..). ...).z..}h....(....(.1@...J.J.1@.".........!.......J.......:..P.;.P.$..#.. :.Z.Z.(.h.(.h.(......@..P.@.....(.(.(..........*.y..h....qE.y....=..=..5.~4...j7ED..+xN..X.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BB1aXITZ[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1149
Entropy (8bit):	7.791975792327417
Encrypted:	false
SSDEEP:	24:hhxlcJrB6QJ0CXhyPAGQ3QgLEvDsLyW3ZXr4X6HpEv7V8F+:hSrFkoGGVLE7lW9rjE58F+
MD5:	F43DDA08A617022485897A32BA92626B
SHA1:	BB8D872DFF74D6ADBB7C670B9A5530400D54DCAB
SHA-256:	88961720A724D8CE8C455B1A2A85AE64952816CE480956BFE4ACEF400EBD7A93
SHA-512:	B87F90B283922333C56422EF5083BE9B82A7C4F2215595C2A674B8A813C12FF0D3A4B84DE6C96C110CC7C3A8A8F50AEAE74F24EB045809B5283875071670740E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aXITZ.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+...../IDATx...}..c...SN$..@.e.Y..<.f...y.X.0.j..Z...T...)5..h.s.l..0.8gShl.T.l)..r.>?....Q.k{..}...~.VVta...V}.F.R...l.X......AbD..].)8..`....{p/..;.`..Q[......u..<.o."..u....u.Ge%1........`.F..J1Y..u....k..sew.bf....E.o....+.GPU..\..u.?(....j.>.B3.Da/K.QLo~'...]...go.k[+.@..K..U.\.......zInT....^..N.k......M.."V..J.".i.-q.r=.......}.L]?..].#..'.g..q"?I.....^.O .i..,.,\|.v\....,...Y.;.......J.Rd.s...N{.el.d.....=.h....X.k......^..N....,.v...Kt...b_...bx.w.....^1....\|...p.l#....}QXNd.9..~$.f....<'p.n..Pr..m5.@t;_.J.?4.\.[.,U1..........L.....g.Ky...?...c......\|F......2... w.i.>.rRs.K0._..0....v.&..s.r.v...u.Kbf."..rc=.....R,.V".#.....r.,.../.\|..$v..GX.\|}1...y."2.."....X.6.g"..dP.....a.....q.b. ...s4..y.B....6og.D.@.ATa.....FE.n>H,Q..p........(...c...\|.R..<_Kq.i?ME}.....h.?)...:....x.P^.?.=x.x\|...0.30...'v+..0.p.D...p......`m.y-....*. ..Gb:.>....[.......0..Y..\..n..-..a.%.H..O...#1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\BBX2afX[1].png Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	879
Entropy (8bit):	7.684764008510229
Encrypted:	false
SSDEEP:	24:nbwTOG/D9S9kmVgvOc0WL9P9juX7wlA3lrvfFRNa:bwTOk5S96vBB1jGwO3lzfxa
MD5:	4AAAEC9CA6F651BE6C54B005E92EA928
SHA1:	7296EC91AC01A8C127CD5B032A26BBC0B64E1451
SHA-256:	90396DF05C94DD44E772B064FF77BC1E27B5025AB9C21CE748A717380D4620DD
SHA-512:	09E0DE84657F2E520645C6BE20452C1779F6B492F67F88ABC7AB062D563C060AE51FC1E99579184C274AC3805214B6061AEC1730F72A6445AEBDB7E9F255755F
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+.....!IDATx...K.Q..wfv.u......,I"...)...z............>.OVObQ......d?\|.....F.QI$....qf.s.....">y`......{~.6.Z.`.D[&.cV`..-8i...J.S.N..xf.6@.v.(E..S.....&...T...?.X)${.....s.l."V..r...PJ!..p.4b}.=2...[......:.....LW3...A.eB.;...2...~...s_z.x\|..o....+..x....KW.G2..9.....<.\....gv...n..1..0...1}....Ht_A.x...D..5.H.......W..$_\G.e;./.1R+v....j.6v........z.k............&..(....,F.u8^..v...d-.j?.w..;..O.<9$..A..f.k.Kq9..N..p.rP2K.0.).X.4..Uh[..8..h....O..V.%.f.......G..U.m.6$......X....../.=....f:.......\|c(,.......l.\..<./..6...!...z(......# "S..f.Q.N=.0VQ._..\|....>@....P.7T.$./)s....Wy..8..xV......D....8r."b@....:.E.E......._(....4w....Ir..e-5..zjg...e?./...\|X..."!..'/......OI..J"I.MP....#...G.Vc..E..m.....wS.&.K<...Kq..\...A..$.K......,...[..D...8.?..)..3....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\auction[1].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	15909
Entropy (8bit):	5.844667772295533
Encrypted:	false
SSDEEP:	384:VnpAUape7VBhSpim2CpHDkUVnpKjObZsHC01eH:VpAU7BbsAfjBHi
MD5:	C5F7A6107D7C66E40ACCEBA36B877A81
SHA1:	E79ED4962659FD60F7F95750BD44C7842B827A0A
SHA-256:	A3B1A60ED12E07E59F317D87954F2C61AE60114AB6FD1A9B4012659B967BC8BE
SHA-512:	E283FFC424CF3FD6B9F2658209C9F3EA0785AA213A99F81D949B56C1D2CF45A5558EAEA1CD8CAB69E916BF42CEC3C812EDBE1CDB46C2DB4046105ECAFDC07622
Malicious:	false
IE Cache URL:	https://srtb.msn.com/auction?a=de-ch&b=50882175e06343329570d6e0394eb3af&c=MSN&d=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&e=HP&f=0&g=homepage&h=&j=0&k=0&l=&m=0&n=infopane%7C3%2C11%2C15&o=&p=init&q=&r=&s=1&t=&u=0&v=0&x=&w=&_=1623825050395
Preview:	..<script id="sam-metadata" type="text/html" data-json="{"optout":{"msaOptOut":false,"browserOptOut":false},"taboola":{"sessionId":"v2_1516630752d58c9338e7d8faf1e7c773_6085aab5-c16d-4401-856f-286decbc519f-tuct7c32043_1623825091_1623825091_CIi3jgYQr4c_GMfM5cTJr5OT6QEgASgBMCs4stANQNCIEEje2NkDUP___________wFYAGAAaIiuzvz94c6FCQ"},"tbsessionid":"v2_1516630752d58c9338e7d8faf1e7c773_6085aab5-c16d-4401-856f-286decbc519f-tuct7c32043_1623825091_1623825091_CIi3jgYQr4c_GMfM5cTJr5OT6QEgASgBMCs4stANQNCIEEje2NkDUP___________wFYAGAAaIiuzvz94c6FCQ","pageViewId":"50882175e06343329570d6e0394eb3af","RequestLevelBeaconUrls":[]}">..</script>..<li class="head-to-head serversidenativead hasimage " data-json="{"tvb":[],"trb":[],"tjb":[],"p":"gemini","e":true}" data-provider="gemini" data-ad-region="infopane" data-ad-index="3" data-viewability=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\checksync[1].htm Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	5.302761373207805
Encrypted:	false
SSDEEP:	384:RIAGcVXlblcqnzleZSweg2f5ngB/LkPF3OZOLQWwY4RXrqt:Q86qhbS2RxF3OsLQWwY4RXrqt
MD5:	A1EF805AA91F780CDF0CF4E76C6BF832
SHA1:	483C3961ADDAC604C7F5A0FEEBE50B31D895A259
SHA-256:	F5AF1444ED12476886A3594A5E696CADD4BFC46EA90A66C08F875E9750C93778
SHA-512:	FB14B11759D9CEDC224627908D91D7C1CF27D213FE1350883AD5F3EAA8D9D681346143B86708F63ECD1377D614CE348212AA0E9C8C6EB1B7DA539F1554F7C895
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/c21lg-d.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\de-ch[1].json Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	79097
Entropy (8bit):	5.337866393801766
Encrypted:	false
SSDEEP:	768:olAy9XsiItnuy5zIux1whjCU7kJB1C54AYtiQzNEJEWlCgP5HVN/QZYUmftKCB:olLEJxa4CmdiuWlDxHga7B
MD5:	408DDD452219F77E388108945DE7D0FE
SHA1:	C34BAE1E2EBD5867CB735A5C9573E08C4787E8E7
SHA-256:	197C124AD4B7DD42D6628B9BEFD54226CCDCD631ECFAEE6FB857195835F3B385
SHA-512:	17B4CF649A4EAE86A6A38ABA535CAF0AEFB318D06765729053FDE4CD2EFEE7C13097286D0B8595435D0EB62EF09182A9A10CFEE2E71B72B74A6566A2697EAB1B
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/6f0cca92-2dda-4588-a757-0e009f333603/de-ch.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","cctId":"55a804ab-e5c6-4b97-9319-86263d365d28","MainText":"Ihre Privatsph.re","MainInfoText":"Wir verarbeiten Ihre Daten, um Inhalte oder Anzeigen bereitzustellen, und analysieren die Bereitstellung solcher Inhalte oder Anzeigen, um Erkenntnisse .ber unsere Website zu gewinnen. Wir geben diese Informationen auf der Grundlage einer Einwilligung und eines berechtigten Interesses an unsere Partner weiter. Sie k.nnen Ihr Recht auf Einwilligung oder Widerspruch gegen ein berechtigtes Interesse aus.ben, und zwar auf der Grundlage eines der folgenden bestimmten Zwecke oder auf Partnerebene .ber den Link unter jedem Zweck. Diese Entscheidungen werden an unsere Anbieter, die am Transparency and Consent Framework teilnehmen, signalisiert.","AboutText":"Weitere Informationen","AboutCookiesText":"Ihre Privatsph.re","ConfirmText":"Alle zulassen","AllowAll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\iab2Data[1].json Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	242382
Entropy (8bit):	5.1486574437549235
Encrypted:	false
SSDEEP:	768:l3JqIW6A3pZcOkv+prD5bxLkjO68KQHamIT4Ff5+wbUk6syZ7TMwz:l3JqINA3kR4D5bxLk78KsIkfZ6hBz
MD5:	D76FFE379391B1C7EE0773A842843B7E
SHA1:	772ED93B31A368AE8548D22E72DDE24BB6E3855C
SHA-256:	D0EB78606C49FCD41E2032EC6CC6A985041587AAEE3AE15B6D3B693A924F08F2
SHA-512:	23E7888E069D05812710BF56CC76805A4E836B88F7493EC6F669F72A55D5D85AD86AD608650E708FA1861BC78A139616322D34962FD6BE0D64E0BEA0107BF4F4
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/iab2Data.json
Preview:	{"gvlSpecificationVersion":2,"tcfPolicyVersion":2,"features":{"1":{"descriptionLegal":"Vendors can:\n* Combine data obtained offline with data collected online in support of one or more Purposes or Special Purposes.","id":1,"name":"Match and combine offline data sources","description":"Data from offline data sources can be combined with your online activity in support of one or more purposes"},"2":{"descriptionLegal":"Vendors can:\n* Deterministically determine that two or more devices belong to the same user or household\n* Probabilistically determine that two or more devices belong to the same user or household\n* Actively scan device characteristics for identification for probabilistic identification if users have allowed vendors to actively scan device characteristics for identification (Special Feature 2)","id":2,"name":"Link different devices","description":"Different devices can be determined as belonging to you or your household in support of one or more of purposes."},"3":{"de

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\otSDKStub[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	16853
Entropy (8bit):	5.393243893610489
Encrypted:	false
SSDEEP:	192:2Qp/7PwSgaXIXbci91iEBadZH8fKR9OcmIQMYOYS7uzdwnBZv7iIHXF2FsT:FRr14FLMdZH8f4wOjawnTvuIHVh
MD5:	82566994A83436F3BDD00843109068A7
SHA1:	6D28B53651DA278FAE9CFBCEE1B93506A4BCD4A4
SHA-256:	450CFBC8F3F760485FBF12B16C2E4E1E9617F5A22354337968DD661D11FFAD1D
SHA-512:	1513DCF79F9CD8318109BDFD8BE1AEA4D2AEB4B9C869DAFF135173CC1C4C552C4C50C494088B0CA04B6FB6C208AA323BFE89E9B9DED57083F0E8954970EF8F22
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=function(e){"use strict";var t,o,n,i,a,r,s,l,c,p,u,d,m,h,f,g,b,A,C,v,y,I,S,w,T,L,R,B,D,G,E,P,_,U,k,O,F,V,x,N,H,M,j,K=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(o=t=t\|\|{})[o.Unknown=0]="Unknown",o[o.BannerCloseButton=1]="BannerCloseButton",o[o.ConfirmChoiceButton

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\rtbsmpubs[1].js Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3967
Entropy (8bit):	5.547542562366252
Encrypted:	false
SSDEEP:	96:8VJrMSx2hmsCoxMlTBeWNbhbX/pESOvxo:2FMGOmGyWW7bX/pvOvxo
MD5:	D63B04CE680802AC6C179C9B56BE1016
SHA1:	ECF17298F6E1A180A79E6E8E0957FD971A781A3D
SHA-256:	44668913C6DA2CB0D368C85184B825BF63090DDD0416BE44E659170A4C0BB113
SHA-512:	C823362FB1C21DAB510CE222890B53BC337D0C38BCED0EC759AB9165BDF2E80800992FD1A174F234F1A8E94C6286BEA0CEC4D3626BBE543BD1B44597AB1B28C1
Malicious:	false
IE Cache URL:	https://contextual.media.net/rtbsmpubs.php?&gdpr=0&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HBI57XIG&region=nv&ptrid=8PR68Q253&requestString=670468743*4%7C300x250%7C8CU157172%7C858412214%7C&crid=670468743&sd=1&requrl=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&bl=1&rt=5&dn=https://contextual.media.net&https=1&act=headerBid&prvReqId=146661780827173341623825085908&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.20181360547389737&ndec=1&scrsize=1280x1024&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A284%2C%22vh%22%3A271%2C%22ph%22%3A271%7D&itype=HB-CM&cc=CH&rc=ZH&ct=GLATTBRUGG&bt=1&gcp=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid3S0
Preview:	window.hbCMBidxc.rtbsheaderBid3S0({"pinfo":{"4":{"adCodeType":"BANNER","adFormat":"html","ae":false}},"meta":{"auction_id":"61475593486501473_1384633019","region":"nydc","vcfl":false,"serverId":"c10-mowx-prod-3","apid":1,"prvReqId":"146661780827173341623825085908","mowxLogs":{"SD":null,"PC":1,"SPRIG":0,"UCC":4,"lr_seg_cnt":0,"GCID":0,"IAB2":0,"vsGap":null},"sp":{"ivt":3,"source":0,"to":3,"fst":0,"cst":0,"isReq":3},"int_id":"HM","pageCat":{"iab2":"623"},"vls":0,"mp_seg":[17212,15607,15610,15630,15634]},"tl":{"670468743":{"bl":{"4":{"metainfo":{"responseTime":30,"experiment":{"ssProfile":0,"sfl":false,"md_rp":1,"ssBucket":0,"bfl":-100,"clt":0,"fl_rl":1},"rstb":true,"ab":"0","crid":"670468743","mowxLogs":{"g_uid_sent":[],"BCN_BF":null,"bsBucket":0,"ssProfile":0,"BCE":null,"lr":0,"BCI":null,"g_one_uid_sent":"None","uid_sent":0,"yhs_enabled":null,"SC":0,"lr_seg_deal":0,"BCT":null,"yhs_target_bidders":null,"BCN_YHS":null,"BCW":null,"bsProfile":0,"ssBucket":0,"TAF":0,"g_uid_cvrg":null,"suppl

C:\Users\user\AppData\Roaming\GlobalMgr.db Download File
Process:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.542152818827005
Encrypted:	false
SSDEEP:	3:LDIdyGK3MrRQWSEwXTjOcweBWRDSEwXTjOcwe7V8reKvRiQGVXVK8E:3T+RD3wXPMFx3wXPMeQpG5gz
MD5:	017C71551CF4AFB92F2EBBB13ABC181C
SHA1:	B4FAA85678A4D51A07214227087A0A007C8DA91B
SHA-256:	A9C034CC7CA17B18780AC1CD74CA4963555FA45F860DDE3128B5E3113716A46E
SHA-512:	2735B87E6BCAC0C42042842EFB8494DB0AE51CDD43442446FEACC4F2852685DB47DFEFB336F22365140616F6C60964916C6F582CCDB0FD18BA4718D35CD92D87
Malicious:	false
Preview:	[Profile]..config1=3105537a5f82de19dd9e30f475f73aed..config2=3105537a5f82de19dd9e30f475f73aed..config3=..config4=1b3d82ff206f2697db14bb5ee90b3a8d..config5=1..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.888717189348574
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
File size:	650952
MD5:	7145a179b496fc5fe19dc9b7745e2deb
SHA1:	db6434602ca9b8939a468defb9cef89d4ca93d12
SHA256:	8e23c6df003309ef656835eab65a8263c88ac0c277ffdbd5307eefdecb23872a
SHA512:	91cfe168917e51020c5a4628ef59ee462e2b9d82318d41f10059c3a910e94c8b1dc1ab5763c67a8a3d353893e36581788321f22b7c2c1aaf91df0125d38864e7
SSDEEP:	12288:32wvqfb2RbdyP4S54TNPBGauMKS3AsecQx3VD7aE0IpNb0cCbe4dp:GwvqfyW54JBMMGseLnaE04NAfdp
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......Sn................K.......I.......H.7.....}.....Eg.......w>.....Eg..G...Eg..4....w9......w).0............f..K....f..]....f..B..

File Icon


Icon Hash:	a2a0b496b2caca72

Static PE Info

General
Entrypoint:	0x59cfb0
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x60B8A55F [Thu Jun 3 09:48:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d63f364983b544871758380d2cf0f8de

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	1/23/2019 1:00:00 AM 1/26/2022 1:00:00 PM
Subject Chain	CN="Anhui Shabake Network Technology Co., Ltd.", OU=è¿è¥, O="Anhui Shabake Network Technology Co., Ltd.", L=Ma'anshan, S=Anhui, C=CN, SERIALNUMBER=91320804MA1MKN9Q0G, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=Ma'anshan, OID.1.3.6.1.4.1.311.60.2.1.2=Anhui, OID.1.3.6.1.4.1.311.60.2.1.3=CN
Version:	3
Thumbprint MD5:	82131D9B33E4A0F9B769F39D1A877284
Thumbprint SHA-1:	361AA4713F3588E09B44F3AB6F574B2F118A0CAC
Thumbprint SHA-256:	0C1FB0A95313A99C6EBEB09E403D0F876B8028DE6FE08F7C8FA499708CFFAEFD
Serial:	010FADBCE9936CE0F10987519C38EBCC

Entrypoint Preview

Instruction
pushad
mov esi, 0050A000h
lea edi, dword ptr [esi-00109000h]
mov dword ptr [edi+0018E014h], 2F525BA3h
push edi
or ebp, FFFFFFFFh
jmp 00007F6070C8CF40h
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F6070C8CF39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6070C8CF1Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F6070C8CF39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F6070C8CF3Dh
jne 00007F6070C8CF5Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6070C8CF51h
dec eax
add ebx, ebx
jne 00007F6070C8CF39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F6070C8CF06h
add ebx, ebx
jne 00007F6070C8CF39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F6070C8CF84h
xor ecx, ecx
sub eax, 03h
jc 00007F6070C8CF43h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F6070C8CFA7h
sar eax, 1
mov ebp, eax
jmp 00007F6070C8CF3Dh
add ebx, ebx
jne 00007F6070C8CF39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6070C8CEFEh
inc ecx
add ebx, ebx
jne 00007F6070C8CF39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6070C8CEF0h
add ebx, ebx
jne 00007F6070C8CF39h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F6070C8CF21h
jne 00007F6070C8CF3Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F6070C8CF16h
add ecx, 02h
cmp ebp, 00000000h

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a71e0	0x328	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19e000	0x91e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9ce00	0x20c8	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x19d174	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x19d194	0xa0	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x109000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0x10a000	0x94000	0x93400	False	0.991089903438	data	7.93093357299	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x19e000	0xa000	0x9600	False	0.476328125	data	5.85877550334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
ZIP	0x19e304	0x32d4	Zip archive data, at least v2.0 to extract	Chinese	China
RT_ICON	0x1a15dc	0xea8	data	Chinese	China
RT_ICON	0x1a2488	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 15793151, next used block 10789024	Chinese	China
RT_ICON	0x1a2d34	0x568	GLS_BINARY_LSB_FIRST	Chinese	China
RT_ICON	0x1a32a0	0x25a8	data	Chinese	China
RT_ICON	0x1a584c	0x10a8	data	Chinese	China
RT_ICON	0x1a68f8	0x468	GLS_BINARY_LSB_FIRST	Chinese	China
RT_MENU	0x1a6d64	0x26	data	Chinese	China
RT_DIALOG	0x1a6d90	0x18	data	Chinese	China
RT_GROUP_ICON	0x1a6dac	0x5a	data	Chinese	China
RT_VERSION	0x1a6e0c	0x248	data	Chinese	China
RT_MANIFEST	0x1a7058	0x188	XML 1.0 document text	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey
COMCTL32.dll
GDI32.dll	PatBlt
gdiplus.dll	GdipFree
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
MSIMG32.dll	AlphaBlend
ole32.dll	OleCreate
OLEAUT32.dll	VariantClear
SETUPAPI.dll	SetupIterateCabinetW
SHELL32.dll
SHLWAPI.dll	StrStrIA
urlmon.dll	URLDownloadToFileW
USER32.dll	GetDC
WLDAP32.dll
WS2_32.dll	setsockopt

Version Infos

Description	Data
LegalCopyright	Copyright (C) 2021
InternalName	SEM.exe
FileVersion	6.0.0.0603
ProductName	SEM.exe
FileDescription	_
OriginalFilename	SEM.exe
Translation	0x0804 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/16/21-08:30:40.658422	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49740	47.102.38.15	192.168.2.4
06/16/21-08:30:41.136031	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49740	47.102.38.15	192.168.2.4
06/16/21-08:30:41.980328	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49742	47.102.38.15	192.168.2.4
06/16/21-08:30:42.004662	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49740	47.102.38.15	192.168.2.4
06/16/21-08:30:42.461904	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49742	47.102.38.15	192.168.2.4
06/16/21-08:30:43.374367	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49742	47.102.38.15	192.168.2.4
06/16/21-08:30:43.376143	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49740	47.102.38.15	192.168.2.4
06/16/21-08:30:44.813692	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49742	47.102.38.15	192.168.2.4
06/16/21-08:30:45.943242	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49740	47.102.38.15	192.168.2.4
06/16/21-08:30:46.710480	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49742	47.102.38.15	192.168.2.4
06/16/21-08:30:52.789449	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49756	47.102.38.15	192.168.2.4
06/16/21-08:30:53.807652	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49740	47.102.38.15	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 08:30:39.939483881 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.283088923 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:40.286716938 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.311773062 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.311947107 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.560801029 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.656872988 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:40.657005072 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:40.658421993 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:40.708103895 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.778388023 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.778542042 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.911640882 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:40.911758900 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.913517952 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:40.913781881 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:41.133435011 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:41.136030912 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:41.176858902 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:41.257241964 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:41.630641937 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:41.654993057 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:41.655179024 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:41.975912094 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:41.980328083 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:42.003325939 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:42.004662037 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:42.036326885 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:42.051904917 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:42.105457067 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:42.112720966 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:42.457998037 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:42.461904049 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:42.505399942 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:43.026137114 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:43.026762962 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:43.029073000 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:43.029205084 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:43.370727062 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:43.371896029 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:43.374366999 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:43.376142979 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:43.427093029 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:43.427212000 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:44.464108944 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:44.465106964 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:44.813079119 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:44.813692093 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:44.880342960 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:44.976078033 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:45.060883999 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:45.410602093 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:45.584162951 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:45.939835072 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:45.943242073 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:46.051965952 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:46.367790937 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:46.367948055 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:46.706794977 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:46.710479975 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:46.848361969 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:52.163876057 CEST	49756	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:52.465792894 CEST	80	49756	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:52.466269016 CEST	49756	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:52.485896111 CEST	49756	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:52.785506010 CEST	80	49756	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:52.789448977 CEST	80	49756	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:52.791663885 CEST	49756	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:52.794847965 CEST	80	49756	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:52.796370983 CEST	49756	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:53.085537910 CEST	80	49756	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:53.509054899 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:53.509079933 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:53.803056002 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:53.807651997 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:30:53.849859953 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:30:56.875703096 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:30:56.921442032 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:56.921633005 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:30:56.930001974 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:30:56.972225904 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:56.978493929 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:56.978528023 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:56.978612900 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:30:56.991362095 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:30:57.033538103 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:57.039459944 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:57.039817095 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:30:57.040652037 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:30:57.084009886 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:57.115019083 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:57.115042925 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:30:57.115160942 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:31:01.710549116 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:31:01.710834980 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:31:01.716432095 CEST	49742	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:31:02.004700899 CEST	80	49742	47.102.38.15	192.168.2.4
Jun 16, 2021 08:31:08.807471991 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:31:08.808003902 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:31:08.809530020 CEST	49740	80	192.168.2.4	47.102.38.15
Jun 16, 2021 08:31:09.167538881 CEST	80	49740	47.102.38.15	192.168.2.4
Jun 16, 2021 08:31:31.803431988 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.803474903 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.829715014 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.829823017 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.847482920 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.847506046 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.847652912 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.849121094 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.849153042 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.849327087 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.876357079 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.876379013 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.876523018 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.876703978 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.878112078 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.878185034 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.891508102 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.891681910 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.891735077 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.891786098 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.891810894 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.891827106 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.891841888 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.891871929 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.891910076 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.891961098 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.892002106 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.892029047 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.892035007 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.892057896 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.892056942 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.892085075 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.892087936 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.892105103 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.892110109 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.892164946 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.892222881 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.909801960 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.910475969 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.925544024 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.925570965 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.926450968 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.927059889 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.927089930 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.927135944 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.927158117 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.927190065 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.927197933 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.927215099 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.927227974 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.927251101 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.927310944 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.927320004 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.940988064 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.941179991 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.952511072 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.952656031 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.953080893 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.953181982 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.953871965 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.954044104 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.986191034 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.986372948 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.986407042 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.986490965 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.986593008 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:31.986674070 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.988089085 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.995099068 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:31.998084068 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998127937 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998166084 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998229027 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998246908 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998255968 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998262882 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998322010 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998361111 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998392105 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998399019 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998437881 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998470068 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998491049 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998496056 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998509884 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998588085 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998636961 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998642921 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998701096 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998743057 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998745918 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998755932 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998761892 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998801947 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998821974 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998864889 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998910904 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998948097 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.998963118 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.998985052 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.999005079 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.999018908 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.999041080 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:31.999046087 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.999094009 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:31.999164104 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.034370899 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034410000 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034468889 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034504890 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034504890 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.034533024 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034564972 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034579039 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.034595966 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.034596920 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034631014 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034641981 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.034655094 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.034667969 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034693956 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.034989119 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.035721064 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.035756111 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.035824060 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.035865068 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.036917925 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.036942005 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.037025928 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.038172007 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.038196087 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.038243055 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.038275957 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.039586067 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.039611101 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.039664030 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.039705038 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.040316105 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.040668964 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.040704966 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.040745020 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.040780067 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.041192055 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.041215897 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.041249037 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.041280031 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.041316986 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.041341066 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.041348934 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.041352987 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.041357040 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.041390896 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.041426897 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041443110 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.041477919 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041501045 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041523933 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041547060 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041574001 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041579962 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041590929 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041594982 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041609049 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041635036 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041656971 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041677952 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041686058 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041687012 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041697025 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041718006 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041719913 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041728020 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041743040 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041764975 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041791916 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041815996 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041836023 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041837931 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041862011 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041862965 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041877031 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041896105 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041901112 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041920900 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.041932106 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041954041 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.041973114 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.041985035 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.042031050 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042037010 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.042066097 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042098999 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042133093 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042154074 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042165995 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042169094 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042177916 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042200089 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042216063 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042237997 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042274952 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042282104 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042309046 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042342901 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042361975 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042371035 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042376995 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042380095 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042383909 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042387962 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042413950 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042428970 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042448997 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.042476892 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042481899 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.042520046 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042553902 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042587996 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042599916 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042607069 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042622089 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042637110 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042656898 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042669058 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042695045 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.042701960 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.042732954 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042766094 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042799950 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042813063 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042831898 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042850018 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042865992 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.042896032 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.042910099 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.043147087 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.043175936 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.043206930 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.043222904 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.043257952 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.043394089 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.043427944 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.044425964 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.044495106 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.044498920 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.044529915 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.044545889 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.044553995 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.044578075 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.044650078 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.045654058 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.045685053 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.045792103 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.045799971 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.046793938 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.046828985 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.046982050 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.046992064 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.047878981 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.047940016 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.048017979 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.049004078 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.049036026 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.049112082 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.050097942 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.050158978 CEST	443	49782	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.050276995 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.050286055 CEST	49782	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.058387995 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.086040020 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086096048 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086118937 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086141109 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086163998 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086245060 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086256027 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086258888 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086262941 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086265087 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086280107 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086307049 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086344957 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086347103 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086374044 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086380005 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086396933 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086421967 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086441994 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086443901 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086462021 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086474895 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086477995 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086498022 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086519003 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086519957 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086525917 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086529016 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086532116 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086544991 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086558104 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086564064 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086580038 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086628914 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086644888 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086654902 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086667061 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086673021 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086680889 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086682081 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086699963 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086718082 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086719990 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086740017 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086750031 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086754084 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086756945 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086772919 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086788893 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086806059 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086824894 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086853027 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086858034 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086858988 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086868048 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086884022 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086891890 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086898088 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086904049 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086916924 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086920023 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086940050 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086957932 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086961031 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086972952 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.086986065 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.086997032 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087003946 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087043047 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087048054 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087049007 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087074041 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087086916 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087101936 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087156057 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087174892 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087182045 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087208033 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087208986 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087225914 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087239027 CEST	443	49780	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087241888 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087250948 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087270021 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087275028 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087348938 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087352037 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087369919 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087379932 CEST	49780	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087414980 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087416887 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087469101 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087563992 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087620020 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087620974 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087641001 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087644100 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087688923 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087712049 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087737083 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087743998 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087762117 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087776899 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087884903 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087886095 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087909937 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.087939978 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087960958 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087970972 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.087979078 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.088023901 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.088041067 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.088092089 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.088102102 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.088116884 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.088120937 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.088149071 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.088165998 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.088221073 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.088310003 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.105822086 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.105850935 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.105875015 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.105897903 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.105952978 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.105997086 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.106332064 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.106355906 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.106457949 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.107599020 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.107621908 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.107711077 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.108841896 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.108860016 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.108925104 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.110071898 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.110102892 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.110167980 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.111368895 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.111552954 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.111619949 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.112652063 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.112669945 CEST	443	49781	151.101.1.44	192.168.2.4
Jun 16, 2021 08:31:32.112735987 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.112762928 CEST	49781	443	192.168.2.4	151.101.1.44
Jun 16, 2021 08:31:32.130867958 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.130902052 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.130943060 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.130979061 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.130990028 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.131010056 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.131011963 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.131043911 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.131045103 CEST	443	49779	87.248.118.23	192.168.2.4
Jun 16, 2021 08:31:32.131066084 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:31:32.131088018 CEST	49779	443	192.168.2.4	87.248.118.23
Jun 16, 2021 08:32:30.382709026 CEST	49758	443	192.168.2.4	104.20.185.68
Jun 16, 2021 08:32:30.425487995 CEST	443	49758	104.20.185.68	192.168.2.4
Jun 16, 2021 08:32:30.425673962 CEST	49758	443	192.168.2.4	104.20.185.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 08:30:20.040961027 CEST	49714	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:20.099711895 CEST	53	49714	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:20.256019115 CEST	58028	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:20.306071997 CEST	53	58028	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:20.339185953 CEST	53097	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:20.390567064 CEST	53	53097	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:20.398822069 CEST	49257	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:20.462713003 CEST	53	49257	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:20.565740108 CEST	62389	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:20.616111040 CEST	53	62389	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:21.837693930 CEST	49910	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:21.896799088 CEST	53	49910	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:23.876368999 CEST	55854	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:23.944068909 CEST	53	55854	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:24.925298929 CEST	64549	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:24.976126909 CEST	53	64549	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:32.406934023 CEST	63153	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:32.466406107 CEST	53	63153	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:35.977909088 CEST	52991	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:36.043080091 CEST	53	52991	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:36.901426077 CEST	53700	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:36.957372904 CEST	53	53700	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:37.776493073 CEST	51726	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:37.826863050 CEST	53	51726	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:38.718619108 CEST	56794	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:38.772346973 CEST	53	56794	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:39.791996002 CEST	56534	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:39.809530020 CEST	56627	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:39.843543053 CEST	53	56534	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:39.868293047 CEST	53	56627	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:40.411024094 CEST	56621	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:40.472384930 CEST	53	56621	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:40.479955912 CEST	63116	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:40.538681984 CEST	53	63116	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:40.627156973 CEST	64078	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:40.678503036 CEST	53	64078	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:40.696645975 CEST	64801	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:40.752724886 CEST	53	64801	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:41.242106915 CEST	61721	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:41.311881065 CEST	53	61721	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:41.848406076 CEST	51255	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:41.899926901 CEST	53	51255	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:42.659743071 CEST	61522	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:42.712817907 CEST	53	61522	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:43.519397974 CEST	52337	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:43.573065996 CEST	53	52337	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:44.482417107 CEST	55046	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:44.536367893 CEST	53	55046	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:45.323657990 CEST	49612	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:45.377042055 CEST	53	49612	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:46.126832008 CEST	49285	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:46.189372063 CEST	53	49285	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:50.262595892 CEST	50601	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:50.321531057 CEST	53	50601	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:50.669204950 CEST	60875	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:50.722923040 CEST	53	60875	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:51.728152037 CEST	56448	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:52.086534977 CEST	53	56448	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:52.547501087 CEST	59172	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:52.623667002 CEST	53	59172	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:56.692702055 CEST	62420	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:56.759843111 CEST	53	62420	8.8.8.8	192.168.2.4
Jun 16, 2021 08:30:56.955955029 CEST	60579	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:30:57.023729086 CEST	53	60579	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:11.046863079 CEST	50183	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:11.105504990 CEST	53	50183	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:12.010397911 CEST	61531	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:12.076498032 CEST	53	61531	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:13.076317072 CEST	49228	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:13.137556076 CEST	53	49228	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:14.249464989 CEST	59794	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:14.309294939 CEST	53	59794	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:15.014231920 CEST	55916	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:15.074521065 CEST	53	55916	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:15.099188089 CEST	52752	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:15.165848017 CEST	53	52752	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:15.840318918 CEST	60542	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:15.898972988 CEST	53	60542	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:16.451577902 CEST	60689	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:16.512111902 CEST	53	60689	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:17.591082096 CEST	64206	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:17.655821085 CEST	53	64206	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:18.862407923 CEST	50904	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:18.921665907 CEST	53	50904	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:19.532077074 CEST	57525	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:19.600023031 CEST	53	57525	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:26.126315117 CEST	53814	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:26.195718050 CEST	53	53814	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:27.482872963 CEST	53418	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:27.550318003 CEST	53	53418	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:29.635153055 CEST	62833	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:29.695610046 CEST	53	62833	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:30.691756010 CEST	59260	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:30.742094994 CEST	53	59260	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:31.748491049 CEST	49944	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:31.759242058 CEST	63300	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:31.799449921 CEST	53	49944	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:31.823612928 CEST	53	63300	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:32.268732071 CEST	61449	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:32.331800938 CEST	53	61449	8.8.8.8	192.168.2.4
Jun 16, 2021 08:31:59.835510969 CEST	51275	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:31:59.911900997 CEST	53	51275	8.8.8.8	192.168.2.4
Jun 16, 2021 08:32:03.514435053 CEST	63492	53	192.168.2.4	8.8.8.8
Jun 16, 2021 08:32:03.576792002 CEST	53	63492	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 16, 2021 08:30:39.809530020 CEST	192.168.2.4	8.8.8.8	0x141f	Standard query (0)	w.nanweng.cn	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:40.479955912 CEST	192.168.2.4	8.8.8.8	0x427d	Standard query (0)	w.nanweng.cn	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:40.627156973 CEST	192.168.2.4	8.8.8.8	0xe1bd	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:51.728152037 CEST	192.168.2.4	8.8.8.8	0x5b64	Standard query (0)	w.nanweng.cn	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:52.547501087 CEST	192.168.2.4	8.8.8.8	0x8ec0	Standard query (0)	web.vortex.data.msn.com	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:56.692702055 CEST	192.168.2.4	8.8.8.8	0xc897	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:56.955955029 CEST	192.168.2.4	8.8.8.8	0x7bb4	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:26.126315117 CEST	192.168.2.4	8.8.8.8	0x9fcd	Standard query (0)	lg3.media.net	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:27.482872963 CEST	192.168.2.4	8.8.8.8	0x9ba0	Standard query (0)	hblg.media.net	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:29.635153055 CEST	192.168.2.4	8.8.8.8	0xc14	Standard query (0)	cvision.media.net	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:30.691756010 CEST	192.168.2.4	8.8.8.8	0xa104	Standard query (0)	srtb.msn.com	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:31.748491049 CEST	192.168.2.4	8.8.8.8	0xc236	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:31.759242058 CEST	192.168.2.4	8.8.8.8	0x521f	Standard query (0)	img.img-taboola.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 16, 2021 08:30:39.868293047 CEST	8.8.8.8	192.168.2.4	0x141f	No error (0)	w.nanweng.cn		47.102.38.15	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:39.868293047 CEST	8.8.8.8	192.168.2.4	0x141f	No error (0)	w.nanweng.cn		106.14.178.247	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:39.868293047 CEST	8.8.8.8	192.168.2.4	0x141f	No error (0)	w.nanweng.cn		47.103.45.17	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:40.538681984 CEST	8.8.8.8	192.168.2.4	0x427d	No error (0)	w.nanweng.cn		47.102.38.15	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:40.538681984 CEST	8.8.8.8	192.168.2.4	0x427d	No error (0)	w.nanweng.cn		106.14.178.247	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:40.538681984 CEST	8.8.8.8	192.168.2.4	0x427d	No error (0)	w.nanweng.cn		47.103.45.17	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:40.678503036 CEST	8.8.8.8	192.168.2.4	0xe1bd	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 08:30:52.086534977 CEST	8.8.8.8	192.168.2.4	0x5b64	No error (0)	w.nanweng.cn		47.102.38.15	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:52.086534977 CEST	8.8.8.8	192.168.2.4	0x5b64	No error (0)	w.nanweng.cn		106.14.178.247	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:52.086534977 CEST	8.8.8.8	192.168.2.4	0x5b64	No error (0)	w.nanweng.cn		47.103.45.17	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:52.623667002 CEST	8.8.8.8	192.168.2.4	0x8ec0	No error (0)	web.vortex.data.msn.com	web.vortex.data.microsoft.com		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 08:30:56.759843111 CEST	8.8.8.8	192.168.2.4	0xc897	No error (0)	geolocation.onetrust.com		104.20.185.68	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:56.759843111 CEST	8.8.8.8	192.168.2.4	0xc897	No error (0)	geolocation.onetrust.com		104.20.184.68	A (IP address)	IN (0x0001)
Jun 16, 2021 08:30:57.023729086 CEST	8.8.8.8	192.168.2.4	0x7bb4	No error (0)	contextual.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:26.195718050 CEST	8.8.8.8	192.168.2.4	0x9fcd	No error (0)	lg3.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:27.550318003 CEST	8.8.8.8	192.168.2.4	0x9ba0	No error (0)	hblg.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:29.695610046 CEST	8.8.8.8	192.168.2.4	0xc14	No error (0)	cvision.media.net	cvision.media.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 08:31:30.742094994 CEST	8.8.8.8	192.168.2.4	0xa104	No error (0)	srtb.msn.com	www.msn.com		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 08:31:30.742094994 CEST	8.8.8.8	192.168.2.4	0xa104	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 08:31:31.799449921 CEST	8.8.8.8	192.168.2.4	0xc236	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 08:31:31.799449921 CEST	8.8.8.8	192.168.2.4	0xc236	No error (0)	edge.gycpi.b.yahoodns.net		87.248.118.23	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:31.799449921 CEST	8.8.8.8	192.168.2.4	0xc236	No error (0)	edge.gycpi.b.yahoodns.net		87.248.118.22	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:31.823612928 CEST	8.8.8.8	192.168.2.4	0x521f	No error (0)	img.img-taboola.com	tls13.taboola.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jun 16, 2021 08:31:31.823612928 CEST	8.8.8.8	192.168.2.4	0x521f	No error (0)	tls13.taboola.map.fastly.net		151.101.1.44	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:31.823612928 CEST	8.8.8.8	192.168.2.4	0x521f	No error (0)	tls13.taboola.map.fastly.net		151.101.65.44	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:31.823612928 CEST	8.8.8.8	192.168.2.4	0x521f	No error (0)	tls13.taboola.map.fastly.net		151.101.129.44	A (IP address)	IN (0x0001)
Jun 16, 2021 08:31:31.823612928 CEST	8.8.8.8	192.168.2.4	0x521f	No error (0)	tls13.taboola.map.fastly.net		151.101.193.44	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

w.nanweng.cn

w.nanweng.cn

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49740	47.102.38.15	80	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2021 08:30:40.311773062 CEST	2554	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jun 16, 2021 08:30:40.311947107 CEST	2554	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}
Jun 16, 2021 08:30:40.658421993 CEST	2561	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:40 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:40.778388023 CEST	2567	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jun 16, 2021 08:30:40.778542042 CEST	2567	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}
Jun 16, 2021 08:30:41.136030912 CEST	2664	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:40 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:41.654993057 CEST	2771	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jun 16, 2021 08:30:41.655179024 CEST	2771	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}
Jun 16, 2021 08:30:42.004662037 CEST	2987	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:41 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:43.026137114 CEST	3006	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jun 16, 2021 08:30:43.026762962 CEST	3006	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 67 45 69 45 69 59 53 48 41 49 79 4d 7a 45 52 49 67 45 45 48 43 63 6f 49 51 49 78 4c 43 49 43 4a 41 45 71 47 43 49 47 42 77 41 69 41 51 51 54 4a 69 38 6d 45 53 63 6f 49 52 38 78 4c 7a 34 Data Ascii: js=DhIhAwgjKRsxKCJdJgEiEiYSHAIyMzERIgEEHCcoIQIxLCICJAEqGCIGBwAiAQQTJi8mEScoIR8xLz4CJAIiWCY-OloyPy5YJDwiWyQ-MQYyET0GMT8uXjEsJl4yAQhYJS89ByYGOQcyAiIYIgUlGzEoIl0mPzIcJC8uGCIFJVsiAQQcJyghWgo8OgIkAiIRJj8qWiU-JlgyPz0GJC8hADE-Ll4xLDpeMT8mHDEBOlglPDJY
Jun 16, 2021 08:30:43.376142979 CEST	3013	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:43 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:44.976078033 CEST	3036	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jun 16, 2021 08:30:45.060883999 CEST	3036	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}
Jun 16, 2021 08:30:45.584162951 CEST	3043	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}
Jun 16, 2021 08:30:45.943242073 CEST	3054	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:45 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:53.509054899 CEST	3208	OUT	POST /qy/rq HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 469 Host: w.nanweng.cn
Jun 16, 2021 08:30:53.509079933 CEST	3209	OUT	Data Raw: 26 69 6e 66 3d 7b 22 61 62 22 3a 30 2c 22 61 70 70 69 64 22 3a 32 32 32 33 2c 22 61 76 6c 74 22 3a 6e 75 6c 6c 2c 22 61 76 73 22 3a 30 2c 22 62 63 6c 6b 22 3a 30 2c 22 62 70 22 3a 30 2c 22 63 69 64 22 3a 30 2c 22 63 6b 77 22 3a 22 22 2c 22 63 6c Data Ascii: &inf={"ab":0,"appid":2223,"avlt":null,"avs":0,"bclk":0,"bp":0,"cid":0,"ckw":"","clr":0,"cont":0,"conw":0,"ddr":0,"dlr":0,"etrc":20,"etrc2":0,"fre":0,"frr":0,"fs":0,"gqp":0,"lbc":0,"lbcr":0,"mbp":0,"md":0,"md5":"7145a179b496fc5fe19dc9b7745e2deb
Jun 16, 2021 08:30:53.807651997 CEST	3210	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:53 GMT Content-Type: text/html Content-Length: 570 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 77 2e 6e 61 6e 77 65 6e 67 2e 63 6e 2f 71 79 2f 72 71 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 75 66 36 67 77 34 37 78 61 30 71 30 38 6e 71 70 67 36 7a 74 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 31 2f 30 36 2f 31 36 20 31 34 3a 33 30 3a 35 33 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://w.nanweng.cn/qy/rq</td></tr><tr><td>Server:</td><td>izuf6gw47xa0q08nqpg6ztz</td></tr><tr><td>Date:</td><td>2021/06/16 14:30:53</td></tr></table><hr/>Powered by Tengine<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49742	47.102.38.15	80	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2021 08:30:40.913517952 CEST	2569	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jun 16, 2021 08:30:40.913781881 CEST	2570	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 67 45 69 45 69 59 53 48 41 49 79 4d 7a 45 52 49 67 45 45 48 43 63 6f 49 51 49 78 4c 43 49 43 4a 41 45 71 47 43 49 47 42 77 41 69 41 51 51 54 4a 69 38 6d 45 53 63 6f 49 52 38 78 4c 7a 34 Data Ascii: js=DhIhAwgjKRsxKCJdJgEiEiYSHAIyMzERIgEEHCcoIQIxLCICJAEqGCIGBwAiAQQTJi8mEScoIR8xLz4CJAIiWCY-OloyPy5YJDwiWyQ-MQYyET0GMT8uXjEsJl4yAQhYJS89ByYGOQcyAiIYIgUlGzEoIl0mPzIcJC8uGCIFJVsiAQQcJyghWgo8OgIkAiIRJj8qWiU-JlgyPz0GJC8hADE-Ll4xLDpeMT8mHDEBOlglPDJY
Jun 16, 2021 08:30:41.630641937 CEST	2768	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 67 45 69 45 69 59 53 48 41 49 79 4d 7a 45 52 49 67 45 45 48 43 63 6f 49 51 49 78 4c 43 49 43 4a 41 45 71 47 43 49 47 42 77 41 69 41 51 51 54 4a 69 38 6d 45 53 63 6f 49 52 38 78 4c 7a 34 43 4a 41 49 69 57 43 59 2d 4f 6c 6f 79 50 79 35 59 4a 44 77 69 57 79 51 2d 4d 51 59 79 45 54 30 47 4d 54 38 75 58 6a 45 73 4a 6c 34 79 41 51 68 59 4a 53 38 39 42 79 59 47 4f 51 63 79 41 69 49 59 49 67 55 6c 47 7a 45 6f 49 6c 30 6d 50 7a 49 63 4a 43 38 75 47 43 49 46 4a 56 73 69 41 51 51 63 4a 79 67 68 57 67 6f 38 4f 67 49 6b 41 69 49 52 4a 6a 38 71 57 69 55 2d 4a 6c 67 79 50 7a 30 47 4a 43 38 68 41 44 45 2d 4c 6c 34 78 4c 44 70 65 4d 54 38 6d 48 44 45 42 4f 6c 67 6c 50 44 4a 59 4a 6c 6b 74 42 7a 45 6f 49 68 67 69 42 54 45 48 43 41 49 69 58 53 49 42 4d 68 34 6d 4b 46 38 63 4a 77 45 79 48 43 59 53 49 68 67 69 42 54 45 66 49 67 45 45 48 43 63 6f 49 56 30 4b 50 44 6f 43 4a 41 49 69 41 69 63 6f 49 56 30 4a 41 69 4a 64 4a 6a 4e 62 49 41 3d 3d Data Ascii: js=DhIhAwgjKRsxKCJdJgEiEiYSHAIyMzERIgEEHCcoIQIxLCICJAEqGCIGBwAiAQQTJi8mEScoIR8xLz4CJAIiWCY-OloyPy5YJDwiWyQ-MQYyET0GMT8uXjEsJl4yAQhYJS89ByYGOQcyAiIYIgUlGzEoIl0mPzIcJC8uGCIFJVsiAQQcJyghWgo8OgIkAiIRJj8qWiU-JlgyPz0GJC8hADE-Ll4xLDpeMT8mHDEBOlglPDJYJlktBzEoIhgiBTEHCAIiXSIBMh4mKF8cJwEyHCYSIhgiBTEfIgEEHCcoIV0KPDoCJAIiAicoIV0JAiJdJjNbIA==
Jun 16, 2021 08:30:41.980328083 CEST	2986	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:41 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:42.105457067 CEST	2987	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jun 16, 2021 08:30:42.112720966 CEST	2988	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 67 45 69 45 69 59 53 48 41 49 79 4d 7a 45 52 49 67 45 45 48 43 63 6f 49 51 49 78 4c 43 49 43 4a 41 45 71 47 43 49 47 42 77 41 69 41 51 51 54 4a 69 38 6d 45 53 63 6f 49 52 38 78 4c 7a 34 Data Ascii: js=DhIhAwgjKRsxKCJdJgEiEiYSHAIyMzERIgEEHCcoIQIxLCICJAEqGCIGBwAiAQQTJi8mEScoIR8xLz4CJAIiWCY-OloyPy5YJDwiWyQ-MQYyET0GMT8uXjEsJl4yAQhYJS89ByYGOQcyAiIYIgUlGzEoIl0mPzIcJC8uGCIFJVsiAQQcJyghWgo8OgIkAiIRJj8qWiU-JlgyPz0GJC8hADE-Ll4xLDpeMT8mHDEBOlglPDJY
Jun 16, 2021 08:30:42.461904049 CEST	2999	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:42 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:43.029073000 CEST	3007	OUT	POST /qy/png HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 13 Host: w.nanweng.cn
Jun 16, 2021 08:30:43.029205084 CEST	3007	OUT	Data Raw: 6a 73 3d 7b 22 70 6e 67 22 3a 31 7d 0a Data Ascii: js={"png":1}
Jun 16, 2021 08:30:43.374366999 CEST	3013	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:43 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:44.464108944 CEST	3028	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jun 16, 2021 08:30:44.465106964 CEST	3028	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 67 45 69 45 69 59 53 48 41 49 79 4d 7a 45 52 49 67 45 45 48 43 63 6f 49 51 49 78 4c 43 49 43 4a 41 45 71 47 43 49 47 42 77 41 69 41 51 51 54 4a 69 38 6d 45 53 63 6f 49 52 38 78 4c 7a 34 Data Ascii: js=DhIhAwgjKRsxKCJdJgEiEiYSHAIyMzERIgEEHCcoIQIxLCICJAEqGCIGBwAiAQQTJi8mEScoIR8xLz4CJAIiWCY-OloyPy5YJDwiWyQ-MQYyET0GMT8uXjEsJl4yAQhYJS89ByYGOQcyAiIYIgUlGzEoIl0mPzIcJC8uGCIFJVsiAQQcJyghWgo8OgIkAiIRJj8qWiU-JlgyPz0GJC8hADE-Ll4xLDpeMT8mHDEBOlglPDJY
Jun 16, 2021 08:30:44.813692093 CEST	3029	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:44 GMT Content-Length: 0 Connection: keep-alive
Jun 16, 2021 08:30:46.367790937 CEST	3056	OUT	POST /qy/gl HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0; WOW64; Trident/5.0) Content-Length: 331 Host: w.nanweng.cn
Jun 16, 2021 08:30:46.367948055 CEST	3056	OUT	Data Raw: 6a 73 3d 44 68 49 68 41 77 67 6a 4b 52 73 78 4b 43 4a 64 4a 67 45 69 45 69 59 53 48 41 49 79 4d 7a 45 52 49 67 45 45 48 43 63 6f 49 51 49 78 4c 43 49 43 4a 41 45 71 47 43 49 47 42 77 41 69 41 51 51 54 4a 69 38 6d 45 53 63 6f 49 52 38 78 4c 7a 34 Data Ascii: js=DhIhAwgjKRsxKCJdJgEiEiYSHAIyMzERIgEEHCcoIQIxLCICJAEqGCIGBwAiAQQTJi8mEScoIR8xLz4CJAIiWCY-OloyPy5YJDwiWyQ-MQYyET0GMT8uXjEsJl4yAQhYJS89ByYGOQcyAiIYIgUlGzEoIl0mPzIcJC8uGCIFJVsiAQQcJyghWgo8OgIkAiIRJj8qWiU-JlgyPz0GJC8hADE-Ll4xLDpeMT8mHDEBOlglPDJY
Jun 16, 2021 08:30:46.710479975 CEST	3061	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:46 GMT Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49756	47.102.38.15	80	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2021 08:30:52.485896111 CEST	3189	OUT	POST /qy/ov HTTP/1.1 Host: w.nanweng.cn Content-Length: 190 Connection:close Accept-Language: zh-cn Cache-Conbtrol:no-cache Content-Type:application/x-www-form-urlencoded Data Raw: 26 72 70 73 3d 30 26 72 65 73 69 64 3d 30 26 72 65 73 32 69 64 3d 30 26 75 69 64 3d 33 31 30 35 35 33 37 61 35 66 38 32 64 65 31 39 64 64 39 65 33 30 66 34 37 35 66 37 33 61 65 64 26 7a 69 64 3d 26 70 61 67 3d 30 26 63 31 3d 30 26 70 6e 3d 26 72 6e 3d 26 73 6f 66 74 3d 26 61 70 70 69 64 3d 32 32 32 33 26 73 69 64 3d 31 36 30 38 31 26 76 65 72 3d 36 2e 30 2e 30 2e 36 30 33 26 76 6d 3d 31 31 26 74 6d 3d 31 35 36 39 37 33 34 33 32 33 26 74 79 70 65 3d 32 30 26 73 69 67 3d 33 43 38 37 46 41 31 37 39 35 42 30 43 37 33 45 30 44 36 36 30 44 45 36 42 37 33 32 41 30 43 30 0d 0a Data Ascii: &rps=0&resid=0&res2id=0&uid=3105537a5f82de19dd9e30f475f73aed&zid=&pag=0&c1=0&pn=&rn=&soft=&appid=2223&sid=16081&ver=6.0.0.603&vm=11&tm=1569734323&type=20&sig=3C87FA1795B0C73E0D660DE6B732A0C0
Jun 16, 2021 08:30:52.789448977 CEST	3199	IN	HTTP/1.1 403 Forbidden Date: Wed, 16 Jun 2021 06:30:52 GMT Content-Type: text/html Content-Length: 570 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 77 2e 6e 61 6e 77 65 6e 67 2e 63 6e 2f 71 79 2f 6f 76 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 75 66 36 68 39 33 34 70 37 61 74 6f 71 61 62 6e 6a 72 6e 7a 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 31 2f 30 36 2f 31 36 20 31 34 3a 33 30 3a 35 32 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://w.nanweng.cn/qy/ov</td></tr><tr><td>Server:</td><td>izuf6h934p7atoqabnjrnzz</td></tr><tr><td>Date:</td><td>2021/06/16 14:30:52</td></tr></table><hr/>Powered by Tengine<hr><center>tengine</center></body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 16, 2021 08:30:56.978528023 CEST	104.20.185.68	443	192.168.2.4	49758	CN=onetrust.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Feb 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Feb 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:30:56.978528023 CEST	104.20.185.68	443	192.168.2.4	49758	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.891910076 CEST	87.248.118.23	443	192.168.2.4	49780	CN=*.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 03 02:00:00 CEST 2021 Tue Oct 22 14:00:00 CEST 2013	Thu Jul 22 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.891910076 CEST	87.248.118.23	443	192.168.2.4	49780	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.892164946 CEST	87.248.118.23	443	192.168.2.4	49779	CN=*.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 03 02:00:00 CEST 2021 Tue Oct 22 14:00:00 CEST 2013	Thu Jul 22 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.892164946 CEST	87.248.118.23	443	192.168.2.4	49779	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.927227974 CEST	151.101.1.44	443	192.168.2.4	49782	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.927227974 CEST	151.101.1.44	443	192.168.2.4	49782	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.927251101 CEST	151.101.1.44	443	192.168.2.4	49781	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Jun 16, 2021 08:31:31.927251101 CEST	151.101.1.44	443	192.168.2.4	49781	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		37f463bf4616ecd445d4a1937da06e19

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe PID: 7004 Parent PID: 6004

General

Start time:	08:30:38
Start date:	16/06/2021
Path:	C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe'
Imagebase:	0x400000
File size:	650952 bytes
MD5 hash:	7145A179B496FC5FE19DC9B7745E2DEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe PID: 7004 Parent PID: 6004 AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exeCOMMON

Executed Functions

Function 04CA9260, Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.725748856.0000000004CA9000.00000004.00000001.sdmp, Offset: 04CA9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4ca9000_AdobeAcrobatProDC2021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8305fad62af9fd9d7836808133c96558825905a462e5a98d35160408b57e7a2
Instruction ID: 003e50a174dec0731dec3c80b9a17043ae4e3f848bb19cdf500d41ee34c79fa8
Opcode Fuzzy Hash: d8305fad62af9fd9d7836808133c96558825905a462e5a98d35160408b57e7a2
Instruction Fuzzy Hash: F2F158B1B442029FEB248E14CC47B7AB7E7AF8071CF15485AE909AB281D775FC61C7A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report AdobeAcrobatProDC2021.005.20048#U4e2d#U6587#U76f4#U88c5#U7834#U89e3#U7248@2223_16081.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics