Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 06:04 UTC

General

  • Target

    73f9d42a089f261101717c1c74b65967.pdf

  • Size

    76KB

  • MD5

    73f9d42a089f261101717c1c74b65967

  • SHA1

    3d726fec77c19fc58ff3b5a0387dd9e43c9ee914

  • SHA256

    b978727dd57fcd43670282434ed3aec7858aaf498330e1ff61d79734eb5d8120

  • SHA512

    706681414e267c43822e02b30ba3e9d3934bd3191053737359d6210876ca1af2fddbfa8ac0f046b3156b907350fdb0eb7586d93980a302e75d2db283de321dbf

  • SSDEEP

    1536:DhmFJfUfv71T5YAInt8bULN0dYs0wcCXIM6ysMumGAUr6yzEVQTq0CLoJw2:lic7R5r4t8IGdYzpmrstAG6AWydOoT

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\73f9d42a089f261101717c1c74b65967.pdf"
    1⤵
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BB460A136B31B4D4FE5C2F85E5768A71 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BB460A136B31B4D4FE5C2F85E5768A71 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
        3⤵
          PID:2604
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8E8EFB4C68B079174CAD94544594E78B --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
          3⤵
            PID:512
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C205FC47256091388825DB142AD104A1 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
              PID:4020
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3C5716594F0F143D8A992C0E842AC7F1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3C5716594F0F143D8A992C0E842AC7F1 --renderer-client-id=5 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
              3⤵
                PID:4972
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0495EDF51F16D12F096961F38EE2D148 --mojo-platform-channel-handle=2648 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                3⤵
                  PID:4184
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E83CE681BEDCA9B5E9D5F5D151DE77E6 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  3⤵
                    PID:4416
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:5064

                Network

                • flag-us
                  DNS
                  149.177.190.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  149.177.190.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  59.128.231.4.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  59.128.231.4.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  g.bing.com
                  Remote address:
                  8.8.8.8:53
                  Request
                  g.bing.com
                  IN A
                  Response
                  g.bing.com
                  IN CNAME
                  g-bing-com.a-0001.a-msedge.net
                  g-bing-com.a-0001.a-msedge.net
                  IN CNAME
                  dual-a-0001.a-msedge.net
                  dual-a-0001.a-msedge.net
                  IN A
                  204.79.197.200
                  dual-a-0001.a-msedge.net
                  IN A
                  13.107.21.200
                • flag-us
                  GET
                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid=
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid= HTTP/2.0
                  host: g.bing.com
                  accept-encoding: gzip, deflate
                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                  Response
                  HTTP/2.0 204
                  cache-control: no-cache, must-revalidate
                  pragma: no-cache
                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                  set-cookie: MUID=2B0B66EFC9AC679F18BB751FC88B668A; domain=.bing.com; expires=Thu, 16-Jan-2025 11:24:48 GMT; path=/; SameSite=None; Secure; Priority=High;
                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                  access-control-allow-origin: *
                  x-cache: CONFIG_NOCACHE
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: 1DE2C60C006A43068DACAADF63A90AC6 Ref B: LON04EDGE0714 Ref C: 2023-12-23T11:24:48Z
                  date: Sat, 23 Dec 2023 11:24:47 GMT
                • flag-us
                  GET
                  https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid=
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid= HTTP/2.0
                  host: g.bing.com
                  accept-encoding: gzip, deflate
                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                  cookie: MUID=2B0B66EFC9AC679F18BB751FC88B668A
                  Response
                  HTTP/2.0 204
                  cache-control: no-cache, must-revalidate
                  pragma: no-cache
                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                  set-cookie: MSPTC=SmA9fkhRLdzK9SVyymEBR6bg3MH3dxyw6GAljjXlor4; domain=.bing.com; expires=Thu, 16-Jan-2025 11:24:48 GMT; path=/; Partitioned; secure; SameSite=None
                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                  access-control-allow-origin: *
                  x-cache: CONFIG_NOCACHE
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: A7A181B538C9494781ED0BF013E56907 Ref B: LON04EDGE0714 Ref C: 2023-12-23T11:24:48Z
                  date: Sat, 23 Dec 2023 11:24:48 GMT
                • flag-us
                  GET
                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid=
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid= HTTP/2.0
                  host: g.bing.com
                  accept-encoding: gzip, deflate
                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                  cookie: MUID=2B0B66EFC9AC679F18BB751FC88B668A; MSPTC=SmA9fkhRLdzK9SVyymEBR6bg3MH3dxyw6GAljjXlor4
                  Response
                  HTTP/2.0 204
                  cache-control: no-cache, must-revalidate
                  pragma: no-cache
                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                  access-control-allow-origin: *
                  x-cache: CONFIG_NOCACHE
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: 8661C1424F444A66ACF13FF3D7F47B22 Ref B: LON04EDGE0714 Ref C: 2023-12-23T11:24:49Z
                  date: Sat, 23 Dec 2023 11:24:48 GMT
                • flag-us
                  DNS
                  200.197.79.204.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  200.197.79.204.in-addr.arpa
                  IN PTR
                  Response
                  200.197.79.204.in-addr.arpa
                  IN PTR
                  a-0001a-msedgenet
                • flag-us
                  DNS
                  0.204.248.87.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  0.204.248.87.in-addr.arpa
                  IN PTR
                  Response
                  0.204.248.87.in-addr.arpa
                  IN PTR
                  https-87-248-204-0lhrllnwnet
                • flag-us
                  DNS
                  95.221.229.192.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  95.221.229.192.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  9.228.82.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  9.228.82.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  9.228.82.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  9.228.82.20.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  43.58.199.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  43.58.199.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  83.177.190.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  83.177.190.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  50.23.12.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  50.23.12.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  50.23.12.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  50.23.12.20.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  41.110.16.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  41.110.16.96.in-addr.arpa
                  IN PTR
                  Response
                  41.110.16.96.in-addr.arpa
                  IN PTR
                  a96-16-110-41deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  41.110.16.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  41.110.16.96.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  211.135.221.88.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  211.135.221.88.in-addr.arpa
                  IN PTR
                  Response
                  211.135.221.88.in-addr.arpa
                  IN PTR
                  a88-221-135-211deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  132.4.17.2.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  132.4.17.2.in-addr.arpa
                  IN PTR
                  Response
                  132.4.17.2.in-addr.arpa
                  IN PTR
                  a2-17-4-132deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  103.169.127.40.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  103.169.127.40.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  2.136.104.51.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  2.136.104.51.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  15.164.165.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  15.164.165.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  100.5.17.2.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  100.5.17.2.in-addr.arpa
                  IN PTR
                  Response
                  100.5.17.2.in-addr.arpa
                  IN PTR
                  a2-17-5-100deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  100.5.17.2.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  100.5.17.2.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  119.110.54.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  119.110.54.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  18.134.221.88.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  18.134.221.88.in-addr.arpa
                  IN PTR
                  Response
                  18.134.221.88.in-addr.arpa
                  IN PTR
                  a88-221-134-18deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  174.178.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  174.178.17.96.in-addr.arpa
                  IN PTR
                  Response
                  174.178.17.96.in-addr.arpa
                  IN PTR
                  a96-17-178-174deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  176.178.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  176.178.17.96.in-addr.arpa
                  IN PTR
                  Response
                  176.178.17.96.in-addr.arpa
                  IN PTR
                  a96-17-178-176deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  217.135.221.88.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  217.135.221.88.in-addr.arpa
                  IN PTR
                  Response
                  217.135.221.88.in-addr.arpa
                  IN PTR
                  a88-221-135-217deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  194.178.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  194.178.17.96.in-addr.arpa
                  IN PTR
                  Response
                  194.178.17.96.in-addr.arpa
                  IN PTR
                  a96-17-178-194deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  21.236.111.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  21.236.111.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  211.178.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  211.178.17.96.in-addr.arpa
                  IN PTR
                  Response
                  211.178.17.96.in-addr.arpa
                  IN PTR
                  a96-17-178-211deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  tse1.mm.bing.net
                  Remote address:
                  8.8.8.8:53
                  Request
                  tse1.mm.bing.net
                  IN A
                  Response
                  tse1.mm.bing.net
                  IN CNAME
                  mm-mm.bing.net.trafficmanager.net
                  mm-mm.bing.net.trafficmanager.net
                  IN CNAME
                  dual-a-0001.a-msedge.net
                  dual-a-0001.a-msedge.net
                  IN A
                  204.79.197.200
                  dual-a-0001.a-msedge.net
                  IN A
                  13.107.21.200
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301027_1P8EBE4G3UJALA1HE&pid=21.2&w=1920&h=1080&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317301027_1P8EBE4G3UJALA1HE&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                  Response
                  HTTP/2.0 200
                  cache-control: public, max-age=2592000
                  content-length: 345225
                  content-type: image/jpeg
                  x-cache: TCP_HIT
                  access-control-allow-origin: *
                  access-control-allow-headers: *
                  access-control-allow-methods: GET, POST, OPTIONS
                  timing-allow-origin: *
                  report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                  nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: 21CFF1B355F2480EBE7C1368A35E2F79 Ref B: LON04EDGE0720 Ref C: 2023-12-23T11:26:28Z
                  date: Sat, 23 Dec 2023 11:26:27 GMT
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301161_1PQD10WVMM1NOV9ZI&pid=21.2&w=1920&h=1080&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317301161_1PQD10WVMM1NOV9ZI&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                  Response
                  HTTP/2.0 200
                  cache-control: public, max-age=2592000
                  content-length: 200646
                  content-type: image/jpeg
                  x-cache: TCP_HIT
                  access-control-allow-origin: *
                  access-control-allow-headers: *
                  access-control-allow-methods: GET, POST, OPTIONS
                  timing-allow-origin: *
                  report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                  nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: C8F4739B8242417696CEA7A98E692765 Ref B: LON04EDGE0720 Ref C: 2023-12-23T11:26:28Z
                  date: Sat, 23 Dec 2023 11:26:27 GMT
                • flag-us
                  DNS
                  32.134.221.88.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  32.134.221.88.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  32.134.221.88.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  32.134.221.88.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  32.134.221.88.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  32.134.221.88.in-addr.arpa
                  IN PTR
                • 204.79.197.200:443
                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid=
                  tls, http2
                  2.3kB
                  10.3kB
                  23
                  19

                  HTTP Request

                  GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid=

                  HTTP Response

                  204

                  HTTP Request

                  GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid=

                  HTTP Response

                  204

                  HTTP Request

                  GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3120c660691c4d65ab525a1172d4dda9&localId=w:CB46C7AD-3FBE-4EAF-8E4F-46C212B95A7B&deviceId=6896190258833704&anid=

                  HTTP Response

                  204
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls, http2
                  1.2kB
                  8.3kB
                  16
                  14
                • 204.79.197.200:443
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301161_1PQD10WVMM1NOV9ZI&pid=21.2&w=1920&h=1080&c=4
                  tls, http2
                  6.1kB
                  172.6kB
                  116
                  133

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317301027_1P8EBE4G3UJALA1HE&pid=21.2&w=1920&h=1080&c=4

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317301161_1PQD10WVMM1NOV9ZI&pid=21.2&w=1920&h=1080&c=4

                  HTTP Response

                  200

                  HTTP Response

                  200
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls
                  385 B
                  52 B
                  4
                  1
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls
                  385 B
                  52 B
                  4
                  1
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls
                  385 B
                  52 B
                  4
                  1
                • 96.17.178.211:80
                • 88.221.135.217:80
                • 96.17.178.211:80
                • 88.221.135.217:80
                • 88.221.135.217:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 88.221.135.217:80
                • 88.221.135.217:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.16.110.114:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.16.110.114:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.17.178.211:80
                • 96.16.110.114:80
                • 96.16.110.114:80
                • 8.8.8.8:53
                  149.177.190.20.in-addr.arpa
                  dns
                  73 B
                  159 B
                  1
                  1

                  DNS Request

                  149.177.190.20.in-addr.arpa

                • 8.8.8.8:53
                  59.128.231.4.in-addr.arpa
                  dns
                  71 B
                  157 B
                  1
                  1

                  DNS Request

                  59.128.231.4.in-addr.arpa

                • 8.8.8.8:53
                  g.bing.com
                  dns
                  56 B
                  158 B
                  1
                  1

                  DNS Request

                  g.bing.com

                  DNS Response

                  204.79.197.200
                  13.107.21.200

                • 8.8.8.8:53
                  200.197.79.204.in-addr.arpa
                  dns
                  73 B
                  106 B
                  1
                  1

                  DNS Request

                  200.197.79.204.in-addr.arpa

                • 8.8.8.8:53
                  0.204.248.87.in-addr.arpa
                  dns
                  71 B
                  116 B
                  1
                  1

                  DNS Request

                  0.204.248.87.in-addr.arpa

                • 8.8.8.8:53
                  95.221.229.192.in-addr.arpa
                  dns
                  73 B
                  144 B
                  1
                  1

                  DNS Request

                  95.221.229.192.in-addr.arpa

                • 8.8.8.8:53
                  9.228.82.20.in-addr.arpa
                  dns
                  140 B
                  156 B
                  2
                  1

                  DNS Request

                  9.228.82.20.in-addr.arpa

                  DNS Request

                  9.228.82.20.in-addr.arpa

                • 8.8.8.8:53
                  43.58.199.20.in-addr.arpa
                  dns
                  71 B
                  157 B
                  1
                  1

                  DNS Request

                  43.58.199.20.in-addr.arpa

                • 8.8.8.8:53
                  83.177.190.20.in-addr.arpa
                  dns
                  72 B
                  158 B
                  1
                  1

                  DNS Request

                  83.177.190.20.in-addr.arpa

                • 8.8.8.8:53
                  50.23.12.20.in-addr.arpa
                  dns
                  140 B
                  156 B
                  2
                  1

                  DNS Request

                  50.23.12.20.in-addr.arpa

                  DNS Request

                  50.23.12.20.in-addr.arpa

                • 8.8.8.8:53
                  41.110.16.96.in-addr.arpa
                  dns
                  142 B
                  135 B
                  2
                  1

                  DNS Request

                  41.110.16.96.in-addr.arpa

                  DNS Request

                  41.110.16.96.in-addr.arpa

                • 8.8.8.8:53
                  211.135.221.88.in-addr.arpa
                  dns
                  73 B
                  139 B
                  1
                  1

                  DNS Request

                  211.135.221.88.in-addr.arpa

                • 8.8.8.8:53
                  132.4.17.2.in-addr.arpa
                  dns
                  69 B
                  131 B
                  1
                  1

                  DNS Request

                  132.4.17.2.in-addr.arpa

                • 8.8.8.8:53
                  103.169.127.40.in-addr.arpa
                  dns
                  73 B
                  147 B
                  1
                  1

                  DNS Request

                  103.169.127.40.in-addr.arpa

                • 8.8.8.8:53
                  2.136.104.51.in-addr.arpa
                  dns
                  71 B
                  157 B
                  1
                  1

                  DNS Request

                  2.136.104.51.in-addr.arpa

                • 8.8.8.8:53
                  15.164.165.52.in-addr.arpa
                  dns
                  72 B
                  146 B
                  1
                  1

                  DNS Request

                  15.164.165.52.in-addr.arpa

                • 8.8.8.8:53
                  100.5.17.2.in-addr.arpa
                  dns
                  138 B
                  131 B
                  2
                  1

                  DNS Request

                  100.5.17.2.in-addr.arpa

                  DNS Request

                  100.5.17.2.in-addr.arpa

                • 8.8.8.8:53
                  119.110.54.20.in-addr.arpa
                  dns
                  72 B
                  158 B
                  1
                  1

                  DNS Request

                  119.110.54.20.in-addr.arpa

                • 8.8.8.8:53
                  18.134.221.88.in-addr.arpa
                  dns
                  72 B
                  137 B
                  1
                  1

                  DNS Request

                  18.134.221.88.in-addr.arpa

                • 8.8.8.8:53
                  174.178.17.96.in-addr.arpa
                  dns
                  72 B
                  137 B
                  1
                  1

                  DNS Request

                  174.178.17.96.in-addr.arpa

                • 8.8.8.8:53
                  176.178.17.96.in-addr.arpa
                  dns
                  72 B
                  137 B
                  1
                  1

                  DNS Request

                  176.178.17.96.in-addr.arpa

                • 8.8.8.8:53
                  217.135.221.88.in-addr.arpa
                  dns
                  73 B
                  139 B
                  1
                  1

                  DNS Request

                  217.135.221.88.in-addr.arpa

                • 8.8.8.8:53
                  194.178.17.96.in-addr.arpa
                  dns
                  72 B
                  137 B
                  1
                  1

                  DNS Request

                  194.178.17.96.in-addr.arpa

                • 8.8.8.8:53
                • 8.8.8.8:53
                  21.236.111.52.in-addr.arpa
                  dns
                  72 B
                  158 B
                  1
                  1

                  DNS Request

                  21.236.111.52.in-addr.arpa

                • 8.8.8.8:53
                  211.178.17.96.in-addr.arpa
                  dns
                  72 B
                  137 B
                  1
                  1

                  DNS Request

                  211.178.17.96.in-addr.arpa

                • 8.8.8.8:53
                  tse1.mm.bing.net
                  dns
                  62 B
                  173 B
                  1
                  1

                  DNS Request

                  tse1.mm.bing.net

                  DNS Response

                  204.79.197.200
                  13.107.21.200

                • 8.8.8.8:53
                • 8.8.8.8:53
                • 8.8.8.8:53
                  32.134.221.88.in-addr.arpa
                  dns
                  216 B
                  3

                  DNS Request

                  32.134.221.88.in-addr.arpa

                  DNS Request

                  32.134.221.88.in-addr.arpa

                  DNS Request

                  32.134.221.88.in-addr.arpa

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                  Filesize

                  64KB

                  MD5

                  70b5cec7422c4403d8722b3a55f014a9

                  SHA1

                  8bc80ed9138de793505bc594ff15943d8b7242e4

                  SHA256

                  11a3e119e59451f31acce8d77e65a902c46379eabfaaeb635c14c3b74c93c581

                  SHA512

                  18319bbb4108ad830ba57bf9f5c3b4d20c442e1a9788c3d2cd04f5a223f04ad669d63f60588ab85000bf732b43d9cab5b98ddf011e100fecd1a347ce7bc83eb0

                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                  Filesize

                  36KB

                  MD5

                  b30d3becc8731792523d599d949e63f5

                  SHA1

                  19350257e42d7aee17fb3bf139a9d3adb330fad4

                  SHA256

                  b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                  SHA512

                  523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                  Filesize

                  56KB

                  MD5

                  752a1f26b18748311b691c7d8fc20633

                  SHA1

                  c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                  SHA256

                  111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                  SHA512

                  a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                • memory/4976-26-0x000000000B680000-0x000000000B6D0000-memory.dmp

                  Filesize

                  320KB

                • memory/4976-27-0x000000000B680000-0x000000000B6A1000-memory.dmp

                  Filesize

                  132KB

                We care about your privacy.

                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.