Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 21:13 UTC

General

  • Target

    1027edcd48599b9f8eca496744cf74b8_JaffaCakes118.pdf

  • Size

    76KB

  • MD5

    1027edcd48599b9f8eca496744cf74b8

  • SHA1

    f4a664d8381c9b77240f4f656ce9aa5de23159f2

  • SHA256

    a9fc5370a99829dac41891fa2f9f1253084d00ebd884961ad619b41a96ea40ac

  • SHA512

    66a2b4137e7164167b93eb3a544f6892007b1314f3933865e9dad0c4f285fe456318ea91f4d0a7a4d686d81dd0ed529ff6070c6da4f99ee3a119142100a9461f

  • SSDEEP

    1536:6lqJI/KWzDGUpx5vrE7idhDq00YI6y+W7JBnGW8pO7yG1kU/:sqJIJW64fYIBBnl7yG19

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1027edcd48599b9f8eca496744cf74b8_JaffaCakes118.pdf"
    1⤵
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5173424DAF826D9D3E10868753A5CF68 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        3⤵
          PID:3620
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7ABD49E59482B101AFDBAF0968AD2999 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7ABD49E59482B101AFDBAF0968AD2999 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
          3⤵
            PID:2812
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=037C784D8FD78F85DA95C5B765485669 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=037C784D8FD78F85DA95C5B765485669 --renderer-client-id=4 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job /prefetch:1
            3⤵
              PID:3200
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F985803308A0A5133F6749F1F5E7D17A --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              3⤵
                PID:3344
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C52C536B88177D63DF9401CDF6D4B76E --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                3⤵
                  PID:1072
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E945320F682190AD67A139AA42DF79A0 --mojo-platform-channel-handle=2528 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  3⤵
                    PID:2088
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:3160
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
                  1⤵
                    PID:5196

                  Network

                  • flag-us
                    DNS
                    2.159.190.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    2.159.190.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    232.168.11.51.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    232.168.11.51.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    41.134.221.88.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    41.134.221.88.in-addr.arpa
                    IN PTR
                    Response
                    41.134.221.88.in-addr.arpa
                    IN PTR
                    a88-221-134-41deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    241.154.82.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    241.154.82.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    41.110.16.96.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    41.110.16.96.in-addr.arpa
                    IN PTR
                    Response
                    41.110.16.96.in-addr.arpa
                    IN PTR
                    a96-16-110-41deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    205.47.74.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    205.47.74.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    183.142.211.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    183.142.211.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    135.240.123.92.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    135.240.123.92.in-addr.arpa
                    IN PTR
                    Response
                    135.240.123.92.in-addr.arpa
                    IN PTR
                    a92-123-240-135deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    217.106.137.52.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    217.106.137.52.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    240.66.18.2.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    240.66.18.2.in-addr.arpa
                    IN PTR
                    Response
                    240.66.18.2.in-addr.arpa
                    IN PTR
                    a2-18-66-240deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    157.123.68.40.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    157.123.68.40.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    206.23.85.13.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    206.23.85.13.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    98.117.19.2.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    98.117.19.2.in-addr.arpa
                    IN PTR
                    Response
                    98.117.19.2.in-addr.arpa
                    IN PTR
                    a2-19-117-98deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    240.221.184.93.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    240.221.184.93.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    26.35.223.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    26.35.223.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    tse1.mm.bing.net
                    Remote address:
                    8.8.8.8:53
                    Request
                    tse1.mm.bing.net
                    IN A
                    Response
                    tse1.mm.bing.net
                    IN CNAME
                    mm-mm.bing.net.trafficmanager.net
                    mm-mm.bing.net.trafficmanager.net
                    IN CNAME
                    dual-a-0001.a-msedge.net
                    dual-a-0001.a-msedge.net
                    IN A
                    204.79.197.200
                    dual-a-0001.a-msedge.net
                    IN A
                    13.107.21.200
                  • flag-us
                    GET
                    https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                    Remote address:
                    204.79.197.200:443
                    Request
                    GET /th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                    host: tse1.mm.bing.net
                    accept: */*
                    accept-encoding: gzip, deflate, br
                    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                    Response
                    HTTP/2.0 200
                    cache-control: public, max-age=2592000
                    content-length: 586035
                    content-type: image/jpeg
                    x-cache: TCP_HIT
                    access-control-allow-origin: *
                    access-control-allow-headers: *
                    access-control-allow-methods: GET, POST, OPTIONS
                    timing-allow-origin: *
                    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    x-msedge-ref: Ref A: 3B4C371AA20C40DEB6380A815175F3EC Ref B: FRA31EDGE0508 Ref C: 2024-03-28T21:15:49Z
                    date: Thu, 28 Mar 2024 21:15:49 GMT
                  • flag-us
                    GET
                    https://tse1.mm.bing.net/th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                    Remote address:
                    204.79.197.200:443
                    Request
                    GET /th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                    host: tse1.mm.bing.net
                    accept: */*
                    accept-encoding: gzip, deflate, br
                    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                    Response
                    HTTP/2.0 200
                    cache-control: public, max-age=2592000
                    content-length: 550329
                    content-type: image/jpeg
                    x-cache: TCP_HIT
                    access-control-allow-origin: *
                    access-control-allow-headers: *
                    access-control-allow-methods: GET, POST, OPTIONS
                    timing-allow-origin: *
                    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    x-msedge-ref: Ref A: 9B4C8A6EAF8249D4948D029CAB1A04A1 Ref B: FRA31EDGE0508 Ref C: 2024-03-28T21:15:49Z
                    date: Thu, 28 Mar 2024 21:15:49 GMT
                  • flag-us
                    GET
                    https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                    Remote address:
                    204.79.197.200:443
                    Request
                    GET /th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                    host: tse1.mm.bing.net
                    accept: */*
                    accept-encoding: gzip, deflate, br
                    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                    Response
                    HTTP/2.0 200
                    cache-control: public, max-age=2592000
                    content-length: 906468
                    content-type: image/jpeg
                    x-cache: TCP_HIT
                    access-control-allow-origin: *
                    access-control-allow-headers: *
                    access-control-allow-methods: GET, POST, OPTIONS
                    timing-allow-origin: *
                    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    x-msedge-ref: Ref A: F528B61611B34F93BAE8ACFB81151146 Ref B: FRA31EDGE0508 Ref C: 2024-03-28T21:15:49Z
                    date: Thu, 28 Mar 2024 21:15:49 GMT
                  • flag-us
                    GET
                    https://tse1.mm.bing.net/th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                    Remote address:
                    204.79.197.200:443
                    Request
                    GET /th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                    host: tse1.mm.bing.net
                    accept: */*
                    accept-encoding: gzip, deflate, br
                    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                    Response
                    HTTP/2.0 200
                    cache-control: public, max-age=2592000
                    content-length: 1145289
                    content-type: image/jpeg
                    x-cache: TCP_HIT
                    access-control-allow-origin: *
                    access-control-allow-headers: *
                    access-control-allow-methods: GET, POST, OPTIONS
                    timing-allow-origin: *
                    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    x-msedge-ref: Ref A: 79233A9287E14082911F9B2DF487C7BA Ref B: FRA31EDGE0508 Ref C: 2024-03-28T21:15:49Z
                    date: Thu, 28 Mar 2024 21:15:49 GMT
                  • flag-us
                    DNS
                    198.111.78.13.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    198.111.78.13.in-addr.arpa
                    IN PTR
                    Response
                  • 204.79.197.200:443
                    https://tse1.mm.bing.net/th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                    tls, http2
                    120.9kB
                    3.3MB
                    2411
                    2400

                    HTTP Request

                    GET https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                    HTTP Request

                    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                    HTTP Request

                    GET https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                    HTTP Request

                    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                    HTTP Response

                    200

                    HTTP Response

                    200

                    HTTP Response

                    200

                    HTTP Response

                    200
                  • 204.79.197.200:443
                    tse1.mm.bing.net
                    tls, http2
                    1.6kB
                    9.4kB
                    19
                    13
                  • 204.79.197.200:443
                    tse1.mm.bing.net
                    tls, http2
                    1.6kB
                    9.4kB
                    19
                    13
                  • 204.79.197.200:443
                    tse1.mm.bing.net
                    tls, http2
                    1.7kB
                    9.5kB
                    20
                    14
                  • 8.8.8.8:53
                    2.159.190.20.in-addr.arpa
                    dns
                    71 B
                    157 B
                    1
                    1

                    DNS Request

                    2.159.190.20.in-addr.arpa

                  • 8.8.8.8:53
                    232.168.11.51.in-addr.arpa
                    dns
                    72 B
                    158 B
                    1
                    1

                    DNS Request

                    232.168.11.51.in-addr.arpa

                  • 8.8.8.8:53
                    41.134.221.88.in-addr.arpa
                    dns
                    72 B
                    137 B
                    1
                    1

                    DNS Request

                    41.134.221.88.in-addr.arpa

                  • 8.8.8.8:53
                    241.154.82.20.in-addr.arpa
                    dns
                    72 B
                    158 B
                    1
                    1

                    DNS Request

                    241.154.82.20.in-addr.arpa

                  • 8.8.8.8:53
                    41.110.16.96.in-addr.arpa
                    dns
                    71 B
                    135 B
                    1
                    1

                    DNS Request

                    41.110.16.96.in-addr.arpa

                  • 8.8.8.8:53
                    205.47.74.20.in-addr.arpa
                    dns
                    71 B
                    157 B
                    1
                    1

                    DNS Request

                    205.47.74.20.in-addr.arpa

                  • 8.8.8.8:53
                    183.142.211.20.in-addr.arpa
                    dns
                    73 B
                    159 B
                    1
                    1

                    DNS Request

                    183.142.211.20.in-addr.arpa

                  • 8.8.8.8:53
                    135.240.123.92.in-addr.arpa
                    dns
                    73 B
                    139 B
                    1
                    1

                    DNS Request

                    135.240.123.92.in-addr.arpa

                  • 8.8.8.8:53
                    217.106.137.52.in-addr.arpa
                    dns
                    73 B
                    147 B
                    1
                    1

                    DNS Request

                    217.106.137.52.in-addr.arpa

                  • 8.8.8.8:53
                    240.66.18.2.in-addr.arpa
                    dns
                    70 B
                    133 B
                    1
                    1

                    DNS Request

                    240.66.18.2.in-addr.arpa

                  • 8.8.8.8:53
                    157.123.68.40.in-addr.arpa
                    dns
                    72 B
                    146 B
                    1
                    1

                    DNS Request

                    157.123.68.40.in-addr.arpa

                  • 8.8.8.8:53
                    206.23.85.13.in-addr.arpa
                    dns
                    71 B
                    145 B
                    1
                    1

                    DNS Request

                    206.23.85.13.in-addr.arpa

                  • 8.8.8.8:53
                    98.117.19.2.in-addr.arpa
                    dns
                    70 B
                    133 B
                    1
                    1

                    DNS Request

                    98.117.19.2.in-addr.arpa

                  • 8.8.8.8:53
                    240.221.184.93.in-addr.arpa
                    dns
                    73 B
                    144 B
                    1
                    1

                    DNS Request

                    240.221.184.93.in-addr.arpa

                  • 8.8.8.8:53
                    26.35.223.20.in-addr.arpa
                    dns
                    71 B
                    157 B
                    1
                    1

                    DNS Request

                    26.35.223.20.in-addr.arpa

                  • 8.8.8.8:53
                    tse1.mm.bing.net
                    dns
                    62 B
                    173 B
                    1
                    1

                    DNS Request

                    tse1.mm.bing.net

                    DNS Response

                    204.79.197.200
                    13.107.21.200

                  • 8.8.8.8:53
                    198.111.78.13.in-addr.arpa
                    dns
                    72 B
                    146 B
                    1
                    1

                    DNS Request

                    198.111.78.13.in-addr.arpa

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Filesize

                    64KB

                    MD5

                    c128d049bb98d8ef2c8b89b74238432e

                    SHA1

                    1c3991923bf2e3b8ada8df3308d5ea16f91e545f

                    SHA256

                    c6a10e1b9da86e9433c41aac461a53a7884c4d87b1108cad826dd448941a21f8

                    SHA512

                    92b602a338f2134cdceb45f7ca05ea777b8596e12a1d71f08fd5112c88c1fb5cd51c7b68977d55029517243602fbd3f446afcdb2411352d5663900080718be83

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Filesize

                    36KB

                    MD5

                    b30d3becc8731792523d599d949e63f5

                    SHA1

                    19350257e42d7aee17fb3bf139a9d3adb330fad4

                    SHA256

                    b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                    SHA512

                    523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Filesize

                    56KB

                    MD5

                    752a1f26b18748311b691c7d8fc20633

                    SHA1

                    c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                    SHA256

                    111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                    SHA512

                    a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                  We care about your privacy.

                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.